# heretek-devcontainers Makefile
#
#   make check             static verifier + offline unit tests
#   make accept            the three wave acceptance gates
#   make images            resolve every pinned remote image in its registry (network)
#   make validate-gateway  validate compose/agentgateway.yaml with the real binary
#   make validate-compose  render the merged compose model (`docker compose config`)
#   make validate-units    lint quadlet .socket/.service units (`systemd-analyze verify`)

.PHONY: check accept verify test images validate-gateway validate-compose validate-units

AGENTGATEWAY ?= $(shell command -v agentgateway 2>/dev/null)

check:
	@echo "==> bun run scripts/verify-stack.ts"
	@bun run scripts/verify-stack.ts
	@echo "==> bun test"
	@bun test

accept:
	@for w in 1 2 3; do \
		echo "==> bash scripts/accept/wave-$$w.sh"; \
		bash scripts/accept/wave-$$w.sh || exit 1; \
	done

verify:
	@bun run scripts/verify-stack.ts

test:
	@bun test

images:
	@bun run scripts/check-images.ts

# Runs the agentgateway binary named by AGENTGATEWAY (default: `agentgateway`
# on PATH); skips with a notice when none is installed. The two role keys are
# dummies: the config references them and the binary refuses unset variables.
validate-gateway:
	@if [ -n "$(AGENTGATEWAY)" ] && [ -x "$(AGENTGATEWAY)" ]; then \
		echo "==> $(AGENTGATEWAY) -f compose/agentgateway.yaml --validate-only"; \
		AGENTGATEWAY_ADMIN_KEY=validate-only AGENTGATEWAY_AGENT_KEY=validate-only BIFROST_VIRTUAL_KEY=validate-only \
			"$(AGENTGATEWAY)" -f compose/agentgateway.yaml --validate-only; \
	else \
		echo "==> agentgateway binary not found (set AGENTGATEWAY=/path/to/agentgateway) — skipping"; \
	fi

validate-compose:
	@if command -v docker >/dev/null 2>&1; then \
		echo "==> docker compose --profile all config -q"; \
		BIFROST_API_KEY=x OPENROUTER_API_KEY=x BIFROST_VIRTUAL_KEY=x BIFROST_ADMIN_USERNAME=x BIFROST_ADMIN_PASSWORD=x AGENTGATEWAY_ADMIN_KEY=x AGENTGATEWAY_AGENT_KEY=x \
		GHIDRA_MCP_AUTH_TOKEN=x SEARXNG_SECRET=x docker compose --profile all config -q; \
	else \
		echo "==> docker not found — skipping"; \
	fi

# Container units are generated by Podman's quadlet generator, so they are
# replaced by stubs here; the .socket and proxy .service units are verified as-is.
validate-units:
	@if command -v systemd-analyze >/dev/null 2>&1; then \
		tmp="$$(mktemp -d)"; trap 'rm -rf "$$tmp"' EXIT; \
		cp quadlets/*.socket quadlets/*.service "$$tmp"/; \
		for c in quadlets/*.container; do \
			printf '[Unit]\nStopWhenUnneeded=true\n[Service]\nExecStart=/bin/true\n' > "$$tmp/$$(basename "$$c" .container).service"; \
		done; \
		echo "==> systemd-analyze verify quadlets/*.socket quadlets/*.service"; \
		out="$$(cd "$$tmp" && systemd-analyze verify --man=no *-proxy.socket *-proxy.service 2>&1)"; \
		if [ -n "$$out" ]; then echo "$$out"; exit 1; fi; \
	else \
		echo "==> systemd-analyze not found — skipping"; \
	fi
