Makefile

# make
# To run all lint checks: `LINT_OPTIONS= make lint`

.PHONY: all buf-check build clean connect-wrapper-generate docker-build fix fmt fuzz go-lint license lint otdfctl/otdfctl policy-sql-gen proto-generate proto-helper-generate proto-lint sdk/sdk sqlc-check test tidy toolcheck

MODS=protocol/go lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service otdfctl tests-bdd
HAND_MODS=lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service otdfctl tests-bdd
REQUIRED_BUF_VERSION=1.70.0
REQUIRED_SQLC_VERSION=1.31.1

ROOT_DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))

# LINT_OPTIONS?=--new
# LINT_OPTIONS?=-new-from-rev=main
LINT_OPTIONS?=-c $(ROOT_DIR)/.golangci.yaml

all: toolcheck clean build lint license test

toolcheck:
	@echo "Checking for required tools..."
	@$(MAKE) --no-print-directory buf-check
	@which golangci-lint > /dev/null || (echo "golangci-lint not found, run  'go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2'" && exit 1)
	@which protoc-gen-doc > /dev/null || (echo "protoc-gen-doc not found, run 'go install github.com/pseudomuto/protoc-gen-doc/cmd/protoc-gen-doc@v1.5.1'" && exit 1)
	@which protoc-gen-connect-openapi > /dev/null || (echo "protoc-gen-connect-openapi not found, run 'go install github.com/sudorandom/protoc-gen-connect-openapi@v0.18.0'" && exit 1)
	@required_golangci_lint_version="2.13.2"; \
	current_version=$$(golangci-lint --version | grep -Eo 'v?[0-9]+\.[0-9]+\.[0-9]+' | sed 's/^v//' | head -n 1); \
	[ "$$(printf '%s\n' "$$required_golangci_lint_version" "$$current_version" | sort -V | head -n1)" = "$$required_golangci_lint_version" ] || \
		(echo "golangci-lint version must be v$$required_golangci_lint_version or later [found: $$current_version]" && exit 1)
	@which goimports >/dev/null || (echo "goimports not found, run 'go install golang.org/x/tools/cmd/goimports@latest'")
	@govulncheck -version >/dev/null || (echo "govulncheck not found, run 'go install golang.org/x/vuln/cmd/govulncheck@latest'")

buf-check:
	@which buf > /dev/null || (echo "buf not found, please install it from https://docs.buf.build/installation" && exit 1)
	@BUF_VERSION=$$(buf --version | head -n 1 | awk '{print $$1}' | sed 's/^v//'); \
	if [ "$$(printf '%s\n' '$(REQUIRED_BUF_VERSION)' "$$BUF_VERSION" | sort -V | head -n 1)" != "$(REQUIRED_BUF_VERSION)" ]; then \
		echo "Error: buf version $(REQUIRED_BUF_VERSION) or later is required, but found $$BUF_VERSION."; \
		echo "Please upgrade buf. See https://docs.buf.build/installation for instructions."; \
		exit 1; \
	fi

sqlc-check:
	@which sqlc > /dev/null || { echo "sqlc not found, please install it: https://docs.sqlc.dev/en/stable/overview/install.html"; exit 1; }
	@SQLC_VERSION=$$(sqlc version | head -n 1 | grep -Eo 'v?[0-9]+\.[0-9]+\.[0-9]+' | sed 's/^v//'); \
	if [ "$$(printf '%s\n' '$(REQUIRED_SQLC_VERSION)' "$$SQLC_VERSION" | sort -V | head -n 1)" != "$(REQUIRED_SQLC_VERSION)" ]; then \
		echo "Error: sqlc version $(REQUIRED_SQLC_VERSION) or later is required, but found $$SQLC_VERSION."; \
		echo "Please upgrade sqlc. See https://docs.sqlc.dev/en/stable/overview/install.html for instructions."; \
		exit 1; \
	fi

fix: tidy fmt

fmt:
	for m in $(HAND_MODS); do  golangci-lint fmt $$m || exit 1; done

tidy:
	for m in $(MODS); do (cd $$m && go mod tidy) || exit 1; done

license:
	for m in $(MODS); do (cd $$m && go run github.com/google/go-licenses@v1.6.0 check --disallowed_types=forbidden --include_tests ./) || exit 1; done

lint: proto-lint go-lint govulncheck

proto-lint:
	buf lint service || (exit_code=$$?; \
	 if [ $$exit_code -eq 100 ]; then \
      echo "Buf lint exited with code 100, treating as success"; \
		else \
			echo "Buf lint exited with code $$exit_code"; \
			exit $$exit_code; \
		fi)

go-lint:
	status=0; \
	for m in $(HAND_MODS); do \
		echo "Linting module: $$m"; \
		(cd "$$m" && golangci-lint run $(LINT_OPTIONS) ) || status=1; \
	done; \
	exit $$status

govulncheck:
	status=0; \
	for m in $(MODS); do \
		echo "govulncheck module: $$m"; \
		(cd "$$m" && govulncheck ./...) || status=1; \
	done; \
	exit $$status

proto-generate: toolcheck
	# remove all generated directories under protocol/go
	find protocol/go -mindepth 1 -maxdepth 1 -type d ! -name internal -exec rm -rf {} +
	rm -rf docs/grpc docs/openapi
	buf generate service
	buf generate service --template buf.gen.grpc.docs.yaml
	buf generate service --template buf.gen.openapi.docs.yaml

	cd protocol/codegen && go run .
	go run ./sdk/codegen

connect-wrapper-generate:
	go run ./sdk/codegen

proto-helper-generate:
	cd protocol/codegen && go run .

policy-sql-gen: sqlc-check
	sqlc generate -f service/policy/db/sqlc.yaml

policy-erd-gen:
	@which mermerd > /dev/null || { echo "mermerd not found, please install it: https://github.com/KarnerTh/mermerd#installation"; exit 1; }
	# Docs: https://github.com/KarnerTh/mermerd#parametersflags
	mermerd -c 'postgresql://postgres:changeme@localhost:5432/opentdf' -e -o service/policy/db/schema_erd.md -s opentdf_policy --useAllTables --showDescriptions enumValues,columnComments
	# Add mermaid CSS to the end of the generated file
	@echo '\n<style>div.mermaid{overflow-x:scroll;}div.mermaid>svg{width:250rem;}</style>' >> service/policy/db/schema_erd.md

test:
	for m in $(HAND_MODS); do (cd $$m && go test ./... -race) || exit 1; done

# Budget per fuzz target, not for the run as a whole: `make fuzz` costs roughly
# FUZZTIME multiplied by the number of targets. Override for a longer soak, e.g.
# `make fuzz FUZZTIME=10m`.
FUZZTIME?=30s

# `go test -fuzz` mutates input only when -fuzz is passed; without it a FuzzXxx
# function is an ordinary test that replays its seed corpus and -fuzztime is
# ignored. It also accepts exactly one package and one target per invocation
# (`go test ./... -fuzz=...` is rejected), so the nested loop is required rather
# than stylistic.
#
# Targets are discovered instead of listed so a new FuzzXxx is picked up without
# editing this file. The grep narrows to candidate packages first because
# `go test -list` has to build a test binary per package and most packages here
# have no fuzz targets. testdata and vendor are skipped since they hold corpus
# files and third-party code, never targets. A failing `go test -list` (e.g. a
# package that does not compile) aborts the run with its errors visible rather
# than being treated as "no targets", which would let `make fuzz` pass having
# fuzzed nothing.
#
# A crasher gets written to testdata/fuzz/<Target>/<hash> and is replayed as a
# seed by every later `go test`, so it turns the suite red until the underlying
# bug is fixed. Keep a crasher in the same commit as its fix.
fuzz:
	@for m in $(HAND_MODS); do \
		(cd $$m && \
		dirs=$$(grep -rl --include='*_test.go' --exclude-dir=testdata --exclude-dir=vendor '^func Fuzz' . \
			| while read -r f; do dirname "$$f"; done | sort -u); \
		for d in $$dirs; do \
			listing=$$(go test -list '^Fuzz' "$$d") || { echo "go test -list failed in $$m $$d" >&2; exit 1; }; \
			for fn in $$(echo "$$listing" | grep '^Fuzz'); do \
				echo "==> $$m $$d $$fn ($(FUZZTIME))"; \
				go test -run '^$$' -fuzz "^$$fn$$" -fuzztime=$(FUZZTIME) "$$d" || exit 1; \
			done; \
		done) || exit 1; \
	done

bench:
	for m in $(HAND_MODS); do (cd $$m && go test -bench ./... -benchmem) || exit 1; done

clean:
	for m in $(MODS); do (cd $$m && go clean) || exit 1; done
	rm -f opentdf otdfctl/otdfctl

build: proto-generate connect-wrapper-generate opentdf sdk/sdk otdfctl/otdfctl

opentdf: $(shell find service)
	go build -o opentdf -v service/main.go

sdk/sdk: $(shell find sdk)
	(cd sdk && go build ./...)

otdfctl/otdfctl: $(shell find otdfctl)
	(cd otdfctl && go build -o otdfctl .)

docker-build: build
	docker build -t opentdf .