.PHONY: dev lint test migrate run-api run-worker run-reconciler integration ci chart

dev:
	uv sync

lint:
	uv run ruff check . && uv run ruff format --check . && uv run mypy .

test:
	uv run pytest tests/unit

integration:
	uv run pytest tests/integration

migrate:
	uv run python -m svcforge_core.migrate

run-api:
	uv run uvicorn services.api.main:create_app --factory --reload --port 8000

run-worker:
	uv run python -m services.worker.main

run-reconciler:
	uv run python -m services.reconciler.main

# Every gate CI runs, except the image build — that needs a docker daemon and three
# minutes, and the point of this target is to find out you failed before pushing.
# Same commands as .gitea/workflows/ci.yaml, deliberately: a gate that only exists in CI
# is a gate you debug through a web UI. Each recipe line below is the command from the
# corresponding job, character for character. If you change one, change both.
ci:
	uv run ruff check . && uv run ruff format --check .
	uv run mypy --strict .
	uv run pytest tests/unit --cov=svcforge_core.domain --cov-fail-under=90
	uv run python -m svcforge_core.migrate
	uv run pytest tests/integration
	uv run --with 'bandit[toml]' bandit -c pyproject.toml -r libs services -ll
	uv export --frozen --no-dev \
		--no-emit-project --no-emit-package svcforge-core \
		-o /tmp/requirements-audit.txt
	uv run --with pip-audit pip-audit --strict -r /tmp/requirements-audit.txt
	hadolint services/*/Dockerfile
	$(MAKE) chart

# The chart's own gates, mirroring the `chart` job in ci.yaml.
#
# `helm template` against plain values.yaml MUST FAIL: the digests there are all-zeros
# placeholders and _helpers.tpl refuses to build an image reference from one. So this
# asserts the failure rather than running the command bare — a bare `helm template` here
# would report the guard working as a broken build, and the previous version of this
# target did exactly that.
#
# The second render uses well-formed dummy digests to prove the templates themselves are
# valid, with both values-gated monitoring blocks turned on.
chart:
	helm lint deploy/chart
	@if helm template svcforge deploy/chart >/dev/null 2>&1; then \
		echo "FAIL: chart rendered against the placeholder digests in values.yaml."; \
		echo "The digest guard in _helpers.tpl is not guarding."; \
		exit 1; \
	fi
	@echo "ok: placeholder digests rejected"
	helm template svcforge deploy/chart \
		--set image.api.digest=sha256:$(shell printf 'a%.0s' $$(seq 64)) \
		--set image.worker.digest=sha256:$(shell printf 'b%.0s' $$(seq 64)) \
		--set image.reconciler.digest=sha256:$(shell printf 'c%.0s' $$(seq 64)) \
		--set serviceMonitor.enabled=true \
		--set prometheusRule.enabled=true \
		>/dev/null
	@echo "ok: chart renders"