Makefile

# agentcookie Makefile
#
# Targets:
#   make            - build and sign bin/agentcookie (default; not notarized)
#   make build      - go build ./cmd/agentcookie -> bin/agentcookie
#   make install    - go install ./cmd/agentcookie, then sign $(GOBIN)/agentcookie
#   make sign       - sign bin/agentcookie with the Developer ID identity
#   make notarize   - submit bin/agentcookie to Apple's notary service
#                     (5-30 min; required before deploying to a Mac other
#                     than the one this build ran on)
#   make release    - build + sign + notarize in one shot (a fully-portable
#                     binary that launches on any Mac without prompts)
#   make verify     - print the designated requirement of bin/agentcookie
#   make test       - go test -race ./...
#   make vet        - go vet ./...
#   make clean      - remove bin/
#
# Build alone does not require an Apple Developer ID. Signing is split into
# `make sign` so contributors can `make build` and `make test` without a
# cert. CI release builds run `make` (build + sign) on a signing-enabled
# macOS runner.
#
# Override the signing identity by exporting AGENTCOOKIE_SIGN_IDENTITY. See
# docs/runbook-v0.12-codesign.md for how to install / renew the cert.

SHELL := /bin/bash
BIN_DIR := bin
BINARY := $(BIN_DIR)/agentcookie
PKG := ./cmd/agentcookie

# Inject the version at link time so `make build` / `make install` -- and the
# CI release build, which runs `make` (see the comment above) -- report the
# real tag instead of the "0.0.1-dev" default baked into internal/cli.Version.
# Mirrors the -X ldflag in .goreleaser.yaml. `git describe` yields e.g. 0.17.1
# on a tagged build or 0.17.1-2-gfe6f405 between tags; the leading v is stripped
# to match goreleaser's {{ .Version }}. Falls back to the in-source default when
# git is unavailable (e.g. building from a release tarball).
VERSION := $(shell git describe --tags --always --dirty 2>/dev/null | sed 's/^v//')
ifneq ($(VERSION),)
LDFLAGS := -X github.com/mvanhorn/agentcookie/internal/cli.Version=$(VERSION)
endif

GOBIN := $(shell go env GOBIN)
ifeq ($(GOBIN),)
GOBIN := $(shell go env GOPATH)/bin
endif

.PHONY: all build install sign notarize release verify test vet clean

all: build sign

release: build sign notarize

build:
	@mkdir -p $(BIN_DIR)
	go build -ldflags "$(LDFLAGS)" -o $(BINARY) $(PKG)

# Install to $(GOBIN)/agentcookie and sign in place so steady-state
# `make install` produces a signed binary with the same designated
# requirement as the local build.
install:
	go install -ldflags "$(LDFLAGS)" $(PKG)
	scripts/sign.sh "$(GOBIN)/agentcookie"

# Local-developer install: same version-stamped install, signed with a locally
# available identity instead of the release Developer ID (not present on most
# machines). Requires AGENTCOOKIE_SIGN_IDENTITY (canonical variable, e.g. an
# "Apple Development: ..." cert). Backs up the current binary first so a bad
# build never strands consumers that preflight this path.
install-dev:
	@if [[ -z "$$AGENTCOOKIE_SIGN_IDENTITY" ]]; then \
	  echo "make install-dev: set AGENTCOOKIE_SIGN_IDENTITY to a locally available signing identity" >&2; \
	  exit 1; \
	fi
	@if [[ -f "$(GOBIN)/agentcookie" ]]; then cp "$(GOBIN)/agentcookie" "$(GOBIN)/agentcookie.bak"; fi
	go install -ldflags "$(LDFLAGS)" $(PKG)
	codesign --force --sign "$$AGENTCOOKIE_SIGN_IDENTITY" "$(GOBIN)/agentcookie"
	codesign -v "$(GOBIN)/agentcookie"

sign:
	@if [[ ! -f $(BINARY) ]]; then \
	  echo "make sign: $(BINARY) does not exist; run \`make build\` first" >&2; \
	  exit 1; \
	fi
	scripts/sign.sh $(BINARY)

notarize:
	@if [[ ! -f $(BINARY) ]]; then \
	  echo "make notarize: $(BINARY) does not exist; run \`make build && make sign\` first" >&2; \
	  exit 1; \
	fi
	scripts/notarize.sh $(BINARY)

verify:
	@if [[ ! -f $(BINARY) ]]; then \
	  echo "make verify: $(BINARY) does not exist; run \`make build\` first" >&2; \
	  exit 1; \
	fi
	codesign -d -r- $(BINARY)

test:
	go test -race ./...

vet:
	go vet ./...

clean:
	rm -rf $(BIN_DIR)