Dockerfile.deps

# Dependencies-only image for faster CI builds
# This image pre-compiles all Haskell dependencies
# Rebuilt weekly or when cabal files change

# Bump in lockstep with cabal.project's `with-compiler: ghc-X.Y.Z`.
ARG GHC_VERSION=9.12.2
FROM haskell:${GHC_VERSION}

# The upstream image installs the pinned compiler under /opt/ghc but does not
# guarantee that directory is on PATH. Cabal's project file deliberately names
# ghc-${GHC_VERSION}; make that executable available to both GitHub container
# jobs and the local Compose runner.
ARG GHC_VERSION
ENV PATH="/opt/ghc/${GHC_VERSION}/bin:${PATH}"

# Install system dependencies (combined into single layer)
RUN apt-get update && apt-get install -y \
  curl ca-certificates lsb-release gnupg \
  libssl-dev librdkafka-dev libsnappy-dev libgrpc-dev \
  libpq-dev libldap2-dev libsasl2-dev liblz4-dev libzstd-dev \
  pkg-config git wget unzip \
  && curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor -o /usr/share/keyrings/postgresql-keyring.gpg \
  && echo "deb [signed-by=/usr/share/keyrings/postgresql-keyring.gpg] http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
  && apt-get update && apt-get install -y postgresql-client-16 \
  && rm -rf /var/lib/apt/lists/*

# Install protoc
RUN PROTOC_VERSION=29.3 && \
  ARCH=$(dpkg --print-architecture | sed 's/arm64/aarch_64/;s/amd64/x86_64/') && \
  wget -q https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-${ARCH}.zip && \
  unzip -q protoc-${PROTOC_VERSION}-linux-${ARCH}.zip -d /usr/local && \
  rm protoc-${PROTOC_VERSION}-linux-${ARCH}.zip

# Install Node.js and bun for frontend builds
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
  apt-get install -y nodejs && \
  npm install -g bun workbox-cli@6.5.4 && \
  rm -rf /var/lib/apt/lists/*

WORKDIR /build

# Fix cabal state to a known path so GHA containers (which override HOME) can find it
ENV CABAL_DIR=/root/.cabal

# Copy only files needed for dependency resolution. cabal.project lists shared/ and
# cli/ as packages, so their .cabal files must be present or `cabal configure` fails
# with "The package location 'shared/' does not exist" — which is what silently broke
# every deps-image build (and therefore every deploy) after the CLI package split.
# Only the .cabal files, so a source edit doesn't invalidate the dependency layer.
COPY *.cabal cabal.project* Setup.hs LICENSE ./
COPY shared/*.cabal ./shared/
COPY cli/*.cabal ./cli/

# Update cabal index and build all dependencies (including test deps), BOTH ways.
#
# `profiling: True` is part of a dependency's store hash, so the prof-way store
# entries are a *different* set of directories from the vanilla ones — they do not
# substitute for each other. Building only the prof way (which is what this did
# until 2026-09-16) left CI's ordinary `cabal build all` with an empty store: all
# 434 dependencies recompiled in-job, every run, which is the whole of the ~31min
# "Build" step and most of the Deploy workflow's wall clock.
#
# Vanilla first and last so the final cabal.project.local in the image is the one
# CI's checkout would produce (no profiling stanza); the prod image (see
# Dockerfile) appends its own stanza and hits the prof-way half of the store.
RUN cabal update && \
  cabal configure --enable-tests --enable-benchmarks && \
  cabal build --only-dependencies all -j$(nproc) && \
  cp cabal.project.local cabal.project.local.vanilla && \
  printf 'package *\n  profiling: True\n  profiling-detail: none\npackage monoscope\n  profiling-detail: late\n' >> cabal.project.local && \
  cabal build --only-dependencies all -j$(nproc) && \
  mv cabal.project.local.vanilla cabal.project.local

# Pre-install npm dependencies for faster deploys
COPY package*.json ./
RUN npm ci --prefer-offline --no-audit

COPY web-components/package*.json ./web-components/
RUN cd web-components && npm ci --prefer-online --no-audit

# Build chart-cli (pre-compiled for faster deployments)
COPY web-components ./web-components
RUN cd web-components && bun build --compile src/chart-cli.ts --outfile /usr/local/bin/chart-cli && \
  chmod +x /usr/local/bin/chart-cli

COPY e2e/package*.json ./e2e/
RUN cd e2e && npm ci --prefer-offline --no-audit && \
  npx playwright install --with-deps chromium && \
  touch /usr/local/share/monoscope-playwright-deps

# The resulting image contains:
# - All system libraries
# - GHC (from ARG GHC_VERSION above)
# - protoc
# - Node.js, bun, workbox-cli, and pre-built chart-cli
# - All npm dependencies pre-installed
# - All Haskell dependencies pre-compiled in ~/.cabal/store