# EdgeGuard — Build-System.
# Cross-Compile für Debian 13 + Ubuntu 24.04 auf amd64 und arm64.
# CGO_ENABLED=0 (statische Binaries, keine libre2-/CGO-Abhängigkeit in v1).

GO       ?= $(shell which go || echo /usr/local/go/bin/go)
MODULE   := git.netcell-it.de/projekte/edgeguard-native
BINARIES := edgeguard-api edgeguard-scheduler edgeguard-ctl edgeguard-waf
VERSION  := $(shell cat VERSION 2>/dev/null || echo 0.0.1-dev)
LDFLAGS  := -s -w -X main.version=$(VERSION)
GOFLAGS  := -trimpath -mod=readonly
export CGO_ENABLED ?= 0

.PHONY: all help build test test-race lint vulncheck release-check tidy clean ui \
        build-linux-amd64 build-linux-arm64 \
        deb deb-amd64 deb-arm64 \
        publish publish-amd64 publish-arm64

all: build

help:
	@echo "EdgeGuard build targets:"
	@echo "  build              Build all binaries for the host architecture (build/host/)"
	@echo "  build-linux-amd64  Cross-compile all binaries for linux/amd64 (build/amd64/)"
	@echo "  build-linux-arm64  Cross-compile all binaries for linux/arm64 (build/arm64/)"
	@echo "  test               go test ./..."
	@echo "  lint               go vet + staticcheck (if installed)"
	@echo "  tidy               go mod tidy"
	@echo "  ui                 Build management-ui (vite)"
	@echo "  deb-amd64          Cross-compile + build edgeguard_<ver>_amd64.deb"
	@echo "  deb-arm64          Cross-compile + build edgeguard_<ver>_arm64.deb"
	@echo "  deb                Build both amd64 and arm64 .deb packages"
	@echo "  publish-amd64      Build amd64 deb AND upload to Gitea"
	@echo "  publish-arm64      Same for arm64"
	@echo "  publish            publish-amd64 + publish-arm64"
	@echo "  clean              Remove build artifacts"

build:
	@mkdir -p build/host
	@for bin in $(BINARIES); do \
	    echo "  -> build/host/$$bin"; \
	    $(GO) build $(GOFLAGS) -ldflags '$(LDFLAGS)' \
	        -o build/host/$$bin ./cmd/$$bin || exit 1; \
	done

build-linux-amd64:
	@mkdir -p build/amd64
	@for bin in $(BINARIES); do \
	    echo "  -> build/amd64/$$bin"; \
	    GOOS=linux GOARCH=amd64 $(GO) build $(GOFLAGS) -ldflags '$(LDFLAGS)' \
	        -o build/amd64/$$bin ./cmd/$$bin || exit 1; \
	done

build-linux-arm64:
	@mkdir -p build/arm64
	@for bin in $(BINARIES); do \
	    echo "  -> build/arm64/$$bin"; \
	    GOOS=linux GOARCH=arm64 $(GO) build $(GOFLAGS) -ldflags '$(LDFLAGS)' \
	        -o build/arm64/$$bin ./cmd/$$bin || exit 1; \
	done

test:
	$(GO) test $(GOFLAGS) ./...

test-race:
	CGO_ENABLED=1 $(GO) test $(GOFLAGS) -race ./...

lint:
	$(GO) vet ./...
	@command -v golangci-lint >/dev/null 2>&1 && golangci-lint run \
	  || echo "golangci-lint nicht installiert (go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest) — übersprungen"

GOBIN := $(shell $(GO) env GOPATH)/bin

# govulncheck — Go-Vuln-DB-Scan. HARTER Release-Gate: bricht ab, wenn der
# Code eine bekannte Vulnerability tatsächlich aufruft. Tool wird bei Bedarf
# automatisch installiert.
vulncheck:
	@command -v govulncheck >/dev/null 2>&1 || GOFLAGS= $(GO) install golang.org/x/vuln/cmd/govulncheck@latest
	@PATH="$(GOBIN):$$PATH" govulncheck ./...

# Go-Quality-Baseline — läuft automatisch vor jedem Release (deb/publish).
# Reihenfolge: vet → golangci-lint (Rollout: NON-BLOCKING) → govulncheck (GATE)
# → build → test -race. govulncheck bricht bei jedem Fund ab; der Linter ist
# in der Rollout-Phase noch non-blocking (Bestand aufräumen, dann auf Gate).
release-check:
	$(GO) vet ./...
	@command -v golangci-lint >/dev/null 2>&1 && (golangci-lint run || echo "  ⚠ golangci-lint-Findings (non-blocking, Rollout-Phase)") \
	  || echo "  golangci-lint nicht installiert — übersprungen (Rollout-Phase)"
	@$(MAKE) --no-print-directory vulncheck
	$(GO) build ./...
	CGO_ENABLED=1 $(GO) test $(GOFLAGS) -race ./...
	@echo "  ✓ Go-Quality-Baseline bestanden (vet, govulncheck, build, test -race)"

tidy:
	$(GO) mod tidy

ui:
	@echo "  -> management-ui (vite build, version $(VERSION))"
	@cd management-ui && \
	    if [ -x "$$(command -v bun)" ]; then bun install --silent && bun run build; \
	    else npm install --silent && npm run build; fi

deb-amd64: release-check build-linux-amd64 ui
	@./scripts/apt-repo/build-package.sh amd64 $(VERSION)

deb-arm64: release-check build-linux-arm64 ui
	@./scripts/apt-repo/build-package.sh arm64 $(VERSION)

deb: deb-amd64 deb-arm64

GITEA_DEB_URL := https://git.netcell-it.de/api/packages/projekte/debian/pool/trixie/main/upload

publish-amd64: deb-amd64
	@./scripts/apt-repo/publish.sh $(VERSION) amd64
	@echo "  -> cleanup-old (keep last $${KEEP:-10})"
	@./scripts/apt-repo/cleanup-old.sh

publish-arm64: deb-arm64
	@./scripts/apt-repo/publish.sh $(VERSION) arm64
	@echo "  -> cleanup-old (keep last $${KEEP:-10})"
	@./scripts/apt-repo/cleanup-old.sh

publish: publish-amd64 publish-arm64

clean:
	rm -rf build/