# webber — the repo's command surface (D-27).
#
# Multi-component, so this lives at the root and reaches down rather than
# sitting inside webber-api/. The code, tests and tooling config are all in
# webber-api/; sandbox-templates/ and sandbox.sh are the other half of the repo
# and have no build of their own. Keeping one Makefile means `make test` means
# the same thing wherever you are standing (D-27).
#
# Paths resolve here (D-10): `python3` is 3.8 on this host, and a bare `pytest`
# or `ruff` resolves only in a login shell.

API    := $(CURDIR)/webber-api
VENV   := $(API)/.venv
PYTHON ?= python3.12

.DEFAULT_GOAL := help

.PHONY: help
help: ## Show this help
	@grep -hE '^[a-z][a-z0-9_-]*:.*?## ' $(MAKEFILE_LIST) \
	  | awk 'BEGIN{FS=":.*?## "}{printf "  \033[36m%-14s\033[0m %s\n", $$1, $$2}'

.PHONY: setup
# Covers webber-api only. webber-cli and webber-sandbox each have their own
# pyproject.toml and venv but are not wired in here — that reads as an
# omission rather than a decision: no ticket or decision record excludes
# them, and their .venvs on disk predate this target and were built by hand.
# Flagged here rather than silently extended — T-47's scope is verification
# of what setup already covers, not widening what it covers.
setup: ## Create/converge the webber-api venv and prove it's usable (T-47)
	cd $(API) && $(PYTHON) -m venv .venv && .venv/bin/pip install -r requirements-dev.txt -e .
	@# The prior line read `pip install -e ".[dev]"`, but pyproject.toml
	@# declares no [dev] extra and never has (checked full history) — pip
	@# only warns ("does not provide the extra 'dev'") and installs the
	@# bare package, so `setup` silently produced a venv with no pytest,
	@# ruff or mypy. requirements-dev.txt (which -r's requirements.txt) is
	@# the real dev dependency list; this is what it was presumably meant
	@# to install. Found by the check below, which failed on the very
	@# first run against a clean venv (T-47).
	@# Exit 0 from pip install is not evidence the env is usable (D-24) — a
	@# step whose job is to not fail has a passing state indistinguishable
	@# from its broken state. collect-only exercises the real import graph
	@# (src.main, every domain, every dev/test dependency pytest itself
	@# needs), not just one module import, so it catches a missing dev
	@# dependency the same as a broken package import — and fails the
	@# target when it does.
	cd $(API) && .venv/bin/python -m pytest tests/ --collect-only -q

.PHONY: test
test: ## Run the webber-api test suite
	@test -x $(VENV)/bin/python || { echo "FAIL — no venv; run: make setup"; exit 69; }
	cd $(API) && .venv/bin/python -m pytest tests/

.PHONY: lint
lint: ## ruff check over webber-api
	@test -x $(VENV)/bin/ruff || { echo "FAIL — ruff not installed; run: make setup"; exit 69; }
	cd $(API) && .venv/bin/ruff check .

.PHONY: typecheck
typecheck: ## mypy over webber-api
	@test -x $(VENV)/bin/mypy || { echo "FAIL — mypy not installed; run: make setup"; exit 69; }
	cd $(API) && .venv/bin/mypy .

# git hands a hook a non-login shell, which never sees ~/.local/bin — where
# gitleaks lands. Without this the scan reports "not installed" on every push,
# which is a check that fails open (D-24).
export PATH := $(HOME)/.local/bin:/usr/local/bin:$(PATH)

.PHONY: secrets
secrets: ## Scan the commits about to be pushed for credentials
	@ci/secrets.sh

# The call surface is identical in every repo; what it runs is not.
#
# `secrets` runs first, deliberately: it is the only failure here that cannot be
# undone by fixing it afterwards. A failed lint costs another commit; a pushed
# credential is cached and indexed whether or not it is later deleted.
#
# Some of these fail today, and are left wired anyway. The state was measured
# once and written down in T-56 rather than being worked around here — a gate
# quietly narrowed to what already passes is a gate that reports success for
# doing nothing, which is the failure this workspace keeps rediscovering.
.PHONY: pre-push
pre-push: secrets lint typecheck test ## Everything the pre-push hook runs