Dockerfile.test

# Test-runner image for the docker-compose E2E suite (docker-compose.test.yml,
# profile "test"). It only needs the Go toolchain and the stdlib-only module
# under tests/e2e, so the build is fast and independent of the app's
# dependency tree.
#
# Base image pinned by digest for the same supply-chain reasons as Dockerfile;
# keep the digest in sync with the builder stage there.
FROM golang:1.26.6-alpine3.24@sha256:3889b425f035be855a72fb4755265311293b6d414521f0a519d819df32222d83

# Run the suite as a non-root user (trivy DS-0002). tests/e2e is a stdlib-only
# module so no module downloads are needed; GOCACHE lives in the user's home,
# which it owns and can write to during both the pre-compile below and the
# runtime CMD.
RUN adduser -D -u 10001 e2e
ENV GOCACHE=/home/e2e/.cache/go-build

WORKDIR /e2e

COPY --chown=e2e:e2e tests/e2e/ ./

# Numeric form so the identity is resolvable without the image's /etc/passwd.
# 10001 is exactly the uid created above, so this is a rename only.
USER 10001

# Pre-compile the test binary so `docker compose up` failures are runtime
# failures, not compile errors discovered after the stack is already up.
RUN go vet -tags=e2e ./... && go test -tags=e2e -run NONE ./...

# docker-compose.test.yml overrides the command; this default keeps the image
# usable standalone.
CMD ["go", "test", "-v", "-tags=e2e", "./..."]