# scheduler — the repo's command surface (D-27).
#
# There is no venv in this working tree today, even though CLAUDE.md documents
# `.venv/bin/python -m pytest`. `make test` says so rather than failing with a
# bare "No such file or directory", and `make setup` creates one.
#
# `python3` on this host is 3.8; PYTHON names 3.12 explicitly (D-26).

VENV   := $(CURDIR)/.venv
PYTHON ?= python3.12

.DEFAULT_GOAL := help

.PHONY: help
help: ## Show this help
	@grep -hE '^[a-z][a-z0-9_-]*:.*?## ' $(MAKEFILE_LIST) \
	  | awk 'BEGIN{FS=":.*?## "}{printf "  \033[36m%-14s\033[0m %s\n", $$1, $$2}'

.PHONY: setup
setup: ## Create the venv, install the test extra, and prove it actually works
	$(PYTHON) -m venv .venv
	$(VENV)/bin/pip install -e ".[test]"
	@# Exit 0 from `pip install` is not evidence (D-24) — pip reports success even
	@# when the result is unusable. Prove the environment works instead of trusting
	@# the install step: `--collect-only` imports every test module and therefore
	@# every src module each one pulls in, which is exactly the failure mode this
	@# target exists to catch (T-47 — this repo had no venv at all on 2026-08-09,
	@# and the documented test command could not work). It runs zero tests, so it
	@# stays cheap, and unlike a bare `import src.main` it exercises the tests/
	@# tree too, not just the package.
	$(VENV)/bin/python -m pytest tests/ --collect-only -q

.PHONY: test
test: ## Run the test suite — hermetic, no live services (D-26)
	@test -x $(VENV)/bin/python || { echo "FAIL — no venv in this tree; run: make setup"; exit 69; }
	# Integration tests are deselected here, not skipped by accident. Twelve
	# tests in test_database_integration.py carry @pytest.mark.integration and
	# need a real Postgres; they errored on every run of this target because
	# nothing deselected them, and the marker had no target to select it either.
	# So they neither passed nor ran — they just made `make test` exit 2 forever,
	# which trains a reader to ignore the exit code (T-55).
	#
	# They were invisible to the netns audit that found the rest of this: they
	# fail identically with and without a network, because postgres-shared is a
	# Docker-internal name a host process cannot resolve in either case. A
	# namespace proves a test does not reach the network; it cannot tell that
	# apart from a test whose dependency is unreachable anyway.
	$(VENV)/bin/python -m pytest tests/ -m "not integration"

.PHONY: test-integration
test-integration: ## Run only the tests that need live Postgres/Redis
	@test -x $(VENV)/bin/python || { echo "FAIL — no venv in this tree; run: make setup"; exit 69; }
	# Refuses an empty selection. A target that passes because it selected
	# nothing is the defect this repo keeps meeting from the other side, so
	# pytest's exit 5 (no tests collected) is a failure with its own message,
	# and a collection error gets a different one — "nothing to run" must never
	# read as "everything passed" (D-24).
	@$(VENV)/bin/python -m pytest tests/ -m integration --collect-only -q >/dev/null 2>&1; \
	 rc=$$?; \
	 if [ $$rc -eq 5 ]; then \
	   echo "FAIL test-integration — selected 0 tests (marker renamed, moved, or lost — this is a defect, not a pass)"; exit 1; \
	 elif [ $$rc -ne 0 ]; then \
	   echo "FAIL test-integration — collection errored (rc=$$rc)"; exit 1; \
	 fi
	$(VENV)/bin/python -m pytest tests/ -m integration -v

# No `lint` target, deliberately. CLAUDE.md states it outright: no linter is
# configured, no ruff or flake8 config, neither in the dependencies. Per D-27
# the name is reserved for repos that lint rather than mandated everywhere — a
# target here could only fail or report clean for something never run.

# git hands a hook a non-login shell, which never sees ~/.local/bin — where
# gitleaks lands. Without this the scan reports "not installed" on every push,
# which is a check that fails open (D-24).
export PATH := $(HOME)/.local/bin:/usr/local/bin:$(PATH)

.PHONY: secrets
secrets: ## Scan the commits about to be pushed for credentials
	@ci/secrets.sh

# The call surface is identical in every repo; what it runs is not.
#
# `secrets` runs first, deliberately: it is the only failure here that cannot be
# undone by fixing it afterwards. A failed lint costs another commit; a pushed
# credential is cached and indexed whether or not it is later deleted.
#
# Some of these fail today, and are left wired anyway. The state was measured
# once and written down in T-56 rather than being worked around here — a gate
# quietly narrowed to what already passes is a gate that reports success for
# doing nothing, which is the failure this workspace keeps rediscovering.
.PHONY: pre-push
pre-push: secrets ## Everything the pre-push hook runs
	@echo "  --   not gated here yet: lint (no linter configured) and test (T-56)"