FROM python:3.12-slim

WORKDIR /app

COPY requirements.txt .
RUN pip install uv && uv pip install --system --no-cache-dir -r requirements.txt

COPY app/ ./app/
COPY tests/ ./tests/

# Stamped by CI so /health can prove WHICH build is running. A deploy that
# reports success while the old container keeps running is otherwise silent
# -- exactly how production served two-day-old code for two days.
ARG GIT_SHA=unknown
ENV GIT_SHA=$GIT_SHA

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]