AWS_ACCOUNT_ID       ?= 086679231553
AWS_REGION           ?= us-east-1
ECR_REPO             ?= guarddog-scanner
IMAGE_TAG            ?= latest
LOCAL_IMAGE          ?= guarddog-scan:latest

TARGET_REPO          ?= /Users/tmoin/work_dir/wowza
EXCLUDE_PACKAGES     ?= pip,setuptools,wheel
PRIVATE_NPM_SCOPES   ?= theorchard
SCAN_WORKERS         ?= 8
NPM_SCAN_WORKERS     ?= 4

.PHONY: lint fmt build ecr-login scan scan-agentic scan-packages test ci_unit_lint ci_unit_lint_clean clean

lint: ## Check linting and formatting (no changes written)
	docker compose run --rm --entrypoint sh test -c "ruff check . && ruff format . --check"

fmt: ## Auto-fix lint violations and reformat code
	uvx ruff check . --fix && uvx ruff format .

ecr-login: ## Authenticate Docker to ECR
	aws ecr get-login-password --region $(AWS_REGION) | \
		docker login --username AWS --password-stdin $(AWS_ACCOUNT_ID).dkr.ecr.$(AWS_REGION).amazonaws.com

build: ecr-login ## Authenticate to ECR then build the scanner image locally
	docker compose build scan

# --- Scan targets (use LOCAL_IMAGE; override TARGET_REPO as needed) ---

scan: ## Scan TARGET_REPO with all scanners  (e.g. make scan TARGET_REPO=/path/to/repo)
	docker run --platform linux/amd64 --rm \
		-v "$(abspath $(TARGET_REPO)):/target" \
		-e EXCLUDE_PACKAGES=$(EXCLUDE_PACKAGES) \
		-e PRIVATE_NPM_SCOPES=$(PRIVATE_NPM_SCOPES) \
		-e SCAN_WORKERS=$(SCAN_WORKERS) \
		-e NPM_SCAN_WORKERS=$(NPM_SCAN_WORKERS) \
		$(LOCAL_IMAGE) /target

scan-agentic: ## Scan TARGET_REPO for agentic threats only (claude.md, MCP, etc.)
	docker run --platform linux/amd64 --rm \
		-v "$(abspath $(TARGET_REPO)):/target" \
		-e EXCLUDE_PACKAGES=$(EXCLUDE_PACKAGES) \
		-e PRIVATE_NPM_SCOPES=$(PRIVATE_NPM_SCOPES) \
		$(LOCAL_IMAGE) /target --scan-type AgenticScan

scan-packages: ## Scan TARGET_REPO for malicious PyPI/npm packages only
	docker run --platform linux/amd64 --rm \
		-v "$(abspath $(TARGET_REPO)):/target" \
		-e EXCLUDE_PACKAGES=$(EXCLUDE_PACKAGES) \
		-e PRIVATE_NPM_SCOPES=$(PRIVATE_NPM_SCOPES) \
		-e SCAN_WORKERS=$(SCAN_WORKERS) \
		-e NPM_SCAN_WORKERS=$(NPM_SCAN_WORKERS) \
		$(LOCAL_IMAGE) /target --scan-type Packages

# --- Test targets ---

test: ## Run all tests inside Docker
	mkdir -p build
	docker compose run --rm test

ci_unit_lint: ## Lint + run tests in CI; writes JUnit XML and coverage for Jenkins
	mkdir -p build
	docker compose build test
	docker compose run --rm --entrypoint sh test -c "ruff check . && ruff format . --check"
	docker compose run --rm test \
		--junitxml=build/pyunit.xml \
		--cov=guarddog_scanner \
		--cov-report=xml:build/coverage.xml

ci_unit_lint_clean: ## Remove CI build artefacts
	rm -rf build

clean: ## Remove local build artefacts and Docker images
	rm -rf build
	docker compose down --rmi local