Makefile

.PHONY: build build-plugins build-all build-all-plugins build-bundle build-release ensure-bundle-placeholder lint test test-coverage test-race test-integration verify proto install-tools init clean tidy check-version extract-changelog install-script

# Tool versions - bump here to upgrade everywhere
BUF_VERSION ?= v1.68.1
PROTOC_GEN_GO_VERSION ?= v1.36.11
PROTOC_GEN_GO_GRPC_VERSION ?= v1.6.1
GOLANGCI_LINT_VERSION ?= v2.11.4
TEST_TIMEOUT ?= 3m
export TEST_TIMEOUT

# Resolve GOBIN so tools installed via 'go install' are always found,
# even when $GOBIN / $GOPATH/bin is not in $PATH.
GOBIN := $(shell go env GOBIN)
ifeq ($(GOBIN),)
GOBIN := $(shell go env GOPATH)/bin
endif

# Prepend GOBIN to PATH for all make recipes so buf can find
# protoc-gen-go / protoc-gen-go-grpc plugin binaries.
export PATH := $(GOBIN):$(PATH)

# First-time setup: install tools, download dependencies, and generate protobuf code.
# Run this once after cloning the repository.
init: install-tools
	go work sync
	mkdir -p gen/proto
	$(GOBIN)/buf generate
	$(GOBIN)/buf lint
	@$(MAKE) ensure-bundle-placeholder
	@echo "Ready. Run 'make build-all' to compile."

# Create empty placeholder bundle zips so `go build ./cmd/locksmith` works
# without first running `make build-all`. The placeholders contain only an
# empty manifest.json; runtime extraction will see ErrEmptyBundle and warn.
# Real bundles are generated by build-bundle.
ensure-bundle-placeholder:
	@if [ ! -f internal/bundled/assets/bundle-darwin.zip ] || [ ! -f internal/bundled/assets/bundle-linux.zip ]; then \
		go run ./.scripts/build-bundle-placeholder; \
	fi

build:
	go build -o bin/locksmith ./cmd/locksmith
	go build -o bin/locksmith-pinentry ./cmd/locksmith-pinentry

build-plugins:
	go run ./.scripts/build-plugins

build-all: build-all-plugins build-bundle build

# Build pinentry first, then all plugins.
build-all-plugins:
	go build -o bin/locksmith-pinentry ./cmd/locksmith-pinentry
	go run ./.scripts/build-plugins

# Package plugins and pinentry into the per-platform bundle zip
# embedded into the locksmith binary.
build-bundle: build-all-plugins
	go run ./.scripts/build-bundle

lint: install-tools
	$(GOBIN)/golangci-lint run ./...
	$(GOBIN)/buf lint

# Run unit tests across all workspace modules.
test:
	./.scripts/test.sh

# Run with race detector across all workspace modules.
test-race:
	./.scripts/test-race.sh

# Run with coverage report across all workspace modules.
# Saves per-module HTML reports to .reports/ and prints a summary table.
test-coverage:
	./.scripts/test-coverage.sh

# Run integration tests (require daemon + plugins)
test-integration:
	go test -tags=integration -v ./...

# Run all quality gates: lint, race tests, coverage >= 90%, build, GPG signatures, docs.
# Use this as the final step before merging a feature branch.
verify:
	./.scripts/verification.sh

# Verify that the git tag a CI build is running on matches sdk/version/VERSION
# and that CHANGES.md has a corresponding ## Version vX.Y.Z section.
# On non-tag builds the script is a no-op (exit 0).
check-version:
	go run ./.scripts/check-version

# Extract the body of "## Version v$(VERSION)" from CHANGES.md to
# dist/release-notes.md. Used by the release workflow to assemble
# GitHub-release notes verbatim from the changelog.
extract-changelog:
	@if [ -z "$(VERSION)" ]; then echo "extract-changelog: VERSION required (e.g. make extract-changelog VERSION=v0.1.0)"; exit 2; fi
	@mkdir -p dist
	go run ./.scripts/extract-changelog -version "$(VERSION)" -o dist/release-notes.md
	@echo "wrote dist/release-notes.md"

# Render the POSIX install script from its template into dist/install.sh.
# Used by the release workflow to publish install.sh as a GitHub-release
# asset.
install-script:
	@mkdir -p dist
	go run ./.scripts/render-install -o dist/install.sh
	@echo "rendered dist/install.sh"

# Build the release-flavoured locksmith binary (production flags:
# -trimpath, -ldflags="-s -w") with the per-platform plugin/pinentry
# bundle embedded. Depends on build-all-plugins (which produces the
# bin/ inputs build-bundle reads) and build-bundle (which writes the
# embedded zip). Pinentry is NOT rebuilt with -trimpath here - the
# bundle already carries the copy locksmith.init extracts.
build-release: build-all-plugins build-bundle
	go build -trimpath -ldflags="-s -w" -o bin/locksmith ./cmd/locksmith

# Regenerate protobuf Go code and verify linting.
# Installs pinned tool versions into GOPATH/bin on each run (no-op if already at correct version).
proto: install-tools
	mkdir -p gen/proto
	$(GOBIN)/buf generate
	$(GOBIN)/buf lint

# Install all code-generation and lint tools at pinned versions.
# Safe to run repeatedly - go install is idempotent for the same version.
install-tools:
	go install github.com/bufbuild/buf/cmd/buf@$(BUF_VERSION)
	go install google.golang.org/protobuf/cmd/protoc-gen-go@$(PROTOC_GEN_GO_VERSION)
	go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@$(PROTOC_GEN_GO_GRPC_VERSION)
	go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)

tidy:
	go run ./.scripts/tidy

clean:
	rm -rf bin/ .reports/