# Makefile
SHELL := /usr/bin/env bash

KUSTOMIZE ?= kustomize
PYTHON ?= $(if $(wildcard .venv/bin/python),.venv/bin/python,python3)
TERRAFORM ?= terraform
TRIVY ?= trivy
BUILD_DIR ?= build
ATLAS_FLUX_ROOT := clusters/atlas/flux-system
AETHER_FLUX_ROOT := clusters/aether/flux-system
AETHER_TF_DIR := terraform/aether
FLUX_KUSTOMIZATION ?= flux-system
FLUX_NAMESPACE ?= flux-system
FLUX_PATH ?= $(ATLAS_FLUX_ROOT)
TRIVY_CACHE_DIR ?= $(BUILD_DIR)/trivy-cache
TRIVY_DB_FLAGS ?= --skip-db-update

.PHONY: help render render-atlas render-aether render-services render-infrastructure validate dashboards knowledge test flux-diff flux-inventory trivy-scan security-report security aether-fmt aether-init aether-validate aether-plan

help:
	@printf '%s\n' \
		'Targets:' \
		'  render                Render Atlas, Aether, services, and infrastructure.' \
		'  render-atlas          Render the Atlas Flux root.' \
		'  render-aether         Render the Aether Flux root.' \
		'  render-services       Render every service kustomization.' \
		'  render-infrastructure Render infrastructure kustomizations.' \
		'  validate              Run render checks plus the local quality gate.' \
		'  dashboards            Regenerate Grafana dashboard artifacts.' \
		'  knowledge             Regenerate Atlas knowledge artifacts and comms mirror.' \
		'  test                  Run the local quality gate.' \
		'  flux-diff             Diff a Flux Kustomization; override FLUX_KUSTOMIZATION/FLUX_PATH.' \
		'  flux-inventory        Print Flux Kustomization inventory.' \
		'  trivy-scan            Run the local Trivy filesystem scan.' \
		'  security-report       Build IronBank report from build/trivy-fs.json.' \
		'  security              Run Trivy scan and build the IronBank report.' \
		'  aether-fmt            Check Terraform formatting for Aether.' \
		'  aether-init           Initialize Aether Terraform providers.' \
		'  aether-validate       Validate Aether Terraform after init.' \
		'  aether-plan           Plan Aether Terraform from local variables/env.'

render: render-atlas render-aether render-services render-infrastructure

render-atlas:
	$(KUSTOMIZE) build $(ATLAS_FLUX_ROOT) >/tmp/titan-iac-atlas-flux-system.yaml

render-aether:
	$(KUSTOMIZE) build $(AETHER_FLUX_ROOT) >/tmp/titan-iac-aether-flux-system.yaml

render-services:
	@set -euo pipefail; \
	while IFS= read -r k; do \
		d="$${k%/kustomization.yaml}"; \
		printf 'render %s\n' "$$d"; \
		$(KUSTOMIZE) build "$$d" >/tmp/titan-iac-render.yaml; \
	done < <(find services -name kustomization.yaml | sort)

render-infrastructure:
	@set -euo pipefail; \
	while IFS= read -r k; do \
		d="$${k%/kustomization.yaml}"; \
		printf 'render %s\n' "$$d"; \
		$(KUSTOMIZE) build "$$d" >/tmp/titan-iac-render.yaml; \
	done < <(find infrastructure -name kustomization.yaml | sort)

validate: render test

dashboards:
	$(PYTHON) scripts/render/dashboards_render_atlas.py --build
	$(PYTHON) scripts/render/dashboards_render_logs.py --build
	$(PYTHON) scripts/render/logging_render_observability.py --build

knowledge:
	$(PYTHON) scripts/render/knowledge_render_atlas.py --write --sync-comms

test:
	$(PYTHON) -m testing.quality_gate --profile local --build-dir $(BUILD_DIR)

flux-diff:
	flux diff kustomization $(FLUX_KUSTOMIZATION) --namespace $(FLUX_NAMESPACE) --path $(FLUX_PATH)

flux-inventory:
	$(PYTHON) scripts/render/flux_inventory.py $(ATLAS_FLUX_ROOT)

trivy-scan:
	mkdir -p $(BUILD_DIR)
	$(TRIVY) fs --cache-dir "$(TRIVY_CACHE_DIR)" $(TRIVY_DB_FLAGS) --skip-files clusters/atlas/flux-system/gotk-components.yaml --timeout 5m --no-progress --format json --output $(BUILD_DIR)/trivy-fs.json --scanners vuln,secret,misconfig --severity HIGH,CRITICAL .

security-report:
	@test -s $(BUILD_DIR)/trivy-fs.json || { printf '%s\n' 'missing build/trivy-fs.json; run make trivy-scan first'; exit 1; }
	$(PYTHON) ci/scripts/supply_chain_report.py --trivy-json $(BUILD_DIR)/trivy-fs.json --waivers ci/titan-iac-trivy-waivers.json --output $(BUILD_DIR)/ironbank-compliance.json

security: trivy-scan security-report

aether-fmt:
	$(TERRAFORM) -chdir=$(AETHER_TF_DIR) fmt -check

aether-init:
	$(TERRAFORM) -chdir=$(AETHER_TF_DIR) init

aether-validate:
	$(TERRAFORM) -chdir=$(AETHER_TF_DIR) validate

aether-plan:
	$(TERRAFORM) -chdir=$(AETHER_TF_DIR) plan