SHELL := /usr/bin/env bash
.DEFAULT_GOAL := test

IMAGE   ?= forgejo.coulomb.social/coulomb/approval-engine
VERSION ?= 0.1.0
# trivy is the sanctioned scanner (operator decision, 2026-09-06).
TRIVY   ?= aquasec/trivy:latest

test: ## Run unit tests
	python3 -m pytest -q

image-build: ## Build the production image locally
	docker build -f Containerfile -t approval-engine:local -t $(IMAGE):$(VERSION) .

image-scan: ## Scan the built image; fails on any CRITICAL or HIGH finding
	docker run --rm -v /var/run/docker.sock:/var/run/docker.sock $(TRIVY) \
	  image --scanners vuln --severity CRITICAL,HIGH \
	  --exit-code 1 $(IMAGE):$(VERSION)

image-release: image-build image-scan ## Build, scan, then push. Push only runs if the scan passes.
	docker push $(IMAGE):$(VERSION)
	@echo "Pin this digest in deploy/approval-engine.yaml (never the tag):"
	@docker inspect --format '{{index .RepoDigests 0}}' $(IMAGE):$(VERSION)

deploy-dry-run: ## Validate Kubernetes manifests without applying them
	kubectl apply --dry-run=client -f deploy/approval-engine.yaml -f deploy/networkpolicies.yaml

help: ## Show this help
	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} \
	  /^[a-zA-Z_-]+:.*?##/ { printf "  \033[36m%-24s\033[0m %s\n", $$1, $$2 }' $(MAKEFILE_LIST)

.PHONY: test image-build image-scan image-release deploy-dry-run help