SHELL := /usr/bin/env bash
.DEFAULT_GOAL := help

# The live forge release source is railiance-apps (helm/forgejo-values.yaml,
# make forgejo-deploy). This repo only observes it (FORGE-WP-0009).
FORGE_RELEASE ?= forgejo
FORGE_NAMESPACE ?= forgejo
FORGE_HTTP_SERVICE ?= forge-http
FORGE_SSH_SERVICE ?= forgejo-ssh-nodeport
FORGE_DB_CLUSTER ?= forgejo-db
FORGE_DB_NAMESPACE ?= databases
REGISTRY_DOCS ?= docs/gitea-container-registry.md docs/gitea-package-registry.md
EVIDENCE_DOCS ?= docs/observability-operating-evidence.md docs/ci-runner-actions-gitops-ownership.md docs/backup-restore-secret-handoff.md
RUNNER_DOCS ?= docs/gitea-actions-runner-substrate.md docs/gitea-actions-runner-evidence.md
SOPS_SENTINEL ?=

##@ Operator checks

check-tools: ## Check local tools used by forge operator targets
	@missing=0; \
	for tool in kubectl helm sops; do \
		if command -v $$tool >/dev/null 2>&1; then \
			echo "ok: $$tool"; \
		else \
			echo "missing: $$tool"; \
			missing=1; \
		fi; \
	done; \
	if command -v tea >/dev/null 2>&1; then \
		echo "ok: tea"; \
	else \
		echo "optional: tea not found"; \
	fi; \
	exit $$missing

check-sops: ## Verify the given SOPS_SENTINEL file can decrypt
	@test -n "$(SOPS_SENTINEL)" || { echo "set SOPS_SENTINEL=<sops file>" >&2; exit 2; }
	sops -d $(SOPS_SENTINEL) >/dev/null

registry-docs: ## Print canonical registry docs
	@for doc in $(REGISTRY_DOCS); do \
		printf '\n## %s\n\n' "$$doc"; \
		sed -n '1,220p' "$$doc"; \
	done

evidence-docs: ## Print forge evidence and handoff contracts
	@for doc in $(EVIDENCE_DOCS); do \
		printf '\n## %s\n\n' "$$doc"; \
		sed -n '1,260p' "$$doc"; \
	done

runner-docs: ## Print Forgejo Actions runner substrate docs and evidence
	@for doc in $(RUNNER_DOCS); do \
		printf '\n## %s\n\n' "$$doc"; \
		sed -n '1,260p' "$$doc"; \
	done

runner-status: ## Read-only Actions runner, host, and inter-hub registry probes
	bash tools/gitea-runner-status.sh

forgejo-runner-status: ## Read-only Forgejo Actions runner and endpoint probes
	bash tools/forgejo-runner-status.sh

forge-observe: ## Capture non-secret forge capacity, recovery, and allocation evidence
	python3 tools/observe_forge_resources.py \
	  $(if $(REMOTE),--remote $(REMOTE),) \
	  --output-dir docs/evidence/resource-railiance-forgejo/observations

test-unit: ## Run non-live forge evidence tests
	python3 -m unittest discover -s tests -p 'test_*.py' -v

check-runner-tools: ## Check local tools used by runner inspection targets
	@missing=0; \
	for tool in curl ssh docker; do \
		if command -v $$tool >/dev/null 2>&1; then \
			echo "ok: $$tool"; \
		else \
			echo "missing: $$tool"; \
			missing=1; \
		fi; \
	done; \
	for tool in skopeo act_runner; do \
		if command -v $$tool >/dev/null 2>&1; then \
			echo "ok: $$tool"; \
		else \
			echo "optional: $$tool not found"; \
		fi; \
	done; \
	exit $$missing

##@ Current Forgejo (target names keep the legacy gitea- prefix)

gitea-deploy gitea-ingress-deploy forge-deploy: ## Removed: deploy the forge from railiance-apps
	@echo "The forge is deployed from railiance-apps (make forgejo-deploy; see RAPPS-WP-0019 for the cutover order)." >&2
	@echo "This repo's former Gitea-chart targets carried stale values and are retired (FORGE-WP-0009)." >&2
	@exit 2

forgejo-status: forge-status ## Read-only status for the forge runtime and database (alias)

forge-status: ## Read-only status for the forge runtime and database
	kubectl get pods -n $(FORGE_NAMESPACE) -l app.kubernetes.io/instance=$(FORGE_RELEASE)
	kubectl get svc -n $(FORGE_NAMESPACE) $(FORGE_HTTP_SERVICE) --ignore-not-found
	kubectl get svc -n $(FORGE_NAMESPACE) $(FORGE_SSH_SERVICE) --ignore-not-found
	kubectl get ingress -n $(FORGE_NAMESPACE) $(FORGE_RELEASE) --ignore-not-found
	@if kubectl cnpg status $(FORGE_DB_CLUSTER) -n $(FORGE_DB_NAMESPACE) >/dev/null 2>&1; then \
		kubectl cnpg status $(FORGE_DB_CLUSTER) -n $(FORGE_DB_NAMESPACE); \
	else \
		echo "kubectl cnpg plugin not available; falling back to cnpg resources"; \
		kubectl get cluster $(FORGE_DB_CLUSTER) -n $(FORGE_DB_NAMESPACE); \
		kubectl get pods -n $(FORGE_DB_NAMESPACE) -l cnpg.io/cluster=$(FORGE_DB_CLUSTER); \
	fi

##@ Help

help: ## Show this help
	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} \
	  /^[a-zA-Z0-9_-]+:.*?##/ { printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2 } \
	  /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST)

.PHONY: check-tools check-sops registry-docs evidence-docs runner-docs runner-status forgejo-runner-status forge-observe test-unit check-runner-tools gitea-deploy gitea-ingress-deploy gitea-status forgejo-status help

##@ Secret detection

GO ?= go

test-secret-detection: ## Verify receive-path refusal with an explicitly admitted test scanner
	@test -n "$${FORGE_TEST_GITLEAKS:-}" || { echo "FORGE_TEST_GITLEAKS must name the admitted test binary" >&2; exit 2; }
	cd tools/receive-secret-scan && $(GO) test -count=1 ./...

.PHONY: test-secret-detection

# CUST-WP-0079-T05: staged-source generation; hook uses the isolated recipe.
.PHONY: generated-work-records generated-work-records-check
generated-work-records:
	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records
generated-work-records-check:
	$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check