# EdgeGuard — Build-System.
# Cross-Compile für Debian 13 + Ubuntu 24.04 auf amd64 und arm64.
# CGO_ENABLED=0 (statische Binaries, keine libre2-/CGO-Abhängigkeit in v1).

GO       ?= $(shell which go || echo /usr/local/go/bin/go)
MODULE   := git.netcell-it.de/projekte/edgeguard-native
BINARIES := edgeguard-api edgeguard-scheduler edgeguard-ctl edgeguard-waf
VERSION  := $(shell cat VERSION 2>/dev/null || echo 0.0.1-dev)
LDFLAGS  := -s -w -X main.version=$(VERSION)
GOFLAGS  := -trimpath -mod=readonly
export CGO_ENABLED ?= 0

.PHONY: all help build test test-race lint golangci vulncheck release-check tidy clean ui \
        build-linux-amd64 build-linux-arm64 \
        deb deb-amd64 deb-arm64 \
        publish publish-amd64 publish-arm64

all: build

help:
	@echo "EdgeGuard build targets:"
	@echo "  build              Build all binaries for the host architecture (build/host/)"
	@echo "  build-linux-amd64  Cross-compile all binaries for linux/amd64 (build/amd64/)"
	@echo "  build-linux-arm64  Cross-compile all binaries for linux/arm64 (build/arm64/)"
	@echo "  test               go test ./..."
	@echo "  lint               go vet + staticcheck (if installed)"
	@echo "  tidy               go mod tidy"
	@echo "  ui                 Build management-ui (vite)"
	@echo "  deb-amd64          Cross-compile + build edgeguard_<ver>_amd64.deb"
	@echo "  deb-arm64          Cross-compile + build edgeguard_<ver>_arm64.deb"
	@echo "  deb                Build both amd64 and arm64 .deb packages"
	@echo "  publish-amd64      Build amd64 deb AND upload to Gitea"
	@echo "  publish-arm64      Same for arm64"
	@echo "  publish            publish-amd64 + publish-arm64"
	@echo "  clean              Remove build artifacts"

build:
	@mkdir -p build/host
	@for bin in $(BINARIES); do \
	    echo "  -> build/host/$$bin"; \
	    $(GO) build $(GOFLAGS) -ldflags '$(LDFLAGS)' \
	        -o build/host/$$bin ./cmd/$$bin || exit 1; \
	done

build-linux-amd64:
	@mkdir -p build/amd64
	@for bin in $(BINARIES); do \
	    echo "  -> build/amd64/$$bin"; \
	    GOOS=linux GOARCH=amd64 $(GO) build $(GOFLAGS) -ldflags '$(LDFLAGS)' \
	        -o build/amd64/$$bin ./cmd/$$bin || exit 1; \
	done

build-linux-arm64:
	@mkdir -p build/arm64
	@for bin in $(BINARIES); do \
	    echo "  -> build/arm64/$$bin"; \
	    GOOS=linux GOARCH=arm64 $(GO) build $(GOFLAGS) -ldflags '$(LDFLAGS)' \
	        -o build/arm64/$$bin ./cmd/$$bin || exit 1; \
	done

test:
	$(GO) test $(GOFLAGS) ./...

test-race:
	CGO_ENABLED=1 $(GO) test $(GOFLAGS) -race ./...

GOBIN := $(shell $(GO) env GOPATH)/bin
GOLANGCI_VERSION := v2.12.2

lint:
	$(GO) vet ./...
	@$(MAKE) --no-print-directory golangci

# golangci-lint — HARTER Gate. Tool wird bei Bedarf auf pinned Version
# installiert; bricht ab, sobald ein Finding auftaucht (Bestand ist 0,
# Rollout abgeschlossen — siehe .golangci.yml).
golangci:
	@command -v golangci-lint >/dev/null 2>&1 || GOFLAGS= $(GO) install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_VERSION)
	@PATH="$(GOBIN):$$PATH" golangci-lint run --timeout 6m

# govulncheck — Go-Vuln-DB-Scan. HARTER Release-Gate: bricht ab, wenn der
# Code eine bekannte Vulnerability tatsächlich aufruft. Tool wird bei Bedarf
# automatisch installiert.
vulncheck:
	@command -v govulncheck >/dev/null 2>&1 || GOFLAGS= $(GO) install golang.org/x/vuln/cmd/govulncheck@latest
	@PATH="$(GOBIN):$$PATH" govulncheck ./...

# Go-Quality-Baseline — läuft automatisch vor jedem Release (deb/publish).
# Reihenfolge: vet → golangci-lint (GATE) → govulncheck (GATE) → build →
# test -race. Alle vier brechen bei jedem Fund ab. Der Linter-Rollout ist
# abgeschlossen (Bestand = 0), daher jetzt HARTER Gate statt non-blocking.
release-check:
	$(GO) vet ./...
	@$(MAKE) --no-print-directory golangci
	@$(MAKE) --no-print-directory vulncheck
	$(GO) build ./...
	CGO_ENABLED=1 $(GO) test $(GOFLAGS) -race ./...
	@echo "  ✓ Go-Quality-Baseline bestanden (vet, golangci-lint, govulncheck, build, test -race)"

tidy:
	$(GO) mod tidy

ui:
	@echo "  -> management-ui (vite build, version $(VERSION))"
	@cd management-ui && \
	    if [ -x "$$(command -v bun)" ]; then bun install --silent && bun run build; \
	    else npm install --include=dev --silent && npm run build; fi

deb-amd64: release-check build-linux-amd64 ui
	@./scripts/apt-repo/build-package.sh amd64 $(VERSION)

deb-arm64: release-check build-linux-arm64 ui
	@./scripts/apt-repo/build-package.sh arm64 $(VERSION)

deb: deb-amd64 deb-arm64

GITEA_DEB_URL := https://git.netcell-it.de/api/packages/projekte/debian/pool/trixie/main/upload

publish-amd64: deb-amd64
	@./scripts/apt-repo/publish.sh $(VERSION) amd64
	@echo "  -> cleanup-old (keep last $${KEEP:-10})"
	@./scripts/apt-repo/cleanup-old.sh

publish-arm64: deb-arm64
	@./scripts/apt-repo/publish.sh $(VERSION) arm64
	@echo "  -> cleanup-old (keep last $${KEEP:-10})"
	@./scripts/apt-repo/cleanup-old.sh

publish: publish-amd64 publish-arm64

clean:
	rm -rf build/