# Platform battery as one command: `make check` is what CI calls and what a session runs before
# handing the tree over. Toolchain and linter are PINNED (never "latest"): a gate that changes
# under you on someone else's machine is not a gate. Shape mirrors backend/Makefile deliberately.

GO ?= go
# go.mod's floor is 1.26.4 (the engine's), but the BUILD toolchain floor here is 1.26.5: it carries
# the crypto/tls and os security fixes, and this module is the one exposed to the network.
GO_MIN_VERSION := 1.26.5
GOLANGCI_LINT ?= golangci-lint
GOLANGCI_VERSION := 2.12.2

.PHONY: build vet fmt lint test check tools-check vuln

build: tools-check
	$(GO) build ./...

vet:
	$(GO) vet ./...

# `gofmt -l` exits 0 even when it names files, so the emptiness of its output is the assertion.
fmt:
	@test -z "$$(gofmt -l .)" || { echo "gofmt: not formatted:"; gofmt -l .; exit 1; }

tools-check:
	@$(GO) version | grep -qE 'go1\.26\.([5-9]|[0-9]{2,})|go1\.(2[7-9]|[3-9][0-9])' || { \
		echo "Go $(GO_MIN_VERSION)+ required (security fixes in a network-facing module); got: $$($(GO) version)"; exit 1; }
	@$(GOLANGCI_LINT) --version 2>/dev/null | grep -q " $(GOLANGCI_VERSION) " || { \
		echo "golangci-lint $(GOLANGCI_VERSION) required (findings are version-dependent)."; \
		echo "install: https://github.com/golangci/golangci-lint/releases/tag/v$(GOLANGCI_VERSION)"; exit 1; }

lint: tools-check
	$(GOLANGCI_LINT) run --timeout=10m ./...

# -race needs cgo. If the C toolchain is missing this fails loudly rather than quietly proving less.
test:
	$(GO) test ./... -race -count=1

# The battery. It ends by NAMING the tests that did not run: the database-backed ones skip without
# TM_PLATFORM_TEST_DSN, and a silent skip reads as coverage.
check: build vet fmt lint test
	@echo "--- did NOT run (no database; set TM_PLATFORM_TEST_DSN) ---"
	@$(GO) test ./... -count=1 -v > .skips.log 2>&1 || { echo "the skip-harvest pass FAILED:"; \
		grep -E '^(---|\s+---) FAIL|^FAIL' .skips.log; rm -f .skips.log; exit 1; }
	@grep -- '--- SKIP' .skips.log || echo "(none)"
	@rm -f .skips.log

# Not part of `check`: it needs the network (the vulnerability database), and the battery must be
# green on a bare clone offline. CI runs it as its own step (STACK_DECISIONS §5).
vuln:
	$(GO) run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...