replace single stage Dockerfile by build.Dockerfile

the additional build step takes a few seconds extra, but this way we only need to maintain a single file, without duplication

.github/workflows/docker-publish.yml

@@ -20,5 +20,5 @@ jobs:
     uses: FAIRDataTeam/github-workflows/.github/workflows/docker-publish.yml@v2
     secrets: inherit
     with:
-      file: './build.Dockerfile'
+      file: './Dockerfile'
       push: ${{ github.event_name == 'release' && github.event.action == 'created' }}

Dockerfile

@@ -21,11 +21,33 @@
 # THE SOFTWARE.
 #
 
+# https://docs.docker.com/reference/dockerfile/#syntax
+# syntax=docker/dockerfile:1
+
+################################################################################
+# BUILD JAR
+
+FROM maven:3-eclipse-temurin-21-alpine AS builder
+
+WORKDIR /builder
+
+ADD . /builder
+
+# https://maven.apache.org/ref/current/maven-embedder/cli.html
+RUN mvn --quiet --batch-mode --update-snapshots --fail-fast -DskipTests package
+
+################################################################################
+# BUILD IMAGE
+
 FROM eclipse-temurin:21-jdk-alpine
 
+# add non-root user to run the app
+# https://spring.io/guides/gs/spring-boot-docker
+RUN addgroup -S spring && adduser -S spring -G spring
+USER spring:spring
+
 WORKDIR /fdp
 
-ADD target/fdp-spring-boot.jar /fdp/app.jar
-ADD target/classes/application-production.yml /fdp/application.yml
+COPY --from=builder /builder/target/fdp-spring-boot.jar /fdp/app.jar
 
-ENTRYPOINT java -jar app.jar --spring.profiles.active=production --spring.config.location=classpath:/application.yml,classpath:/application-production.yml,file:/fdp/application.yml
+ENTRYPOINT ["java", "-jar", "app.jar"]