Makefile

GO ?= go
PYTHON ?= python3
VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
COMMIT ?= $(shell git rev-parse HEAD 2>/dev/null || echo unknown)
BUILD_DATE ?= $(shell git show -s --format=%cI HEAD 2>/dev/null || echo unknown)
STATICCHECK_BIN := $(abspath bin/tools/staticcheck)
GOVULNCHECK_VERSION ?= v1.7.0
ACTIONLINT_VERSION ?= v1.7.7
CROSS_BUILD_DIR ?= bin/cross
REGRESSION_COUNT ?= 10
REGRESSION_SEED ?=
REGRESSION_OUTPUT ?= bin/routing-regression
LDFLAGS := -s -w -buildid= -X main.version=$(VERSION) -X main.commit=$(COMMIT) -X main.buildDate=$(BUILD_DATE)

.PHONY: build check ci fmt-check workflow-check release-check mod-check dependency-boundary-check upstream-vuln test race fault-test routing-regression browser-profile-check transport-regression-check vet staticcheck vuln config-check container-context-check container-image-check bench-check bench-smoke cross-build

build:
	mkdir -p bin
	CGO_ENABLED=0 $(GO) build -trimpath -buildvcs=false -ldflags "$(LDFLAGS)" -o bin/moto .

fmt-check:
	test -z "$$(gofmt -l .)"

workflow-check:
	$(GO) run github.com/rhysd/actionlint/cmd/actionlint@$(ACTIONLINT_VERSION) .github/workflows/*.yml

release-check:
	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) test/release_sbom_test.py
	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) test/release_workflow_test.py

mod-check:
	$(GO) mod verify
	$(GO) mod tidy -diff
	$(PYTHON) internal/browserhttp2/update_upstream.py --check --zip "$$( $(GO) env GOMODCACHE )/cache/download/golang.org/x/net/@v/v0.60.0.zip"

dependency-boundary-check:
	$(PYTHON) -B scripts/dependency_security.py check --go "$(GO)"
	$(PYTHON) -B test/dependency_security_test.py

upstream-vuln:
	$(PYTHON) -B scripts/dependency_security.py query --go "$(GO)"

test:
	$(GO) test ./...

race:
	$(GO) test -race ./...

fault-test:
	$(GO) test -race ./controller -shuffle=on -count=10 -run 'Test(ConcurrentReload|ReloadRules|RouteHealth|RaceBoostTargets|CachedBoost|FreshBoost|BoostProtocolCanary|DialBulkhead|Prewarm|ActiveHealth|HTTPConnect|HTTP2ConnectPing|HTTP3|.*ProtocolPenalty|SelectTargetsExcluding|.*TLS|.*ProxyProtocol|ServerClose)'

# Pin critical Boost/cache/health/recovery/reload cases with evidence-checked
# run/pass counts. The broader fault suite complements this fixed coverage.
routing-regression:
	$(PYTHON) -B test/routing_regression.py --go "$(GO)" --count "$(REGRESSION_COUNT)" --output "$(REGRESSION_OUTPUT)" $(if $(REGRESSION_SEED),--seed "$(REGRESSION_SEED)")

# Compare actual loopback Moto bytes with a captured, fixed Chrome baseline.
# No browser or upstream credentials; test traffic stays on loopback.
browser-profile-check:
	$(PYTHON) -B test/test_browser_profile_compare.py
	$(PYTHON) -B test/test_browser_profile_regression.py
	$(PYTHON) -B test/browser_profile_regression.py --go "$(GO)" --protocol h2 --scenario all --samples 3

# Keep detailed comparison output local while preserving the regression gate.
transport-regression-check:
	@log="$$(mktemp "$${TMPDIR:-/tmp}/moto-transport-regression.XXXXXX")" || exit 1; \
	trap 'rm -f "$$log"' 0; \
	if $(MAKE) --no-print-directory browser-profile-check >"$$log" 2>&1; then \
		echo "Transport regression checks passed."; \
	else \
		echo "Transport regression checks failed. Reproduce locally with make browser-profile-check." >&2; \
		exit 1; \
	fi

vet:
	$(GO) vet ./...

staticcheck:
	$(GO) -C tools/staticcheck mod verify
	$(GO) -C tools/staticcheck mod tidy -diff
	mkdir -p bin/tools
	$(GO) -C tools/staticcheck build -mod=readonly -trimpath -o "$(STATICCHECK_BIN)" honnef.co/go/tools/cmd/staticcheck
	"$(STATICCHECK_BIN)" ./...

vuln:
	$(GO) run golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION) ./...

config-check:
	$(GO) run . --config config/setting.json --check-config

container-context-check:
	$(PYTHON) -c 'from pathlib import Path; ignored = {line.strip().strip("/") for line in Path(".dockerignore").read_text().splitlines() if line.strip() and not line.lstrip().startswith("#")}; required = {"config/setting.json", "test/native_proxy"}; missing = sorted(required - ignored); assert not missing, f"sensitive Docker context paths are not ignored: {missing}"'
	$(PYTHON) -c 'from pathlib import Path; source = Path("Dockerfile").read_text(); assert "COPY . ." not in source, "Dockerfile must use scoped COPY instructions"'

container-image-check: container-context-check
	docker build --target build -t moto-build:container-check .
	docker run --rm moto-build:container-check sh -ec 'test ! -e /src/config/setting.json; test ! -e /src/test/native_proxy'
	docker build -t moto:container-check .
	test "$$(docker image inspect -f '{{.Config.User}}' moto:container-check)" = "65532:65532"
	docker run --rm moto:container-check --version
	@container_id="$$(docker create moto:container-check)"; \
	trap 'docker rm "$$container_id" >/dev/null 2>&1 || true' EXIT INT TERM; \
	files="$$(docker export "$$container_id" | tar -tf -)"; \
	if printf '%s\n' "$$files" | grep -Eiq '(^|/)(setting\.json|native_proxy)(/|$$)'; then \
		echo "sensitive path found in final image" >&2; \
		exit 1; \
	fi; \
	docker rm "$$container_id" >/dev/null; \
	trap - EXIT INT TERM

bench-check:
	$(PYTHON) -c 'import py_compile, tempfile; cache = tempfile.TemporaryDirectory(); py_compile.compile("test/bench.py", cfile=cache.name + "/bench.pyc", doraise=True); py_compile.compile("test/bulk_relay_bench.py", cfile=cache.name + "/bulk_relay_bench.pyc", doraise=True); py_compile.compile("test/moto-route-watch.py", cfile=cache.name + "/moto-route-watch.pyc", doraise=True)'
	$(PYTHON) -c 'import py_compile, tempfile; cache = tempfile.TemporaryDirectory(); py_compile.compile("test/http_connect_smoke.py", cfile=cache.name + "/http_connect_smoke.pyc", doraise=True); py_compile.compile("test/connect_route_smoke.py", cfile=cache.name + "/connect_route_smoke.pyc", doraise=True)'
	$(PYTHON) -B test/moto_route_watch_test.py
	$(PYTHON) -B test/http_connect_smoke_test.py
	$(PYTHON) -B test/connect_route_smoke_test.py
	$(PYTHON) -B test/routing_regression_test.py
	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) -B test/h2_timing_matrix_test.py
	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) -B test/h2_timing_origin_test.py

bench-smoke:
	$(PYTHON) test/bench.py --self-contained --mode normal -c 4 -t 12 --warmup 4 --timeout 2 --min-success-rate 100 --min-warm-throughput-ratio 0.02 --max-warm-p95-ms 500
	$(PYTHON) test/bench.py --self-contained --mode regex -c 4 -t 12 --warmup 4 --timeout 2 --min-success-rate 100 --min-warm-throughput-ratio 0.02 --max-warm-p95-ms 500
	$(PYTHON) test/bench.py --self-contained --mode boost -c 4 -t 12 --warmup 4 --timeout 2 --min-success-rate 100 --min-warm-throughput-ratio 0.02 --max-warm-p95-ms 500
	$(PYTHON) test/bench.py --self-contained --mode roundrobin -c 4 -t 12 --warmup 4 --timeout 2 --min-success-rate 100 --min-warm-throughput-ratio 0.02 --max-warm-p95-ms 500
	$(PYTHON) test/bulk_relay_bench.py --direction both --concurrency 1 --connections 1 --bytes-per-direction 1MiB --warmup-bytes 64KiB --timeout 30 --min-success-rate 100

cross-build:
	mkdir -p $(CROSS_BUILD_DIR)
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -buildvcs=false -o $(CROSS_BUILD_DIR)/moto-linux-amd64 .
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -buildvcs=false -o $(CROSS_BUILD_DIR)/moto-linux-arm64 .
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -buildvcs=false -o $(CROSS_BUILD_DIR)/moto-darwin-arm64 .
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -buildvcs=false -o $(CROSS_BUILD_DIR)/moto-windows-amd64.exe .

check: fmt-check workflow-check release-check dependency-boundary-check mod-check test race fault-test routing-regression transport-regression-check vet staticcheck vuln upstream-vuln config-check container-context-check bench-check bench-smoke

ci: check cross-build