Makefile

# sei-internal-skills: install targets for engineers, gates for contributors, and the
# seidroid driver build. `make` with no target prints this list by section.
#
# Only prune-retired-apply deletes anything. No target here writes to a cluster, an
# issue or a pull request: that work goes through the normal git and PR flow.

.DEFAULT_GOAL := help

SHELL := /usr/bin/env bash

.PHONY: help
# The default goal. It prints each target that has `## ` help text, by section.
help:
	@awk 'BEGIN {FS = ":.*?## "} /^##@ / {printf "\n\033[1m%s\033[0m\n", substr($$0, 5)} /^[a-zA-Z_-]+:.*?## / {printf "  \033[36m%-32s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)

##@ Engineers: install and stay current

.PHONY: update
update: ## Start here. Fast-forward this checkout, then run sync-all
	@echo "→ fast-forwarding this sei-internal-skills checkout (run on main)…"
	@git pull --ff-only
	@$(MAKE) --no-print-directory sync-all

.PHONY: sync-all
sync-all: ## Sync every skill, agent and output style into ~/.claude, verify the catalog, print a prune hint. No git pull (used by update and the installer)
	@echo "→ syncing all agents…"
	@./scripts/sync-agents.sh --target ~/ --force
	@echo "→ syncing all skills…"
	@./scripts/sync-skills.sh --target ~/ --force
	@$(MAKE) --no-print-directory verify-catalog
	@echo "→ syncing output styles…"
	@./scripts/sync-output-styles.sh --target ~/ --force
	@./scripts/prune-retired.sh --target ~/ --check
	@echo "✓ environment current with sei-internal-skills $$(git rev-parse --short HEAD)"

.PHONY: sync-output-styles
sync-output-styles: ## Install the output styles into ~/.claude/output-styles/. It never activates one
	@./scripts/sync-output-styles.sh --target ~/ --force

.PHONY: prune-retired
prune-retired: ## Report which retired resources are still installed in ~/.claude. Deletes nothing.
	@./scripts/prune-retired.sh --target ~/

.PHONY: prune-retired-apply
prune-retired-apply: ## DELETES the retired resources make prune-retired lists from ~/.claude. The only target that removes anything.
	@./scripts/prune-retired.sh --target ~/ --apply

.PHONY: verify-installed-references
verify-installed-references: ## Report citations that ~/.claude cannot resolve. A diagnostic, not a gate: always exits 0
	@./scripts/verify-references.sh --installed

# Removed targets. Each one names its replacement.
.PHONY: bootstrap sync-skills sync-agents sync-experimental
bootstrap sync-skills sync-agents sync-experimental:
	@echo "make $@ is gone. Run: make update" >&2; exit 1

##@ Contributors: the gates CI runs, then the file generators

# catalog-coverage writes fixtures into the live .claude/skills/ that the other
# suites read, so check runs its prerequisites one at a time.
.NOTPARALLEL: check

.PHONY: check
check: verify-catalog test-catalog verify-references test-references sync-doctrine-self-check test-doctrine test-output-styles test-install test-prune test-skill-package-checks verify-agent-permissions verify-action-pins ## Run every gate marked (CI) in this section. Run it before you open a PR
	@echo "✓ make check: every gate passed"

.PHONY: verify-catalog
verify-catalog: ## Fail if a skill or agent file does not name itself, or an agent has no description (CI)
	@./scripts/sync-skills.sh --verify
	@./scripts/sync-agents.sh --verify

.PHONY: test-catalog
test-catalog: ## Run the catalog suite: the guard fails closed, every skill and agent syncs, the README counts match (CI)
	@./scripts/tests/catalog-coverage.test.sh

.PHONY: verify-references
verify-references: ## Fail if a shipped artifact cites a skill .claude/skills/ does not hold (CI)
	@./scripts/verify-references.sh

.PHONY: test-references
test-references: ## Run the verify-references regression suite (CI)
	@./scripts/tests/verify-references.test.sh

.PHONY: sync-doctrine-self-check
sync-doctrine-self-check: ## Fail if the AGENTS.md doctrine block differs from scripts/sei-internal-skills-doctrine.md (CI)
	@bash -c '. ./scripts/lib/inject-doctrine.sh && inject_doctrine "." "./scripts/sei-internal-skills-doctrine.md" check' \
		&& echo "doctrine block in sync ✓"

.PHONY: test-doctrine
test-doctrine: ## Run the doctrine-injector regression suite (CI)
	@./scripts/tests/inject-doctrine.test.sh

.PHONY: test-output-styles
test-output-styles: ## Run the output-style suite: a sync never activates a style (CI)
	@./scripts/tests/sync-output-styles.test.sh

.PHONY: test-install
test-install: ## Run the installer suite, offline: targeted mode, the piped form, the download fallback (CI)
	@./scripts/tests/install.test.sh

.PHONY: test-prune
test-prune: ## Run the prune-retired suite: it never deletes a catalog or user-authored resource (CI)
	@./scripts/tests/prune-retired.test.sh

.PHONY: test-skill-package-checks
test-skill-package-checks: ## Sweep scripts/skill-package-checks.sh over every skill; diff block failures against the baseline (CI)
	@./scripts/tests/skill-package-checks.test.sh

.PHONY: verify-agent-permissions
verify-agent-permissions: ## Fail if .claude/settings.json holds a mutating pattern or differs from the canonical set (CI)
	@./scripts/verify-agent-permissions.sh

.PHONY: verify-action-pins
verify-action-pins: ## Fail if a workflow `uses:` a tag or branch instead of a commit sha (CI)
	@./scripts/verify-action-pins.sh

.PHONY: sync-doctrine-self
sync-doctrine-self: ## Write the doctrine block into this repo's AGENTS.md. Run it after you edit scripts/sei-internal-skills-doctrine.md
	@bash -c '. ./scripts/lib/inject-doctrine.sh && inject_doctrine "." "./scripts/sei-internal-skills-doctrine.md" write'

.PHONY: update-agent-permissions
update-agent-permissions: ## Write the canonical read-only allow list into ./.claude/settings.json (DRY_RUN=1 to preview)
	@./scripts/update-agent-permissions.sh

##@ seidroid driver (sei-agent-driver)
# --- sei-agent-driver (Go) ---------------------------------------------------
#
# The one Go module in this repo. Kept behind its own targets rather than folded
# into the workspace ones above, because those install into a user's ~/.claude and
# this builds a binary — a contributor working on skills should never need a Go
# toolchain to run them.

.PHONY: driver-check
driver-check: ## Everything enforced about sei-agent-driver: fmt, build, vet, test, tidy (CI)
	@cd sei-agent-driver && \
	  unformatted="$$(gofmt -l .)"; \
	  if [ -n "$$unformatted" ]; then \
	    printf 'gofmt: these files need formatting:\n%s\n' "$$unformatted" >&2; exit 1; \
	  fi
	cd sei-agent-driver && go build ./...
	cd sei-agent-driver && go vet ./...
	cd sei-agent-driver && go test ./... -race
	cd sei-agent-driver && go mod tidy -diff

# Pinned because @latest in CI runs whatever was published most recently. The vulnerability
# database is not pinned: the tool reads vuln.go.dev at run time.
GOVULNCHECK_VERSION ?= v1.7.0

# For a run that has to diverge from CI: `-show verbose`, or `-db <mirror>` during an outage.
# The workflow passes this through from the `GOVULNCHECK_FLAGS` repository variable, so the
# mirror is reachable in CI and not only locally.
GOVULNCHECK_FLAGS ?=

# Runs inside the module so go.mod's `toolchain` picks the Go whose standard library findings
# are graded against; GOTOOLCHAIN must stay at auto. actions/setup-go exports it as `local`,
# so the workflow sets it back on the step -- under `local` a go.mod that outgrows the
# installed toolchain fails as a setup error instead of resolving. Installed rather than `go run` so a
# reachable finding (3) can be told from a scanner that could not run (1) -- make reports 2
# either way, so that distinction travels as the message.
.PHONY: driver-vulncheck
driver-vulncheck: ## Fail if sei-agent-driver can reach a known vulnerability (CI)
	@cd sei-agent-driver && { \
	  GOBIN=$(CURDIR)/sei-agent-driver/bin \
	    go install golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION) && \
	  ./bin/govulncheck -version; \
	} || { \
	  echo "driver-vulncheck: SCANNER UNAVAILABLE (setup failed) --" \
	       "not a vulnerability verdict; re-run" >&2; exit 1; \
	}
	@cd sei-agent-driver && ./bin/govulncheck $(GOVULNCHECK_FLAGS) ./...; code=$$?; \
	  case $$code in \
	    0) ;; \
	    3) echo "driver-vulncheck: a reachable vulnerability was found (see above)" >&2; exit 3 ;; \
	    *) echo "driver-vulncheck: SCANNER UNAVAILABLE (govulncheck exit $$code) --" \
	            "not a vulnerability verdict; re-run" >&2; exit $$code ;; \
	  esac

# -buildvcs=false because a nested module cannot stamp VCS info, which is also
# why the version is passed in: without it the binary cannot say which commit it
# is, and neither can runtime/debug.ReadBuildInfo.
DRIVER_VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)

.PHONY: driver-build
driver-build: ## Build the sei-agent-driver binary into sei-agent-driver/bin/
	cd sei-agent-driver && go build -trimpath -buildvcs=false \
	  -ldflags "-X main.version=$(DRIVER_VERSION)" \
	  -o bin/sei-agent-driver ./cmd/sei-agent-driver