Makefile

BINARY := profiledeck-cli
BIN_DIR := bin
TOOLS_DIR := $(BIN_DIR)/tools
CMD := ./cmd/profiledeck-cli
DESKTOP_FRONTEND := desktop/frontend
DESKTOP_BINARY := $(BIN_DIR)/profiledeck
DESKTOP_DEVELOPMENT_IDENTIFIER := io.github.strahe.profiledeck.dev
RELEASE_TOOL_PKGS := ./scripts/releasetool ./scripts/updatee2e/runner
UPDATE_E2E_PKG := ./scripts/updatee2e/client
DOCS_DIR := docs
CORE_PKGS := ./cmd/... ./internal/...
DESKTOP_PKGS := ./desktop/...
GO_PKGS := $(CORE_PKGS) $(DESKTOP_PKGS)
GOLANGCI_LINT ?= golangci-lint
WAILS3 ?= wails3
GOLANGCI_LINT_VERSION := v2.13.2
WAILS3_VERSION := v3.0.0-beta.16
GOVULNCHECK_VERSION := v1.7.0
ACTIONLINT_VERSION := v1.7.12
CI_GOLANGCI_LINT_DIR := $(TOOLS_DIR)/golangci-lint/$(GOLANGCI_LINT_VERSION)
CI_GOLANGCI_LINT := $(CI_GOLANGCI_LINT_DIR)/golangci-lint
CI_WAILS3_DIR := $(TOOLS_DIR)/wails3/$(WAILS3_VERSION)
CI_WAILS3 := $(CI_WAILS3_DIR)/wails3
GOVULNCHECK_DIR := $(TOOLS_DIR)/govulncheck/$(GOVULNCHECK_VERSION)
GOVULNCHECK := $(GOVULNCHECK_DIR)/govulncheck
ACTIONLINT_DIR := $(TOOLS_DIR)/actionlint/$(ACTIONLINT_VERSION)
ACTIONLINT := $(ACTIONLINT_DIR)/actionlint
DESKTOP_GOOS ?= $(or $(GOOS),$(shell go env GOOS))
DESKTOP_GOARCH ?= $(or $(GOARCH),$(shell go env GOARCH))
DESKTOP_GO_ENV := GOOS=$(DESKTOP_GOOS) GOARCH=$(DESKTOP_GOARCH)
ifeq ($(DESKTOP_GOOS),darwin)
DESKTOP_GO_ENV += MACOSX_DEPLOYMENT_TARGET=14.0 CGO_CFLAGS="-O2 -g -mmacosx-version-min=14.0" CGO_CXXFLAGS="-O2 -g -mmacosx-version-min=14.0" CGO_LDFLAGS="-O2 -g -mmacosx-version-min=14.0"
endif
DESKTOP_SIGN ?= true
VERSION ?=
BUILD_NUMBER ?=
RELEASE_COMMIT ?= $(shell git rev-parse HEAD)
BUILT_AT ?=
# Set a full SHA-1 fingerprint to skip the interactive choice when multiple identities are installed.
SIGN_IDENTITY ?=
RELEASE_KEYCHAIN ?=
UPDATE_SIGNING_KEY ?=
UPDATE_PUBLIC_KEY ?= desktop/update/updater-public.pem
RELEASES_DIR ?= $(CURDIR)/.task/release-assets

.PHONY: fmt vet lint lint-core lint-desktop test build pricing-check source-hygiene core-boundary core-check security-check check clean desktop-bindings desktop-bindings-check desktop-taskfile-check desktop-frontend-install desktop-frontend-check desktop-build release-tools-check release-build release-build-macos release-build-linux-amd64 release-finalize release-linux-smoke verify-update-e2e desktop-check docs-install docs-dev docs-build docs-preview docs-check ci-check ci-core-check ci-desktop-check ci-security-check ci-release-build-macos ci-release-build-linux-amd64 ci-release-finalize ci-verify-update-e2e

fmt:
	$(GOLANGCI_LINT) fmt $(GO_PKGS)
	$(GOLANGCI_LINT) fmt ./scripts/...

vet: lint-core

lint: lint-core lint-desktop

lint-core:
	$(GOLANGCI_LINT) run $(CORE_PKGS)

lint-desktop:
	$(DESKTOP_GO_ENV) $(GOLANGCI_LINT) run $(DESKTOP_PKGS) $(RELEASE_TOOL_PKGS)
	$(DESKTOP_GO_ENV) $(GOLANGCI_LINT) run --build-tags updatee2e $(UPDATE_E2E_PKG)

test:
	go test $(CORE_PKGS)

pricing-check:
	go test ./internal/pricing

build:
	mkdir -p $(BIN_DIR)
	go build -o $(BIN_DIR)/$(BINARY) $(CMD)

source-hygiene:
	scripts/check-source-hygiene.sh

core-boundary:
	go test ./internal/architecture

core-check: source-hygiene pricing-check lint-core core-boundary test build

security-check: $(GOVULNCHECK) $(ACTIONLINT)
	$(GOVULNCHECK) ./...
	$(ACTIONLINT) -no-color -shellcheck= -pyflakes=
	npm --prefix $(DESKTOP_FRONTEND) audit --audit-level=high
	npm --prefix $(DOCS_DIR) audit --audit-level=high

check: core-check desktop-check docs-check security-check

desktop-bindings:
	$(WAILS3) task common:bindings

desktop-bindings-check:
	@temp_dir=$$(mktemp -d); \
	trap 'rm -rf "$$temp_dir"' EXIT; \
	$(WAILS3) generate bindings -d "$$temp_dir" -ts -i $(DESKTOP_PKGS); \
	diff -ru $(DESKTOP_FRONTEND)/bindings "$$temp_dir"

desktop-taskfile-check:
	$(WAILS3) task --list >/dev/null
	$(WAILS3) task dev -dry >/dev/null
	$(WAILS3) task common:generate:icons -dry >/dev/null
	$(WAILS3) task build GOOS=darwin -dry >/dev/null
	$(WAILS3) task build GOOS=darwin DEV=true EXTRA_TAGS=taskfilecheck -dry >/dev/null
	$(WAILS3) task build GOOS=windows DEV=true EXTRA_TAGS=taskfilecheck -dry >/dev/null
	$(WAILS3) task build GOOS=linux DEV=true EXTRA_TAGS=taskfilecheck -dry >/dev/null
	$(WAILS3) task linux:build ARCH=amd64 OUTPUT=.task/taskfile-check/profiledeck VERSION=0.1.0-beta.1 COMMIT=0123456789abcdef0123456789abcdef01234567 BUILD_DATE=2026-07-16T00:00:00Z UPDATE_MANAGEMENT=application -dry >/dev/null
	$(WAILS3) task linux:build:release VERSION=0.1.0-beta.1 COMMIT=0123456789abcdef0123456789abcdef01234567 BUILD_DATE=2026-07-16T00:00:00Z PORTABLE_OUTPUT=.task/taskfile-check/portable PACKAGE_OUTPUT=.task/taskfile-check/package -dry >/dev/null
	$(WAILS3) task linux:release VERSION=0.1.0-beta.1 RELEASE_COMMIT=0123456789abcdef0123456789abcdef01234567 BUILT_AT=2026-07-16T00:00:00Z OUTPUT_DIR=.task/taskfile-check/releases -dry >/dev/null
	$(WAILS3) task darwin:build:universal VERSION=0.1.0-beta.1 COMMIT=0123456789abcdef0123456789abcdef01234567 BUILD_DATE=2026-07-16T00:00:00Z -dry >/dev/null
	! $(WAILS3) task darwin:package:universal VERSION=0.1.0-beta.1 BUILD_NUMBER=1 COMMIT=0123456789abcdef0123456789abcdef01234567 BUILD_DATE=2026-07-16T00:00:00Z -dry >/dev/null 2>&1
	$(WAILS3) task darwin:package:universal APP_PATH=.task/taskfile-check/ProfileDeck.app VERSION=0.1.0-beta.1 BUNDLE_VERSION=0.1.0 BUILD_NUMBER=1 COMMIT=0123456789abcdef0123456789abcdef01234567 BUILD_DATE=2026-07-16T00:00:00Z -dry >/dev/null
	@output="$$(PROFILEDECK_RELEASE_SIGN_IDENTITY=profiledeck-signing-identity-privacy-probe $(WAILS3) task darwin:release VERSION=0.1.0-beta.1 BUILD_NUMBER=1 RELEASE_COMMIT=0123456789abcdef0123456789abcdef01234567 BUILT_AT=2026-07-16T00:00:00Z OUTPUT_DIR=.task/taskfile-check/releases -dry 2>&1 || true)"; \
	case "$$output" in *profiledeck-signing-identity-privacy-probe*) echo "release task output exposed the signing identity"; exit 1;; esac
	@output="$$(PROFILEDECK_RELEASE_SIGN_IDENTITY= $(MAKE) -n release-build-macos VERSION=0.1.0-beta.1 BUILD_NUMBER=1 RELEASE_COMMIT=0123456789abcdef0123456789abcdef01234567 SIGN_IDENTITY=profiledeck-signing-identity-privacy-probe 2>&1)"; \
	case "$$output" in *profiledeck-signing-identity-privacy-probe*) echo "release Make output exposed the signing identity"; exit 1;; esac

desktop-frontend-install:
	$(WAILS3) task common:frontend:install

desktop-frontend-check: desktop-frontend-install
	npm --prefix $(DESKTOP_FRONTEND) run check
	npm --prefix $(DESKTOP_FRONTEND) run test:unit

desktop-build:
	$(WAILS3) task build GOOS=$(DESKTOP_GOOS) ARCH=$(DESKTOP_GOARCH)
ifeq ($(DESKTOP_GOOS),darwin)
	@if [ "$(DESKTOP_SIGN)" = "true" ]; then \
		set -e; \
		sign_identity="$$(scripts/release/resolve-signing-identity.sh --interactive --output fingerprint --requested "$(SIGN_IDENTITY)")"; \
		codesign --force --sign "$$sign_identity" --identifier "$(DESKTOP_DEVELOPMENT_IDENTIFIER)" --options runtime --timestamp=none "$(DESKTOP_BINARY)"; \
		codesign --verify --strict --verbose=2 "$(DESKTOP_BINARY)"; \
	fi
endif

release-build: release-build-macos

release-build-macos: export PROFILEDECK_RELEASE_SIGN_IDENTITY := $(or $(PROFILEDECK_RELEASE_SIGN_IDENTITY),$(SIGN_IDENTITY))
release-build-macos:
	@if [ -z "$(VERSION)" ] || [ -z "$(BUILD_NUMBER)" ] || [ -z "$(BUILT_AT)" ]; then echo "VERSION, BUILD_NUMBER, and BUILT_AT are required"; exit 1; fi
	$(WAILS3) task darwin:release VERSION="$(VERSION)" BUILD_NUMBER="$(BUILD_NUMBER)" RELEASE_COMMIT="$(RELEASE_COMMIT)" BUILT_AT="$(BUILT_AT)" RELEASE_KEYCHAIN="$(RELEASE_KEYCHAIN)" OUTPUT_DIR="$(RELEASES_DIR)"

release-build-linux-amd64:
	@if [ -z "$(VERSION)" ] || [ -z "$(BUILT_AT)" ]; then echo "VERSION and BUILT_AT are required"; exit 1; fi
	$(WAILS3) task linux:release VERSION="$(VERSION)" RELEASE_COMMIT="$(RELEASE_COMMIT)" BUILT_AT="$(BUILT_AT)" OUTPUT_DIR="$(RELEASES_DIR)"

release-finalize:
	@if [ -z "$(VERSION)" ] || [ -z "$(UPDATE_SIGNING_KEY)" ]; then echo "VERSION and UPDATE_SIGNING_KEY are required"; exit 1; fi
	@channel="$$(go run ./scripts/releasetool contract --version "$(VERSION)" --field channel)"; \
		manifest="$$(go run ./scripts/releasetool contract --version "$(VERSION)" --field asset.manifest)"; \
		$(WAILS3) updater manifest -version "$(VERSION)" -channel "$$channel" \
			-key "$(UPDATE_SIGNING_KEY)" -output "$(RELEASES_DIR)/$$manifest" \
			"$(RELEASES_DIR)/$$(go run ./scripts/releasetool contract --version "$(VERSION)" --field asset.macos-updater)" \
			"$(RELEASES_DIR)/$$(go run ./scripts/releasetool contract --version "$(VERSION)" --field asset.linux-updater)"
	@manifest="$$(go run ./scripts/releasetool contract --version "$(VERSION)" --field asset.manifest)"; \
		$(WAILS3) updater verify -manifest "$(RELEASES_DIR)/$$manifest" -publickey "$(UPDATE_PUBLIC_KEY)" -dir "$(RELEASES_DIR)"
	go run ./scripts/releasetool finalize --version "$(VERSION)" --directory "$(RELEASES_DIR)"

release-linux-smoke:
	scripts/release/verify-linux-containers.sh \
		--version "$(VERSION)" \
		--deb "$(RELEASES_DIR)/$$(go run ./scripts/releasetool contract --version "$(VERSION)" --field asset.linux-deb)" \
		--rpm "$(RELEASES_DIR)/$$(go run ./scripts/releasetool contract --version "$(VERSION)" --field asset.linux-rpm)"

verify-update-e2e:
	PROFILEDECK_WAILS3="$(WAILS3)" go run ./scripts/updatee2e/runner

release-tools-check:
	@set -e; for script in scripts/release/*.sh; do bash -n "$$script"; done
	go test $(RELEASE_TOOL_PKGS)
	go test -tags updatee2e $(UPDATE_E2E_PKG)

desktop-check: DESKTOP_SIGN = false
desktop-check: core-boundary lint-desktop release-tools-check desktop-bindings-check desktop-taskfile-check desktop-frontend-check desktop-build
	$(DESKTOP_GO_ENV) go test $(DESKTOP_PKGS)

docs-install:
	npm --prefix $(DOCS_DIR) ci

docs-dev: docs-install
	npm --prefix $(DOCS_DIR) run dev

docs-build: docs-install
	npm --prefix $(DOCS_DIR) run build

docs-preview: docs-build
	npm --prefix $(DOCS_DIR) run preview

docs-check: docs-build

$(CI_GOLANGCI_LINT):
	mkdir -p $(CI_GOLANGCI_LINT_DIR)
	curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(CI_GOLANGCI_LINT_DIR) $(GOLANGCI_LINT_VERSION)

$(CI_WAILS3):
	mkdir -p $(CI_WAILS3_DIR)
	GOBIN=$(abspath $(CI_WAILS3_DIR)) go install github.com/wailsapp/wails/v3/cmd/wails3@$(WAILS3_VERSION)

$(GOVULNCHECK):
	mkdir -p $(GOVULNCHECK_DIR)
	GOBIN=$(abspath $(GOVULNCHECK_DIR)) go install golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)

$(ACTIONLINT):
	mkdir -p $(ACTIONLINT_DIR)
	GOBIN=$(abspath $(ACTIONLINT_DIR)) go install github.com/rhysd/actionlint/cmd/actionlint@$(ACTIONLINT_VERSION)

ci-check: $(CI_GOLANGCI_LINT) $(CI_WAILS3)
	$(MAKE) check GOLANGCI_LINT=$(abspath $(CI_GOLANGCI_LINT)) WAILS3=$(abspath $(CI_WAILS3))

ci-core-check: $(CI_GOLANGCI_LINT)
	$(MAKE) core-check GOLANGCI_LINT=$(abspath $(CI_GOLANGCI_LINT))

ci-desktop-check: $(CI_GOLANGCI_LINT) $(CI_WAILS3)
	$(MAKE) desktop-check GOLANGCI_LINT=$(abspath $(CI_GOLANGCI_LINT)) WAILS3=$(abspath $(CI_WAILS3))

ci-security-check:
	$(MAKE) security-check

ci-release-build-macos: export PROFILEDECK_RELEASE_SIGN_IDENTITY := $(or $(PROFILEDECK_RELEASE_SIGN_IDENTITY),$(SIGN_IDENTITY))
ci-release-build-macos: $(CI_WAILS3)
	$(MAKE) release-build-macos VERSION="$(VERSION)" BUILD_NUMBER="$(BUILD_NUMBER)" RELEASE_COMMIT="$(RELEASE_COMMIT)" BUILT_AT="$(BUILT_AT)" RELEASE_KEYCHAIN="$(RELEASE_KEYCHAIN)" RELEASES_DIR="$(RELEASES_DIR)" WAILS3=$(abspath $(CI_WAILS3))

ci-release-build-linux-amd64: $(CI_WAILS3)
	$(MAKE) release-build-linux-amd64 VERSION="$(VERSION)" RELEASE_COMMIT="$(RELEASE_COMMIT)" BUILT_AT="$(BUILT_AT)" RELEASES_DIR="$(RELEASES_DIR)" WAILS3=$(abspath $(CI_WAILS3))

ci-release-finalize: $(CI_WAILS3)
	$(MAKE) release-finalize VERSION="$(VERSION)" UPDATE_SIGNING_KEY="$(UPDATE_SIGNING_KEY)" RELEASES_DIR="$(RELEASES_DIR)" WAILS3=$(abspath $(CI_WAILS3))

ci-verify-update-e2e: $(CI_WAILS3)
	$(MAKE) verify-update-e2e WAILS3=$(abspath $(CI_WAILS3))

clean:
	@if [ -d "$(BIN_DIR)" ]; then \
		find "$(BIN_DIR)" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +; \
	fi