Dockerfile.tests

# Tests image — extends the runtime image with pytest + dev deps + tests/.
#
# Used by the chart's `helm.sh/hook: test` Pod (templates/tests/test-rls.yaml)
# to run the RLS integration tests against the in-cluster Postgres via the
# real Vault Agent + Istio mTLS path. ADR-043 §"test integration".
#
# Why a dedicated Dockerfile (Chart-A, 2026-05-13):
#   When this lived as a third `FROM runtime AS tests` stage in the main
#   Dockerfile, `docker build .` (no --target) silently produced the
#   tests image — whose ENTRYPOINT is pytest. Kubelet then ran pytest
#   once, exited 0, and CrashLoopBackOff'd with `Reason: Completed`.
#   The bug trip-wired on PR-B10 CI run #3 (2026-05-13) and was
#   shipped as the `--target runtime` workaround there. Chart-A
#   removes the trap by splitting the test image out entirely.
#
# Usage:
#   docker build -f Dockerfile.tests \
#                --build-arg TESTS_BASE_IMAGE=audittrace-ai:latest \
#                -t localhost:5000/audittrace/tests:latest .
#
# TESTS_BASE_IMAGE defaults to the same tag the local Makefile builds
# (`audittrace-ai:latest`); CI / release pipelines should override to
# the immutable published runtime tag they want to validate (e.g.
# `lfds/audittrace-memory-server:v1.0.20`).

ARG TESTS_BASE_IMAGE=audittrace-ai:latest
FROM ${TESTS_BASE_IMAGE}

USER root
# DEP-LOCK-AT (ADR-065): the tests image installs the HASHED dev lock instead
# of an inline range list (the old `pytest>=...` / unpinned `psycopg2-binary`).
# It duplicates the runtime packages that already sit in sovereign's
# ~/.local — acceptable (spec gate A3): the system site-packages copy is the
# hashed, exact one the tests run against.
COPY requirements-dev.txt /tmp/requirements-dev.txt
RUN pip install --no-cache-dir --require-hashes --only-binary=:all: -r /tmp/requirements-dev.txt && \
    rm /tmp/requirements-dev.txt

COPY tests/ /app/tests/
COPY pyproject.toml /app/

USER sovereign
WORKDIR /app

ENTRYPOINT ["pytest"]
CMD ["tests/test_rls_isolation.py", "-v", "--no-cov"]