Makefile

CONTAINER_ENGINE?=$(shell command -v podman 2>/dev/null || echo docker)
LEFTHOOK_CMD=go tool lefthook
GOLANGCI_LINT_VERSION=v2.12.2
GOLANGCI_LINT_PACKAGE=github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)
DEPENDENCY_MIN_AGE_DAYS=14
PNPM_MIN_VERSION=11.15.1
PNPM?=pnpm

# --- Image registry and tags ---
IMAGE_REGISTRY?=quay.io/redhat-services-prod/hcm-eng-prod-tenant/hypershell-main
IMAGE_TAG?=latest

# Build version (embedded in api-server binary via ldflags)
git_sha:=$(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
git_dirty:=$(shell git diff --quiet 2>/dev/null || echo -modified)
build_version:=$(git_sha)$(git_dirty)
build_time:=$(shell date -u '+%Y-%m-%d %H:%M:%S UTC')

# Computed baseline references (registry images used in Kind manifests)
api_server_ref=$(IMAGE_REGISTRY)/hypershell-api-server-main:$(IMAGE_TAG)
control_plane_ref=$(IMAGE_REGISTRY)/hypershell-control-plane-main:$(IMAGE_TAG)
web_console_ref=$(IMAGE_REGISTRY)/hypershell-web-console-main:$(IMAGE_TAG)

# Local dev image names
api_server_local=localhost/hypershell:dev
control_plane_local=localhost/hypershell-controller:dev
web_console_local=localhost/hypershell-web-console:dev

# --- Kind cluster configuration ---
KIND_CLUSTER_NAME?=hypershell-dev
KIND_NAMESPACE?=hypershell-system
KIND_HOT_RELOAD?=true
KIND_HOST_MOUNT_PATH?=$(shell git rev-parse --show-toplevel 2>/dev/null || pwd)
KIND_KEYCLOAK_URL?=
LOCAL_IMAGES?=
PULL_SECRET?=
KIND_PULL_SECRET?=

# Prerequisite versions
GATEWAY_API_VERSION?=v1.5.1
# kind v0.32.0 has a podman 6+ ListClusters bug (kubernetes-sigs/kind#4231).
# Pin to a main commit that includes the fix (kubernetes-sigs/kind#4203) until
# the next kind release ships it.  go install uses Go pseudo-versions.
KIND_VERSION?=v0.32.1-0.20260811083914-7650cab268f5
# Build from fork with BackendTLSPolicy support until upstreamed. Pin an exact
# commit (mirrors the KIND_VERSION pseudo-version pin above) so every developer
# builds the same deterministic binary instead of tracking the moving branch
# tip. CLOUD_PROVIDER_KIND_REF is the tip of branch `hypershell` at pin time;
# bump it when the fork advances. The binary auto-stamps this commit as
# vcs.revision, which kind-prereqs uses to skip rebuilds that are already current.
CLOUD_PROVIDER_KIND_REPO?=https://github.com/squizzi/cloud-provider-kind.git
CLOUD_PROVIDER_KIND_REF?=08ce4ea4cc10bce8ffbcf4f859a086bb6b292230
# Optional testing override: build from a branch tip (or any git ref) instead of
# the pinned REF, e.g. `CLOUD_PROVIDER_KIND_BRANCH=my-experiment make kind-up`.
# Empty by default so normal builds stay deterministic and idempotent-by-SHA.
# When set, kind-prereqs always rebuilds from that ref and records the commit it
# actually resolved to, so up.sh restarts to pick up a moved branch tip.
CLOUD_PROVIDER_KIND_BRANCH?=
CERT_MANAGER_VERSION?=v1.21.1
AGENT_SANDBOX_VERSION?=v0.5.6

# Kind config
KIND_CONFIG=deploy/kind/kind-config.yaml
KIND_DNS_PORT?=5553

# OpenShift ephemeral-namespace development. The cluster is a precondition;
# these names select the shared Gateway the administrator already provisioned.
# The gateway base domain is discovered from that Gateway's listener hostname.
GATEWAY_API_GATEWAY_NAME?=openshell-grpc-gateway
GATEWAY_API_GATEWAY_NAMESPACE?=openshift-ingress
GATEWAY_IMAGE?=$(shell . ./OPENSHELL_VERSION && echo "$${OPENSHELL_GATEWAY_IMAGE}:$${OPENSHELL_TAG}")
# Single supported OpenShell release, stamped onto the controller image as the
# app.hypershell.openshell.version label (specs/platform/openshell-image-auto-update.spec.md).
OPENSHELL_TAG?=$(shell . ./OPENSHELL_VERSION && echo "$${OPENSHELL_TAG}")

# Service hostnames (routed through the networking Gateway)
API_HOSTNAME=api.hypershell.localhost
CONSOLE_HOSTNAME=console.hypershell.localhost
HEALTH_HOSTNAME=health.hypershell.localhost
KEYCLOAK_HOSTNAME=keycloak.hypershell.localhost
METRICS_HOSTNAME=observability.hypershell.localhost
KEYCLOAK_OIDC_ISSUER?=https://$(KEYCLOAK_HOSTNAME)/realms/hypershell

# ============================================================================
# Help
# ============================================================================

.PHONY: help
help:
	@echo ""
	@echo "  HyperShell Makefile"
	@echo "  ==================="
	@echo ""
	@echo "  Local Fullsend agents"
	@echo "    fullsend                      Start or resume the dispatcher (watch mode)"
	@echo "    fullsend-status               Show persisted job state"
	@echo "    fullsend-doctor               Check local tools and credential configuration"
	@echo "    fullsend-help                 Show local commands and setup help"
	@echo "    Setup: docs/development/fullsend.md"
	@echo ""
	@echo "  Local Development"
	@echo "    Targets are kind-<name> or openshift-<name>. They do the same work."
	@echo ""
	@echo "    Kind uses KIND_NAMESPACE (default hypershell-system); kind-up creates the cluster."
	@echo "    OpenShift uses the current oc project (oc project -q); OPENSHIFT_NAMESPACE overrides."
	@echo "    OpenShift requires an existing cluster; openshift-up does not create one."
	@echo ""
	@echo "    <prefix>-up                   Deploy the stack (Kind also creates the cluster)"
	@echo "    <prefix>-down                 Remove the environment namespace(s)"
	@echo "    <prefix>-teardown             Kind: destroy the cluster. OpenShift: same as -down"
	@echo "    <prefix>-status               Show cluster, pods, services/Routes, swap state"
	@echo "    <prefix>-api-server-up        Build + swap API server from working tree"
	@echo "    <prefix>-api-server-down      Revert API server to baseline image"
	@echo "    <prefix>-control-plane-up     Build + swap control plane from working tree"
	@echo "    <prefix>-control-plane-down   Revert control plane to baseline image"
	@echo "    <prefix>-web-console-up       Swap web console (Kind: hot reload by default)"
	@echo "    <prefix>-web-console-down     Revert web console to baseline image"
	@echo ""
	@echo "    Kind Specific"
	@echo "    kind-env                 Print environment variables for local setup"
	@echo "    kind-up                  Create cluster + deploy all components (OIDC enabled)"
	@echo "                             LOCAL_IMAGES=true: build from working tree (default)"
	@echo "                             LOCAL_IMAGES=true BUILD_SOURCE=baseline: build from origin/main"
	@echo "                             LOCAL_IMAGES=true KIND_SKIP_BUILD=true: reuse existing local images"
	@echo "                             KIND_SKIP_SEED=true: defer seeding (run kind-seed later)"
	@echo "                             KIND_COVERAGE=true: coverage-instrumented images (implies LOCAL_IMAGES=true)"
	@echo "    kind-seed                Seed platform resources into a running cluster"
	@echo "    kind-reconcile-keycloak-users  Assign platform:admin to admin on stale Keycloak imports"
	@echo "                             SKIP_SEED=true: defer seeding during kind-up / openshift-up"
	@echo "                             SEED_STRICT=true: fail the command if seeding is incomplete"
	@echo "                             FORCE=true: openshift-down skips ownership labels (still refuses reserved names)"
	@echo "    kind-fix-ports           Re-establish host port forwarding (443 + 8080) and sync in-cluster CoreDNS gateway IP"
	@echo "    kind-gateway-trust       Print SSL_CERT_FILE export so the openshell CLI trusts the dev CA"
	@echo "    kind-openshell           Run the openshell CLI via Kind's own network (works on macOS with no native CLI build)"
	@echo "                             ARGS=\"-g dev sandbox create\""
	@echo "    LOCAL_IMAGES=true        Build baseline images from the working tree (kind-up)"
	@echo "    BUILD_SOURCE=baseline    With LOCAL_IMAGES=true, build from origin/main"
	@echo ""
	@echo "  Tools"
	@echo "    spec-ui                  Browse and search specs/ in a local web UI"
	@echo "                             SPEC_VIEWER_PORT=5180, SPEC_VIEWER_SPECS_DIR=../../specs"
	@echo ""
	@echo "  Build"
	@echo "    build-all                Build all container images"
	@echo "    build-api-server         Build API server container image"
	@echo "    build-cli                Regenerate the generated commands, then build the CLI binary"
	@echo "    build-controller         Build control plane container image"
	@echo "    build-web-console        Build web console container image"
	@echo ""
	@echo "  Test & Lint"
	@echo "    unit-test-all            Run all unit test suites (Go, frontend, shell)"
	@echo "    ci-test                  Run all *_test.sh shell unit tests (auto-discovered)"
	@echo "    e2e                      Run E2E tests against target KUBECONFIG cluster"
	@echo "    e2e-console              Run Playwright E2E of the web console and OpenShell console"
	@echo "    coverage                 Run unit + e2e tests and build a combined coverage report in coverage/"
	@echo "                             (e2e part needs KIND_COVERAGE=true make kind-up; COVERAGE_E2E=false skips it)"
	@echo "    coverage-report          Rebuild coverage/report from the data of the last coverage run"
	@echo "    e2e-performance          Run the performance benchmark (modify with E2E_PERF_GATEWAY_COUNT, E2E_PERF_BATCH_SIZE)"
	@echo "    lint                     Run all linters (Go + JS/TS)"
	@echo "    lint-api-server          Lint API server (gofmt, go vet, golangci-lint)"
	@echo "    lint-cli                 Lint CLI (gofmt, go vet, golangci-lint)"
	@echo "    lint-control-plane       Lint control plane (gofmt, go vet, golangci-lint)"
	@echo "    lint-sdk-typescript      Lint TypeScript SDK"
	@echo "    lint-gateway-management-ui  Lint gateway management UI package"
	@echo "    lint-web-console         Lint web console (app + BFF)"
	@echo "    lint-spec-viewer         Lint spec viewer"
	@echo ""
	@echo "  Policy"
	@echo "    check                    Run all policy checks"
	@echo "    check-forbidden-terms    Check for forbidden or discouraged text"
	@echo "    check-dependency-pins    Verify dependency version pins"
	@echo "    check-dependency-age     Verify dependency minimum age"
	@echo "    check-ci-components      Verify CI component registration"
	@echo "    check-deploy-orphans     Verify every deploy/base manifest is referenced by a kustomization"
	@echo "    check-ci-impact-scopes     Verify the local CI impact graph and tracked-file coverage"
	@echo ""
	@echo "  Hooks"
	@echo "    hooks-install            Install Git hooks (lefthook)"
	@echo "    hooks-run                Run hook checks manually"
	@echo ""
	@echo "  APM"
	@echo "    apm-install              Install APM dependencies + run security scan"
	@echo "    apm-install-force        Install APM dependencies + require skillspector scan (CI)"
	@echo "    apm-audit                Run APM security audit"
	@echo ""

# ============================================================================
# Tools
# ============================================================================

# Spec viewer dev server (packages/spec-viewer-ui) over this checkout; 127.0.0.1 only.
# The fleet dashboard image also serves it at /specs/, over GitHub branches.
.PHONY: spec-ui
spec-ui: install-js
	$(PNPM) --filter @openshift-online/hypershell-spec-viewer-ui dev

# ============================================================================
# Build targets
# ============================================================================

.PHONY: build-all
build-all:
	@scripts/kind/build-images.sh

.PHONY: verify-pnpm
verify-pnpm:
	@current=$$($(PNPM) --version); \
	printf '%s\n%s\n' "$(PNPM_MIN_VERSION)" "$$current" | sort -V -C || \
	  { echo "pnpm $$current < minimum $(PNPM_MIN_VERSION)"; exit 1; }

.PHONY: install-js
install-js: verify-pnpm
	$(PNPM) install --frozen-lockfile

.PHONY: build-api-server
build-api-server:
	$(CONTAINER_ENGINE) build -t $(api_server_local) \
		--build-arg GIT_VERSION=$(build_version) --build-arg BUILD_TIME="$(build_time)" \
		components/api-server

.PHONY: build-controller
build-controller:
	$(CONTAINER_ENGINE) build -t $(control_plane_local) \
		--build-arg OPENSHELL_TAG=$(OPENSHELL_TAG) \
		-f components/control-plane/Dockerfile .

.PHONY: build-cli
# Regenerate first so the binary always matches the OpenAPI description and the
# pinned rh-trex-ai generators (the first run needs network access).
build-cli: generate-cli
	cd components/cli && CGO_ENABLED=0 go build -ldflags="-s -w" -o hsctl ./cmd/hsctl

.PHONY: build-web-console
build-web-console:
	$(CONTAINER_ENGINE) build -t $(web_console_local) \
		--build-arg GIT_VERSION=$(build_version) \
		-f components/web-console/Dockerfile .

# ============================================================================
# Policy checks
# ============================================================================

.PHONY: test-forbidden-terms-policy
test-forbidden-terms-policy:
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest scripts/test_check_forbidden_terms.py

.PHONY: check-forbidden-terms
check-forbidden-terms: test-forbidden-terms-policy
	python3 scripts/check_forbidden_terms.py

.PHONY: test-kind-conformance-policy
test-kind-conformance-policy:
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest scripts/test_check_kind_conformance.py

.PHONY: check-kind-conformance
check-kind-conformance: test-kind-conformance-policy
	python3 scripts/check_kind_conformance.py

.PHONY: test-dependency-pin-policy
test-dependency-pin-policy:
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest scripts/test_check_dependency_pins.py

.PHONY: check-dependency-pins
check-dependency-pins: test-dependency-pin-policy
	python3 scripts/check_dependency_pins.py

.PHONY: check-ci-components
check-ci-components:
	python3 scripts/check_ci_components.py

.PHONY: test-deploy-orphans-policy
test-deploy-orphans-policy:
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest scripts/test_check_deploy_orphans.py

.PHONY: check-deploy-orphans
check-deploy-orphans: test-deploy-orphans-policy
	python3 scripts/check_deploy_orphans.py

.PHONY: test-dependency-age-policy
test-dependency-age-policy:
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest scripts/test_check_dependency_age.py

.PHONY: check-dependency-age
# The pinned rh-trex-ai generators run during make check, hooks and CI, so their
# module graphs are held to the same age policy as repository modules.
check-dependency-age: test-dependency-age-policy
	PYTHONDONTWRITEBYTECODE=1 python3 scripts/check_dependency_age.py --min-age-days $(DEPENDENCY_MIN_AGE_DAYS) \
		--external-repo "$$(scripts/trex-checkout.sh)" \
		--external-go-mod scripts/cli-generator/go.mod \
		--external-go-mod scripts/tui-generator/go.mod

.PHONY: sync-openshell-version
sync-openshell-version:
	PYTHONDONTWRITEBYTECODE=1 python3 scripts/sync_openshell_version.py --stamp

.PHONY: vendor-openshell-chart
vendor-openshell-chart:
	@. ./OPENSHELL_VERSION && \
	  echo "Vendoring OpenShell chart $$OPENSHELL_TAG from $$OPENSHELL_CHART_REPO..." && \
	  git clone --depth 1 --branch "$$OPENSHELL_TAG" "$$OPENSHELL_CHART_REPO" /tmp/openshell-chart-vendor && \
	  rm -rf charts/openshell && \
	  cp -r /tmp/openshell-chart-vendor/deploy/helm/openshell charts/openshell && \
	  rm -rf /tmp/openshell-chart-vendor && \
	  grep -rl $$'\xe2\x80\x94' charts/openshell/ | xargs -r perl -pi -e 's/\xe2\x80\x94/-/g' && \
	  echo "Vendored charts/openshell/ at $$OPENSHELL_TAG"
	$(MAKE) sync-openshell-version

.PHONY: test-openshell-version-policy
test-openshell-version-policy:
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest \
		scripts/test_sync_openshell_version.py \
		scripts/test_check_controller_image_label.py

.PHONY: check-openshell-version
check-openshell-version: test-openshell-version-policy
	PYTHONDONTWRITEBYTECODE=1 python3 scripts/sync_openshell_version.py

.PHONY: check-controller-image-label
# Inspect a built controller image's configuration and verify the single
# supported OpenShell release label across every architecture variant
# (specs/platform/openshell-image-auto-update.spec.md, CICD-IMG-04/05). Pass the
# image reference in IMAGE, e.g. `make check-controller-image-label IMAGE=...`.
check-controller-image-label:
	@test -n "$(IMAGE)" || { echo "Set IMAGE=<controller image reference>"; exit 2; }
	PYTHONDONTWRITEBYTECODE=1 python3 scripts/check_controller_image_label.py "$(IMAGE)"

.PHONY: test-spec-ids-policy
test-spec-ids-policy:
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest scripts/test_check_spec_ids.py

.PHONY: check-spec-ids
# Spec ID rules and test citation markers (specs/standards/platform/spec-identifiers.spec.md).
check-spec-ids: test-spec-ids-policy
	PYTHONDONTWRITEBYTECODE=1 python3 scripts/check_spec_ids.py

.PHONY: traceability
# Print which tests cite which spec requirements and scenarios (STD-IDS-08).
traceability:
	@PYTHONDONTWRITEBYTECODE=1 python3 scripts/check_spec_ids.py --report

.PHONY: check-cli-drift
check-cli-drift: generate-tui-check
	scripts/generate-cli.sh --check

.PHONY: test-ci-impact-scopes-policy
test-ci-impact-scopes-policy:
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest scripts/test_check_ci_impact_scopes.py scripts/test_detect_components.py

.PHONY: check-ci-impact-scopes
# Local CI dependency-aware scope graph and tracked-file coverage audit
# (specs/platform/mergify-parallel-merge-queue.spec.md, CICD-MRG-03/08/09).
check-ci-impact-scopes: test-ci-impact-scopes-policy
	PYTHONDONTWRITEBYTECODE=1 python3 scripts/check_ci_impact_scopes.py

.PHONY: check
check: check-forbidden-terms check-kind-conformance check-dependency-pins check-ci-components check-deploy-orphans check-dependency-age check-openshell-version check-cli-drift check-spec-ids check-ci-impact-scopes test-release-bundle test-coverage-report

# ============================================================================
# Git hooks
# ============================================================================

.PHONY: hooks-install
hooks-install:
	$(LEFTHOOK_CMD) install

.PHONY: hooks-run
hooks-run:
	$(LEFTHOOK_CMD) run check

# ============================================================================
# APM
# ============================================================================

.PHONY: apm-install apm-install-force
apm-install:
	@scripts/apm-install.sh

apm-install-force:
	@scripts/apm-install.sh --force

.PHONY: apm-audit
apm-audit:
	apm run audit

# ============================================================================
# Lint targets
# ============================================================================

.PHONY: lint-api-server
lint-api-server:
	@unformatted="$$(gofmt -l components/api-server)"; \
	if [ -n "$$unformatted" ]; then \
		echo "The following API server files are not formatted:"; \
		echo "$$unformatted"; \
		exit 1; \
	fi
	cd components/api-server && go vet ./...
	cd components/api-server && go run $(GOLANGCI_LINT_PACKAGE) run --timeout=5m

.PHONY: lint-cli
lint-cli:
	@unformatted="$$(gofmt -l components/cli)"; \
	if [ -n "$$unformatted" ]; then \
		echo "The following CLI files are not formatted:"; \
		echo "$$unformatted"; \
		exit 1; \
	fi
	cd components/cli && go vet ./...
	cd components/cli && go run $(GOLANGCI_LINT_PACKAGE) run --timeout=5m

.PHONY: lint-control-plane
lint-control-plane:
	@unformatted="$$(gofmt -l components/control-plane)"; \
	if [ -n "$$unformatted" ]; then \
		echo "The following control plane files are not formatted:"; \
		echo "$$unformatted"; \
		exit 1; \
	fi
	cd components/control-plane && go vet ./...
	cd components/control-plane && go run $(GOLANGCI_LINT_PACKAGE) run --timeout=5m

.PHONY: lint-e2e
lint-e2e:
	@unformatted="$$(gofmt -l tests/e2e)"; \
	if [ -n "$$unformatted" ]; then \
		echo "The following e2e files are not formatted:"; \
		echo "$$unformatted"; \
		exit 1; \
	fi
	cd tests/e2e && go vet ./...
	cd tests/e2e && go run $(GOLANGCI_LINT_PACKAGE) run --timeout=5m

.PHONY: lint-sdk-typescript
lint-sdk-typescript: install-js
	$(PNPM) --filter @openshift-online/hypershell-sdk check

.PHONY: lint-gateway-management-ui
lint-gateway-management-ui: install-js
	$(PNPM) --filter @openshift-online/hypershell-domain-probes build
	$(PNPM) --filter @openshift-online/hypershell-gateway-management-ui check

.PHONY: lint-spec-viewer
lint-spec-viewer: install-js
	$(PNPM) --filter @openshift-online/hypershell-spec-viewer-ui run format:check
	$(PNPM) --filter @openshift-online/hypershell-spec-viewer-ui run lint
	$(PNPM) --filter @openshift-online/hypershell-spec-viewer-ui run typecheck

.PHONY: lint-web-console
lint-web-console: install-js
	$(PNPM) --filter @openshift-online/hypershell-sdk build
	$(PNPM) --filter @openshift-online/hypershell-domain-probes check
	$(PNPM) --filter @openshift-online/hypershell-web-console check
	$(PNPM) --filter @openshift-online/hypershell-web-console-bff check

.PHONY: lint
lint: check install-js lint-api-server lint-cli lint-control-plane lint-e2e lint-sdk-typescript lint-gateway-management-ui lint-spec-viewer lint-web-console

# ============================================================================
# Test targets
# ============================================================================

.PHONY: ci-test
ci-test:
	@bash scripts/run-shell-unit-tests.sh

.PHONY: unit-test-all
unit-test-all: install-js ci-test
	cd components/api-server && $(MAKE) test
	cd components/control-plane && go test ./...
	cd components/cli && go test ./...
	cd scripts/sdk-generator && go test ./...
	$(PNPM) run test:web

# ============================================================================
# Kind cluster lifecycle - shell logic lives in scripts/kind/
# ============================================================================

export CONTAINER_ENGINE KIND_CLUSTER_NAME KIND_NAMESPACE
export KIND_HOT_RELOAD KIND_HOST_MOUNT_PATH KIND_KEYCLOAK_URL LOCAL_IMAGES BUILD_SOURCE
export KIND_PULL_SECRET PULL_SECRET
export GATEWAY_API_VERSION KIND_VERSION CLOUD_PROVIDER_KIND_REPO CLOUD_PROVIDER_KIND_REF CLOUD_PROVIDER_KIND_BRANCH CERT_MANAGER_VERSION AGENT_SANDBOX_VERSION
export IMAGE_REGISTRY IMAGE_TAG KIND_CONFIG
export api_server_ref control_plane_ref web_console_ref
export API_SERVER_IMAGE CONTROL_PLANE_IMAGE WEB_CONSOLE_IMAGE
export api_server_local control_plane_local web_console_local
export build_version build_time
export API_HOSTNAME CONSOLE_HOSTNAME HEALTH_HOSTNAME KEYCLOAK_HOSTNAME METRICS_HOSTNAME KEYCLOAK_OIDC_ISSUER
export KIND_DNS_PORT
export OPENSHIFT_NAMESPACE SWAP_REGISTRY SWAP_REPOSITORY SWAP_PLATFORM SWAP_ARCH PULL_SECRET SKIP_SEED SEED_STRICT FORCE
export GATEWAY_API_GATEWAY_NAME GATEWAY_API_GATEWAY_NAMESPACE GATEWAY_IMAGE

# Build cloud-provider-kind from a fork that adds BackendTLSPolicy support
# (TLS re-encryption to backends).  The fork also bundles the podman 6+ kind
# fix, so no go mod replace is needed.
#
# Idempotent by commit: the Go binary auto-stamps its source revision, so we
# compare the on-disk vcs.revision against the pinned CLOUD_PROVIDER_KIND_REF and
# only rebuild when it is missing or out of date. The pinned commit is fetched
# directly (GitHub allows fetch-by-SHA), guaranteeing a deterministic build.
# bin/.cloud-provider-kind.sha records the built commit so up.sh can decide
# whether a running cloud-provider-kind needs restarting -- without invoking go.
.PHONY: kind-prereqs
kind-prereqs:
	@mkdir -p bin
	@ref="$(CLOUD_PROVIDER_KIND_REF)"; \
	branch="$(CLOUD_PROVIDER_KIND_BRANCH)"; \
	if [ -n "$$branch" ]; then \
	  fetchref="$$branch"; \
	  echo "==> Building cloud-provider-kind from ref '$$branch' (CLOUD_PROVIDER_KIND_BRANCH override) -> bin/cloud-provider-kind"; \
	else \
	  fetchref="$$ref"; \
	  if [ -x bin/cloud-provider-kind ]; then \
	    ondisk="$$(go version -m bin/cloud-provider-kind 2>/dev/null | awk -F= '/[[:space:]]vcs.revision=/{print $$2}')"; \
	    if [ "$$ondisk" = "$$ref" ]; then \
	      echo "==> bin/cloud-provider-kind already at $$ref, skipping build"; \
	      printf '%s\n' "$$ref" > bin/.cloud-provider-kind.sha; \
	      exit 0; \
	    fi; \
	    echo "==> bin/cloud-provider-kind is $${ondisk:-unknown}, rebuilding at $$ref"; \
	  else \
	    echo "==> Building cloud-provider-kind@$$ref -> bin/cloud-provider-kind"; \
	  fi; \
	fi; \
	tmpdir=$$(mktemp -d) && \
	  git init -q "$$tmpdir" && \
	  git -C "$$tmpdir" remote add origin $(CLOUD_PROVIDER_KIND_REPO) && \
	  git -C "$$tmpdir" fetch -q --depth 1 origin "$$fetchref" && \
	  git -C "$$tmpdir" -c advice.detachedHead=false checkout -q FETCH_HEAD && \
	  built="$$(git -C "$$tmpdir" rev-parse HEAD)" && \
	  ( cd "$$tmpdir" && CGO_ENABLED=0 go build -o $(CURDIR)/bin/cloud-provider-kind . ) && \
	  rm -rf "$$tmpdir" && \
	  printf '%s\n' "$$built" > bin/.cloud-provider-kind.sha && \
	  echo "==> Done - binary in ./bin/cloud-provider-kind ($$built)"

.PHONY: kind-env
kind-env:
	@echo "# Environment variables for local Kind cluster setup"
	@echo "# Copy the export block below to run 'make kind-up' with these settings:"
	@echo ""
	@echo "export CONTAINER_ENGINE=$(CONTAINER_ENGINE)"
	@echo "export KIND_CLUSTER_NAME=$(KIND_CLUSTER_NAME)"
	@echo "export KIND_NAMESPACE=$(KIND_NAMESPACE)"
	@echo "export KIND_HOT_RELOAD=$(KIND_HOT_RELOAD)"
	@echo "export KIND_HOST_MOUNT_PATH=$(KIND_HOST_MOUNT_PATH)"
	@echo "export KIND_KEYCLOAK_URL=$(KIND_KEYCLOAK_URL)"
	@echo "export LOCAL_IMAGES=$(LOCAL_IMAGES)"
	@echo "export PULL_SECRET=$(PULL_SECRET)"
	@echo "export KIND_PULL_SECRET=$(KIND_PULL_SECRET)"
	@echo "export KIND_DB_IMAGE=$(KIND_DB_IMAGE)"
	@echo "export GATEWAY_API_VERSION=$(GATEWAY_API_VERSION)"
	@echo "export KIND_VERSION=$(KIND_VERSION)"
	@echo "export CLOUD_PROVIDER_KIND_REPO=$(CLOUD_PROVIDER_KIND_REPO)"
	@echo "export CLOUD_PROVIDER_KIND_REF=$(CLOUD_PROVIDER_KIND_REF)"
	@echo "export CLOUD_PROVIDER_KIND_BRANCH=$(CLOUD_PROVIDER_KIND_BRANCH)"
	@echo "export CERT_MANAGER_VERSION=$(CERT_MANAGER_VERSION)"
	@echo "export AGENT_SANDBOX_VERSION=$(AGENT_SANDBOX_VERSION)"
	@echo "export IMAGE_REGISTRY=$(IMAGE_REGISTRY)"
	@echo "export IMAGE_TAG=$(IMAGE_TAG)"
	@echo "export KIND_CONFIG=$(KIND_CONFIG)"
	@echo "export API_HOSTNAME=$(API_HOSTNAME)"
	@echo "export CONSOLE_HOSTNAME=$(CONSOLE_HOSTNAME)"
	@echo "export HEALTH_HOSTNAME=$(HEALTH_HOSTNAME)"
	@echo "export KEYCLOAK_HOSTNAME=$(KEYCLOAK_HOSTNAME)"
	@echo "export METRICS_HOSTNAME=$(METRICS_HOSTNAME)"
	@echo "export KEYCLOAK_OIDC_ISSUER=$(KEYCLOAK_OIDC_ISSUER)"
	@echo "export KIND_DNS_PORT=$(KIND_DNS_PORT)"
	@echo "export API_SERVER_IMAGE=$(API_SERVER_IMAGE)"
	@echo "export CONTROL_PLANE_IMAGE=$(CONTROL_PLANE_IMAGE)"
	@echo "export WEB_CONSOLE_IMAGE=$(WEB_CONSOLE_IMAGE)"

.PHONY: kind-up
kind-up:
	@CLUSTER_DRIVER=kind scripts/cluster/up.sh

.PHONY: kind-seed
kind-seed:
	@CLUSTER_DRIVER=kind scripts/cluster/seed.sh

.PHONY: kind-reconcile-keycloak-users
kind-reconcile-keycloak-users:
	@bash scripts/kind/reconcile-keycloak-users.sh

.PHONY: kind-down
kind-down:
	@CLUSTER_DRIVER=kind scripts/cluster/down.sh

.PHONY: kind-teardown
kind-teardown:
	@CLUSTER_DRIVER=kind scripts/cluster/teardown.sh

.PHONY: kind-status
kind-status:
	@CLUSTER_DRIVER=kind scripts/cluster/status.sh

.PHONY: kind-fix-ports
kind-fix-ports:
	@scripts/kind/port-forward.sh

.PHONY: kind-api-server-up
kind-api-server-up:
	@CLUSTER_DRIVER=kind scripts/cluster/swap.sh up api-server

.PHONY: kind-api-server-down
kind-api-server-down:
	@CLUSTER_DRIVER=kind scripts/cluster/swap.sh down api-server

.PHONY: kind-control-plane-up
kind-control-plane-up:
	@CLUSTER_DRIVER=kind scripts/cluster/swap.sh up control-plane

.PHONY: kind-control-plane-down
kind-control-plane-down:
	@CLUSTER_DRIVER=kind scripts/cluster/swap.sh down control-plane

.PHONY: kind-web-console-up
kind-web-console-up:
	@CLUSTER_DRIVER=kind scripts/cluster/swap.sh up web-console

.PHONY: kind-web-console-down
kind-web-console-down:
	@CLUSTER_DRIVER=kind scripts/cluster/swap.sh down web-console

.PHONY: kind-gateway-trust
kind-gateway-trust:
	@scripts/kind/gateway-trust.sh

.PHONY: kind-openshell
kind-openshell:
	@scripts/kind/openshell.sh $(ARGS)

# Turn on gRPC TLS on the Kind api-server, verify the control plane's TLS dial
# end to end, then restore plaintext (KEEP=true keeps it on; ARGS=revert
# restores it). See specs/platform/hub-grpc-tls.spec.md.
.PHONY: kind-grpc-tls-smoke
kind-grpc-tls-smoke:
	@scripts/kind/grpc-tls-smoke.sh $(ARGS)

# ============================================================================
# OpenShift cluster lifecycle - shell logic lives in scripts/cluster/
# ============================================================================

.PHONY: openshift-up
openshift-up:
	@CLUSTER_DRIVER=openshift scripts/cluster/up.sh

.PHONY: openshift-seed
openshift-seed:
	@CLUSTER_DRIVER=openshift scripts/cluster/seed.sh

.PHONY: openshift-down
openshift-down:
	@CLUSTER_DRIVER=openshift scripts/cluster/down.sh

.PHONY: openshift-teardown
openshift-teardown:
	@CLUSTER_DRIVER=openshift scripts/cluster/teardown.sh

.PHONY: openshift-status
openshift-status:
	@CLUSTER_DRIVER=openshift scripts/cluster/status.sh

.PHONY: openshift-api-server-up
openshift-api-server-up:
	@CLUSTER_DRIVER=openshift scripts/cluster/swap.sh up api-server

.PHONY: openshift-api-server-down
openshift-api-server-down:
	@CLUSTER_DRIVER=openshift scripts/cluster/swap.sh down api-server

.PHONY: openshift-control-plane-up
openshift-control-plane-up:
	@CLUSTER_DRIVER=openshift scripts/cluster/swap.sh up control-plane

.PHONY: openshift-control-plane-down
openshift-control-plane-down:
	@CLUSTER_DRIVER=openshift scripts/cluster/swap.sh down control-plane

.PHONY: openshift-web-console-up
openshift-web-console-up:
	@CLUSTER_DRIVER=openshift scripts/cluster/swap.sh up web-console

.PHONY: openshift-web-console-down
openshift-web-console-down:
	@CLUSTER_DRIVER=openshift scripts/cluster/swap.sh down web-console

.PHONY: openshift-test
openshift-test:
	@bash scripts/cluster/lib_test.sh

# Regenerate the hsctl CLI and TUI descriptor with the rh-trex-ai generators
# pinned in scripts/rh-trex-ai.ref. The -check variants fail when stale.
.PHONY: generate-cli generate-cli-check
generate-cli: generate-tui
	scripts/generate-cli.sh

generate-cli-check:
	scripts/generate-cli.sh --check

generate-sdk-go:
	$(MAKE) -C components/api-server generate-sdk

.PHONY: generate-tui generate-tui-check
generate-tui:
	scripts/generate-tui.sh

generate-tui-check:
	scripts/generate-tui.sh --check
# ============================================================================
# E2E Tests
# ============================================================================

# Driver is auto-detected from the current KUBECONFIG context
# (route.openshift.io => openshift, otherwise kind). Set E2E_INFRA_DRIVER
# on the command line to override.

# The functional e2e suite is the Go testify suite (TestE2E). It auto-detects the
# infra driver from the current KUBECONFIG context (override with E2E_INFRA_DRIVER).
# -failfast aborts on the first failing step (see the Three-Outcome Reporting
# requirement in specs/platform/e2e-testing.spec.md). TearDownSuite collects
# failure diagnostics before cleanup for both direct and matrix/promotion runs.
E2E_GO_TIMEOUT ?= 35m
# E2E_RUN targets a single phase or step in isolation (the primary gateway is
# provisioned once in suite setup, so any phase or step is independently runnable).
# A phase value (Phase-P0..Phase-P3) runs the whole phase; any other value is
# treated as a step id nested under its phase. Examples:
#   make e2e E2E_RUN=Phase-P2      # the whole P2 phase
#   make e2e E2E_RUN=P2.5          # just the P2.5 step
# Unset, the full TestE2E suite runs. Escape regex metacharacters as needed
# (e.g. E2E_RUN='P2\.5' to avoid matching P2.50-style ids).
E2E_RUN ?=
ifeq ($(strip $(E2E_RUN)),)
E2E_RUN_TARGET := TestE2E
else ifeq ($(filter Phase-%,$(E2E_RUN)),$(E2E_RUN))
E2E_RUN_TARGET := TestE2E/TestPhases/$(E2E_RUN)
else
E2E_RUN_TARGET := TestE2E/TestPhases/.*/$(E2E_RUN)
endif
.PHONY: e2e
e2e:
	@echo ""
	@echo "==> Running E2E suite (go test -run $(E2E_RUN_TARGET))"
	@echo ""
	@E2E_PROVISION_TIMEOUT=$${E2E_PROVISION_TIMEOUT:-300} \
		E2E_SANDBOX_TIMEOUT=$${E2E_SANDBOX_TIMEOUT:-300} \
		go -C tests/e2e test . -run '$(E2E_RUN_TARGET)' -failfast -v -timeout $(E2E_GO_TIMEOUT)

# Managed-cluster matrix runner: runs the single-cluster E2ESuite once per
# registered ManagedCluster and reports a per-cluster pass/fail/skip matrix.
.PHONY: e2e-matrix
e2e-matrix:
	@echo ""
	@echo "==> Running E2E matrix (go test TestMatrix)"
	@echo ""
	@E2E_PROVISION_TIMEOUT=$${E2E_PROVISION_TIMEOUT:-300} \
		E2E_SANDBOX_TIMEOUT=$${E2E_SANDBOX_TIMEOUT:-300} \
		go -C tests/e2e test . -run TestMatrix -v -timeout $(E2E_GO_TIMEOUT)

# Bash user-interaction smoke script (happy path; demonstration + sanity check).
# Not the authoritative gate -- the Go suite short mode is. Honors E2E_PAUSE.
.PHONY: e2e-smoke
e2e-smoke:
	@echo ""
	@echo "==> Running E2E smoke (bash user-interaction walkthrough)"
	@echo ""
	@bash tests/e2e/smoke.sh

# Browser-driven Playwright e2e of the HyperShell web console and per-gateway
# OpenShell console. The shell entry point only discovers cluster routes.
.PHONY: e2e-console
e2e-console:
	@echo ""
	@echo "==> Running browser E2E (web console + OpenShell console)"
	@echo ""
	@E2E_PROVISION_TIMEOUT=300 \
		E2E_SANDBOX_TIMEOUT=180 \
		bash tests/e2e/e2e-console.sh

# Combined unit + e2e coverage (specs/platform/local-development.spec.md
# DEV-LOC-18). Runs the Go and frontend unit tests with coverage, then e2e and
# e2e-console against a Kind cluster deployed with KIND_COVERAGE=true make
# kind-up, plus the hsctl smoke test with a -cover hsctl. It collects the data
# the instrumented pods and hsctl wrote, and merges everything into
# coverage/report/. COVERAGE_UNIT, COVERAGE_E2E, COVERAGE_HSCTL_E2E and
# COVERAGE_CONSOLE_E2E (default true) select the steps.
.PHONY: coverage
coverage:
	@bash scripts/code-coverage/run.sh

# Rebuild coverage/report/ from the data of the last `make coverage` run.
.PHONY: coverage-report
coverage-report:
	@bash scripts/code-coverage/run.sh report

.PHONY: test-coverage-report
test-coverage-report:
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest scripts/code-coverage/test_report.py

.PHONY: e2e-performance
e2e-performance:
	@echo ""
	@echo "==> Running E2E performance benchmark (BenchmarkGatewayProvisioning)"
	@echo ""
	# -benchtime 1x: provision the fleet once (this is a one-shot scale test, not a
	# repeated micro-benchmark). b.ReportMetric surfaces ttr p50/p99, throughput,
	# and success rate; compare runs with `benchstat`.
	@go -C tests/e2e test . -run '^$$' -bench '^BenchmarkGatewayProvisioning$$' -benchtime 1x -v -timeout $(E2E_GO_TIMEOUT)

# Browser-driven end-to-end trace verification (WEB-TRC-10). Requires a Kind
# cluster brought up with tracing enabled (KIND_JAEGER=true make kind-up), so
# Jaeger is deployed and the web-console BFF exports to it.
.PHONY: e2e-tracing
e2e-tracing:
	@echo ""
	@echo "==> Verifying end-to-end traces reach Jaeger (Kind)"
	@echo "    (requires: KIND_JAEGER=true make kind-up)"
	@echo ""
	@pnpm --filter @openshift-online/hypershell-web-console test:e2e:tracing:live

.PHONY: test-release-bundle
test-release-bundle:
	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest scripts/test_release_bundle.py

# Local Fullsend: pass values as environment entries, never interpolate them
# into shell commands. The trusted env file is sourced only by local.sh.
.PHONY: fullsend fullsend-status fullsend-doctor fullsend-help
fullsend fullsend-status fullsend-doctor fullsend-help: export FULLSEND_LAUNCH_SCOPE = $(SCOPE)
fullsend fullsend-status fullsend-doctor fullsend-help: export FULLSEND_LAUNCH_ENV_FILE = $(ENV_FILE)
fullsend fullsend-status fullsend-doctor fullsend-help: export FULLSEND_LAUNCH_MODEL = $(MODEL)
fullsend fullsend-status fullsend-doctor fullsend-help: export FULLSEND_LAUNCH_CONCURRENCY = $(if $(filter command line,$(origin CONCURRENCY)),$(CONCURRENCY))
fullsend fullsend-status fullsend-doctor fullsend-help: export FULLSEND_LAUNCH_INTAKE_INTERVAL = $(INTAKE_INTERVAL)
fullsend fullsend-status fullsend-doctor fullsend-help: export FULLSEND_LAUNCH_AUTO_MERGE = $(AUTO_MERGE)
fullsend:
	@bash .hypershell/execute-sdlc/local.sh watch
fullsend-status:
	@bash .hypershell/execute-sdlc/local.sh status
fullsend-doctor:
	@bash .hypershell/execute-sdlc/local.sh doctor
fullsend-help:
	@bash .hypershell/execute-sdlc/local.sh help