SHELL := /usr/bin/env bash
.DEFAULT_GOAL := help

help: ## Show this help
	@grep -E '^[a-zA-Z0-9_-]+:.*?## ' $(MAKEFILE_LIST) | sort | sed 's/:.*##/: /'

check: ## Verify workflow templates remain private and deployment-free
	python3 tools/check_private_defaults.py

test: ## Run enablement regression tests
	python3 -m unittest discover -s tests -v

ARGOCD_DIR := deploy/argocd/railiance01
include $(ARGOCD_DIR)/PIN

argocd-fetch: ## Fetch the pinned Argo CD core manifest and verify its sha256
	mkdir -p $(ARGOCD_DIR)/upstream
	curl -fsSL -o $(ARGOCD_DIR)/upstream/core-install.yaml $(ARGOCD_MANIFEST_URL)
	echo "$(ARGOCD_MANIFEST_SHA256)  $(ARGOCD_DIR)/upstream/core-install.yaml" | sha256sum -c -

argocd-render: argocd-fetch ## Render the declared Argo CD state (no cluster contact)
	kubectl kustomize $(ARGOCD_DIR)

argocd-diff: argocd-fetch ## Read-only server-side diff of declared Argo CD state against railiance01
	kubectl kustomize $(ARGOCD_DIR) | ssh railiance01 'kubectl diff --server-side -n argocd -f -'

.PHONY: help check test argocd-fetch argocd-render argocd-diff