Makefile

SHELL := /usr/bin/env bash
.SHELLFLAGS := -eo pipefail -c

GO ?= go
PYTHON ?= $(shell if command -v python3.12 >/dev/null 2>&1; then echo python3.12; else echo python3; fi)

GO_TEST_FLAGS ?= -count=1 -v
ENVTEST_K8S_VERSION ?= 1.32.x
PYTHON_TEST_REQUIREMENTS ?= agents/requirements-test.txt

VENV_DIR ?= .venv
PYTEST_BIN := $(VENV_DIR)/bin/pytest
PIP_BIN := $(VENV_DIR)/bin/pip
VENV_STAMP := $(VENV_DIR)/.deps-ready

LOCALBIN ?= $(CURDIR)/bin
SETUP_ENVTEST := $(LOCALBIN)/setup-envtest
STATICCHECK := $(LOCALBIN)/staticcheck
CONTROLLER_GEN := $(LOCALBIN)/controller-gen

.PHONY: help test validate test-unit test-go test-anf-snapshot vet-anf-snapshot verify-anf-snapshot test-python setup-envtest test-controller fmt fmt-anf-snapshot fmt-check fmt-check-anf-snapshot vet lint staticcheck-anf-snapshot build build-agentctl build-agentctl-web build-anf-snapshot install-agentctl scan-secrets clean-venv check-python-version helm-lint test-cluster test-smoke test-e2e-cluster manifests generate

.DEFAULT_GOAL := help

help:
	@echo "Canonical developer targets"
	@echo "  make test           - Run go + python tests"
	@echo "  make validate       - Run canonical validation sequence"
	@echo "  make test-go        - Run go tests (excluding envtest controller)"
	@echo "  make test-anf-snapshot - Run nested ANF snapshot tests"
	@echo "  make vet-anf-snapshot - Run nested ANF snapshot vet checks"
	@echo "  make test-python    - Run python agent tests (creates .venv automatically)"
	@echo "  make test-controller - Run envtest controller suite"
	@echo "  make fmt            - Format go code"
	@echo "  make fmt-anf-snapshot - Format nested ANF snapshot go code"
	@echo "  make fmt-check      - Fail if go files are not formatted"
	@echo "  make fmt-check-anf-snapshot - Check nested ANF snapshot formatting"
	@echo "  make vet            - Run go vet"
	@echo "  make lint           - Run lint checks"
	@echo "  make staticcheck-anf-snapshot - Run nested ANF snapshot staticcheck"
	@echo "  make manifests      - Generate CRD manifests"
	@echo "  make generate       - Generate code (deepcopy + go generate)"
	@echo "  make build          - Build go binaries"
	@echo "  make build-anf-snapshot - Build the live ANF namespace snapshot CLI"
	@echo "  make helm-lint      - Lint the Helm chart"
	@echo "  make scan-secrets   - Run repository secret scan"
	@echo ""
	@echo "Cluster test targets (requires KUBECONFIG):"
	@echo "  make test-cluster   - Full cycle: setup → smoke → e2e → teardown"
	@echo "  make test-smoke     - Smoke tests only (cluster must be pre-installed)"
	@echo "  make test-e2e-cluster - E2E tests only (cluster must be pre-installed)"

test: test-go test-anf-snapshot test-python

validate: fmt-check lint test-controller test-go test-anf-snapshot vet-anf-snapshot test-python helm-lint

test-unit: test

test-go:
	@echo "Running Go tests..."
	@pkgs="$$( $(GO) list ./... | awk '!/\/internal\/controller$$/' )"; \
	if [[ -z "$$pkgs" ]]; then \
		echo "No Go packages discovered for test-go"; \
		exit 1; \
	fi; \
	$(GO) test $$pkgs $(GO_TEST_FLAGS)

test-anf-snapshot:
	@echo "Running nested ANF snapshot tests..."
	@cd tools/anf-snapshot && $(GO) test ./... $(GO_TEST_FLAGS)

vet-anf-snapshot:
	@echo "Running nested ANF snapshot vet checks..."
	@cd tools/anf-snapshot && $(GO) vet ./...

verify-anf-snapshot: test-anf-snapshot vet-anf-snapshot

check-python-version:
	@$(PYTHON) -c 'import sys; assert sys.version_info < (3, 13), "test-python requires Python <= 3.12 due dependency pins; run with PYTHON=python3.12"'

$(VENV_STAMP): $(PYTHON_TEST_REQUIREMENTS)
	@if [[ -x "$(VENV_DIR)/bin/python" ]]; then \
		venv_version="$$("$(VENV_DIR)/bin/python" -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')"; \
		target_version="$$("$(PYTHON)" -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')"; \
		if [[ "$$venv_version" != "$$target_version" ]]; then \
			echo "Rebuilding $(VENV_DIR): Python $$venv_version -> $$target_version"; \
			rm -rf "$(VENV_DIR)"; \
		fi; \
	fi
	@echo "Preparing python virtual environment in $(VENV_DIR)..."
	@$(PYTHON) -m venv $(VENV_DIR)
	@$(PIP_BIN) install --upgrade pip
	@$(PIP_BIN) install -r $(PYTHON_TEST_REQUIREMENTS)
	@touch $(VENV_STAMP)

test-python: check-python-version $(VENV_STAMP)
	@echo "Running Python tests..."
	@PYTHONPATH=. $(PYTEST_BIN) agents/tests -q

$(LOCALBIN):
	@mkdir -p $(LOCALBIN)

$(SETUP_ENVTEST): | $(LOCALBIN)
	@GOBIN=$(LOCALBIN) $(GO) install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest

$(STATICCHECK): | $(LOCALBIN)
	@GOBIN=$(LOCALBIN) $(GO) install honnef.co/go/tools/cmd/staticcheck@latest

$(CONTROLLER_GEN): | $(LOCALBIN)
	@GOBIN=$(LOCALBIN) $(GO) install sigs.k8s.io/controller-tools/cmd/controller-gen@latest

manifests: $(CONTROLLER_GEN)
	@echo "Generating CRD manifests..."
	@$(CONTROLLER_GEN) \
		rbac:roleName=manager-role \
		crd:allowDangerousTypes=true \
		webhook \
		paths="./..." \
		output:crd:artifacts:config=config/crd/bases

generate: $(CONTROLLER_GEN)
	@echo "Generating deepcopy and codegen artifacts..."
	@$(CONTROLLER_GEN) object:headerFile="" paths="./api/..."
	@$(GO) generate ./...

setup-envtest: $(SETUP_ENVTEST)
	@echo "Downloading envtest assets ($(ENVTEST_K8S_VERSION))..."
	@$(SETUP_ENVTEST) use -p path $(ENVTEST_K8S_VERSION) >/dev/null

test-controller: $(SETUP_ENVTEST)
	@echo "Running controller envtest suite..."
	@assets="$$( $(SETUP_ENVTEST) use -p path $(ENVTEST_K8S_VERSION) )"; \
	KUBEBUILDER_ASSETS="$$assets" $(GO) test ./internal/controller/... $(GO_TEST_FLAGS)

fmt: fmt-anf-snapshot
	@echo "Formatting Go code..."
	@$(GO) fmt ./...

fmt-anf-snapshot:
	@echo "Formatting nested ANF snapshot Go code..."
	@files="$$(find tools/anf-snapshot -type f -name '*.go' -print)"; \
	if [[ -n "$$files" ]]; then \
		gofmt -w $$files; \
	fi

fmt-check: fmt-check-anf-snapshot
	@echo "Checking Go formatting..."
	@unformatted="$$(gofmt -l $$(git ls-files '*.go'))"; \
	if [[ -n "$$unformatted" ]]; then \
		echo "The following files are not gofmt-formatted:"; \
		echo "$$unformatted"; \
		exit 1; \
	fi

fmt-check-anf-snapshot:
	@echo "Checking nested ANF snapshot Go formatting..."
	@unformatted="$$(gofmt -l $$(find tools/anf-snapshot -type f -name '*.go' -print))"; \
	if [[ -n "$$unformatted" ]]; then \
		echo "The following nested ANF snapshot files are not gofmt-formatted:"; \
		echo "$$unformatted"; \
		exit 1; \
	fi

vet:
	@echo "Running go vet..."
	@$(GO) vet ./...

staticcheck-anf-snapshot: $(STATICCHECK)
	@echo "Running nested ANF snapshot staticcheck..."
	@cd tools/anf-snapshot && PATH="$(LOCALBIN):$$PATH" $(STATICCHECK) ./...

lint: vet fmt-check staticcheck-anf-snapshot $(STATICCHECK)
	@echo "Running staticcheck..."
	@PATH="$(LOCALBIN):$$PATH" $(STATICCHECK) ./...

build:
	@echo "Building Go binaries..."
	@$(GO) build ./...

build-agentctl:
	@echo "Building agentctl binary..."
	@mkdir -p bin
	@$(GO) build -o bin/agentctl ./cmd/agentctl/...

build-agentctl-web:
	@echo "Building agentctl-web binary..."
	@mkdir -p bin
	@$(GO) build -o bin/agentctl-web ./cmd/agentctl-web/...

build-anf-snapshot:
	@echo "Building anf-snapshot binary..."
	@mkdir -p bin
	@cd tools/anf-snapshot && $(GO) build -o ../../bin/anf-snapshot .

install-agentctl: build-agentctl
	@if [[ ! -f bin/agentctl ]]; then \
		echo "agentctl binary not found at bin/agentctl"; \
		exit 1; \
	fi
	@if [[ -w /usr/local/bin ]]; then \
		install -m 0755 bin/agentctl /usr/local/bin/agentctl; \
	else \
		echo "install-agentctl requires elevated permissions for /usr/local/bin; invoking sudo"; \
		sudo install -m 0755 bin/agentctl /usr/local/bin/agentctl; \
	fi
	@echo "Installed /usr/local/bin/agentctl"

helm-lint:
	@echo "Linting Helm chart..."
	@helm lint charts/

scan-secrets:
	@echo "Running repository secret scan..."
	@chmod +x scripts/scan_secrets.sh
	@./scripts/scan_secrets.sh --ci

clean-venv:
	@rm -rf $(VENV_DIR)

# ── Cluster test targets ──────────────────────────────────────────────────────

test-cluster:
	@echo "Running full cluster test cycle..."
	@chmod +x tests/harness/*.sh tests/smoke/*.sh tests/e2e/*.sh
	@bash tests/harness/run-all.sh

test-smoke:
	@echo "Running smoke tests on existing cluster..."
	@chmod +x tests/smoke/run_smoke.sh tests/harness/preflight.sh
	@bash tests/smoke/run_smoke.sh

test-e2e-cluster:
	@echo "Running E2E tests on existing cluster..."
	@chmod +x tests/e2e/*.sh tests/harness/preflight.sh
	@bash tests/e2e/test_golden_path.sh
	@bash tests/e2e/test_multi_tenant.sh

# =============================================================================
# Observability — added 2026-05-15
# =============================================================================

.PHONY: obs-build-verifier obs-test-audit obs-test-analyzer obs-test obs-helm-lint obs-helm-render obs-demo

# Build the audit-verify CLI used in regulator response and CI smoke tests.
obs-build-verifier:
	go build -o bin/audit-verify ./cmd/audit-verify
	@echo "wrote bin/audit-verify"

# Run all audit-log Go tests (chain hashing, tamper detection, key rotation).
obs-test-audit:
	go test ./pkg/otel/genai/... ./pkg/audit/... ./cmd/audit-verify/... -v

# Run the Python audit analyzer + observability tests (no real ML deps needed
# — fakes are injected; the real ML stack is exercised in the analyzer image
# CI build).
obs-test-analyzer:
	. .venv/bin/activate && python -m pytest agents/observability agents/audit_analyzer -v

# Full observability test suite.
obs-test: obs-test-audit obs-test-analyzer

# Lint the standalone observability subchart.
obs-helm-lint:
	helm lint charts/charts/clawdlinux-observability
	helm lint charts/charts/clawdlinux-observability --set auditAnalyzer.enabled=true

# Render the chart to stdout for review or kubectl apply.
obs-helm-render:
	helm template clawd-obs charts/charts/clawdlinux-observability \
	    --namespace clawdlinux-observability

# End-to-end demo: render an audit ledger, verify it, then tamper and verify.
# Requires obs-build-verifier to have been run.
obs-demo: obs-build-verifier
	@echo "=== Generating sample ledger via go test fixture ==="
	go test ./cmd/audit-verify/... -v -run TestEndToEnd
	@echo
	@echo "=== Demo passed: clean ledger -> exit 0, tampered -> exit 1 ==="