Makefile

BINARY := firerunner
PKG := ./...
# Run ALL packages, including listener/CLI wiring tests. The aggregate coverage
# gate covers the functional core and host identity resolver; the imperative
# listener/CLI shell is tested but excluded from the aggregate denominator.
COVERPKG := ./internal/config/...,./internal/core/...,./internal/provisioner/...,./internal/scheduler/...,./internal/diag/...,./internal/cacheserver/...,./internal/jobidentity/...,./internal/jitserver/...,./internal/ec2/...,./internal/health/...,./internal/reconcile/...,./internal/schedule/...,./internal/ghrunners/...,./internal/assigned/...
COVERPROFILE := cover.out
COVER_MIN ?= 70
# Per test binary; a hung test fails with a goroutine dump instead of
# stalling the run (go's default is 10m). The full race+coverage run takes
# ~75 s on a 2-core CI runner, the slowest package well under that.
TEST_TIMEOUT ?= 4m

.PHONY: build
build:
	go build -o $(BINARY) ./cmd/firerunner

.PHONY: vet
vet:
	go vet $(PKG)

.PHONY: test
test:
	go test -race -timeout $(TEST_TIMEOUT) $(PKG)

# Unit coverage across all packages (cross-package attribution via -coverpkg).
.PHONY: cover
cover:
	go test -race -timeout $(TEST_TIMEOUT) -covermode=atomic -coverpkg=$(COVERPKG) -coverprofile=$(COVERPROFILE) $(PKG)
	go tool cover -func=$(COVERPROFILE) | tail -n 1

.PHONY: cover-html
cover-html: cover
	go tool cover -html=$(COVERPROFILE)

# Fail if total coverage is below COVER_MIN percent.
.PHONY: cover-check
cover-check: cover
	@total=$$(go tool cover -func=$(COVERPROFILE) | awk '/^total:/ {gsub(/%/,"",$$3); print $$3}'); \
	echo "total coverage: $$total% (min $(COVER_MIN)%)"; \
	awk -v t="$$total" -v m="$(COVER_MIN)" 'BEGIN { exit (t+0 < m+0) }' || \
		{ echo "coverage $$total% is below minimum $(COVER_MIN)%"; exit 1; }

# Everything CI's test, build and shell jobs check that this machine can run,
# with a PASS/FAIL/SKIP summary. CHECK_ARGS=--fast skips the slow race/coverage run.
.PHONY: check
check:
	@scripts/check.sh $(CHECK_ARGS)

# check on the Linux host FR_REMOTE_HOST (an ssh destination), for the steps
# macOS skips. CHECK_ARGS as for check, plus --netns and --clean.
.PHONY: check-remote
check-remote:
	@scripts/check-remote.sh $(CHECK_ARGS)

# One-time setup of a clone: git hooks that sign off every commit (DCO).
.PHONY: setup
setup:
	@scripts/setup-dev.sh

# End-to-end tests require a real KVM host and are gated behind the `e2e` tag.
.PHONY: e2e
e2e:
	./test/e2e/run.sh

# The egress firewall against the real kernel: loads the generated nft ruleset
# into throwaway network namespaces and probes what a guest can reach. Needs
# Linux, root, ip and nft; the test binary is built as the user and run as root.
# SUDO="sudo -n" fails at once where sudo would ask for a password.
SUDO ?= sudo
.PHONY: netns-test
netns-test:
	go test -c -tags netns -o egress-netns.test ./internal/provisioner/
	$(SUDO) env FR_REQUIRE_NETNS="$(FR_REQUIRE_NETNS)" ./egress-netns.test -test.run EgressNetNS -test.count 1 -test.v
	rm -f egress-netns.test

.PHONY: clean
clean:
	rm -f $(BINARY) $(COVERPROFILE) egress-netns.test