FROM python:3.12-slim

WORKDIR /app

# Copy space app files
COPY . /app

# Install dependencies
RUN pip install --no-cache-dir -r requirements.txt

# Set environment for dataset download
ENV HF_HUB_DOWNLOAD_TIMEOUT=120

# Fetch benchmark tasks from Hugging Face dataset at BUILD time (immutable in image).
# Reverted from runtime fetch (F4) back to build-time fetch per peer review C3/C5:
# runtime fetch from a public admin-writable dataset introduced a supply-chain attack
# surface (poisoned verify.py auto-propagating into the Space). Build-time fetch bakes
# the dataset into the immutable Docker image — dataset updates require a deliberate
# rebuild, which acts as a safety check.
RUN pip install --no-cache-dir huggingface-hub && \
    python -c "from huggingface_hub import snapshot_download; snapshot_download('hummbl-hf/governance-bench', repo_type='dataset', local_dir='/bench')"

# Verify download
RUN ls /bench/tasks/ | head -5

# Set environment
ENV BENCH_ROOT=/bench
ENV PYTHONPATH=/bench/scripts:/app

EXPOSE 7860

CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]