Makefile

BUILD_DIR := build
BIN_DIR := $(CURDIR)/$(BUILD_DIR)/bin
LINT_CONFIG := $(CURDIR)/.golangci.yml

# All Go modules of the workspace: every go.mod but the tool modules under
# tools/, which are not part of go.work.
# Note: the leading "./" is required for find -execdir / cd targets.
MODULES := $(shell find . -name go.mod -not -path '*/vendor/*' -not -path '*/node_modules/*' -not -path '*/build/*' -not -path './tools/*' | sort | sed 's|/go.mod||')

# Development tools: one module per tool under tools/<name>, outside the
# workspace so that their dependencies never reach a library go.mod, each
# pinned and checksum-verified by its own go.mod and go.sum.
TOOLS := golangci-lint govulncheck goveralls mockery

.PHONY: all
all: test

.PHONY: clean
clean: clean-mocks
	@rm -rf $(BUILD_DIR)
	@for mod in $(MODULES); do (cd "$$mod" && go clean -i ./...); done

_build:
	@mkdir -p $(BUILD_DIR)

.PHONY: tools
tools: $(addprefix $(BIN_DIR)/,$(TOOLS))

$(BIN_DIR)/%: tools/%/go.mod tools/%/go.sum
	@echo "==> install $*"
	@GOWORK=off GOBIN=$(BIN_DIR) go install -C tools/$* tool
	@touch $@

.PHONY: sync
sync:
	@echo "Syncing workspace..."
	@go work sync

.PHONY: build
build:
	@for mod in $(MODULES); do \
		echo "==> build $$mod"; \
		(cd "$$mod" && go build -v ./...) || exit 1; \
	done

# Mocks (.mockery.yaml): in-package mock_<interface>_test.go files, so they
# only exist in test binaries; never committed. The targets that compile
# tests generate them first; stale generated files are removed beforehand.
.PHONY: generate
generate: $(BIN_DIR)/mockery clean-mocks
	@echo "Generating mocks..."
	@$(BIN_DIR)/mockery --log-level=warn

.PHONY: clean-mocks
clean-mocks:
	@find . -name 'mock_*_test.go' -not -path './build/*' -type f \
		-exec grep -q '^// Code generated by mockery' {} \; -delete

.PHONY: test
test: _build generate
	@: > $(BUILD_DIR)/coverage.out
	@for mod in $(MODULES); do \
		echo "==> test $$mod"; \
		mod_safe=$$(echo "$$mod" | sed 's|/|_|g; s|^\._||; s|^\.$$|root|'); \
		(cd "$$mod" && go test -cover -race \
			-coverprofile="$(CURDIR)/$(BUILD_DIR)/$$mod_safe.cover" \
			-timeout 300s ./...) || exit 1; \
	done
	@# Aggregate coverage excludes generated mocks, protobuf, and the
	@# example programs: their main() binds a socket and blocks, so it is
	@# not unit-testable and would skew the library coverage figure. The
	@# examples are still built, tested, and linted above.
	@grep -h -v '^mode:' $(BUILD_DIR)/*.cover 2>/dev/null \
		| grep -v 'mock_' | grep -v '.pb.go' | grep -v '/example' \
		> $(BUILD_DIR)/coverage.body || true
	@echo 'mode: atomic' > $(BUILD_DIR)/coverage.out
	@cat $(BUILD_DIR)/coverage.body >> $(BUILD_DIR)/coverage.out
	@rm -f $(BUILD_DIR)/*.cover $(BUILD_DIR)/coverage.body

# The store suites on real PostgreSQL, MySQL, MariaDB and Redis servers,
# which `make test` runs on SQLite and miniredis only. The header of
# scripts/test-backends.sh lists the variables naming the servers and
# starts them locally; CI runs it in the "Store suites (real backends)"
# job, against service containers.
.PHONY: test-backends
test-backends: generate
	@./scripts/test-backends.sh

# Sends build/coverage.out to Coveralls with goveralls (tools/goveralls). CI
# passes the workflow token as COVERALLS_TOKEN (goveralls' GitHub Actions
# setup).
.PHONY: coveralls
coveralls: $(BIN_DIR)/goveralls
	@$(BIN_DIR)/goveralls -coverprofile=$(BUILD_DIR)/coverage.out -service=github

.PHONY: coverage
coverage: $(BUILD_DIR)/coverage.out
	@go tool cover -func ./$(BUILD_DIR)/coverage.out

.PHONY: coverage-html
coverage-html: $(BUILD_DIR)/coverage.out
	@go tool cover -html ./$(BUILD_DIR)/coverage.out

.PHONY: bench
bench: generate
	@for mod in $(MODULES); do \
		echo "==> bench $$mod"; \
		(cd "$$mod" && go test -bench=. -benchmem -benchtime=5s -timeout 300s ./...) || exit 1; \
	done

.PHONY: lint
lint: generate $(BIN_DIR)/golangci-lint
	@go list -f '{{.Dir}}/...' -m | xargs $(BIN_DIR)/golangci-lint run --timeout=300s --config="$(LINT_CONFIG)"

# govulncheck on every module, outside the workspace (each module's own
# requirements: what a consumer resolves), tests included.
.PHONY: vuln
vuln: generate $(BIN_DIR)/govulncheck
	@for mod in $(MODULES); do \
		echo "==> govulncheck $$mod"; \
		(cd "$$mod" && GOWORK=off $(BIN_DIR)/govulncheck -test ./...) || exit 1; \
	done

# Every module on its own (scripts/check-modules.sh): one go line, go.work
# lists every module, `go work sync` is a no-op, and every module builds,
# vets and is tidy with GOWORK=off, with and without the generated mocks.
# CI runs it on every change.
.PHONY: check-modules
check-modules: $(BIN_DIR)/mockery
	@./scripts/check-modules.sh

# Checks a release tag before it is pushed (docs/releasing.md):
#   make release-check TAG=oauth2/v1.0.0
.PHONY: release-check
release-check: generate
	@./scripts/release-check.sh "$(TAG)"

# Opt-in browser suites (Tales and Chrome, prerequisites in docs/saml-sp.md
# and e2e/oidc/run.sh): never part of `make test` nor of CI.
.PHONY: e2e
e2e: e2e-saml e2e-oidc

.PHONY: e2e-saml
e2e-saml:
	@./e2e/saml/run.sh

.PHONY: e2e-oidc
e2e-oidc:
	@./e2e/oidc/run.sh

# The OpenID Foundation conformance suite against oidc/provider (OP plans) and
# oidc/client (RP plans), locally: opt-in, never in CI, not a certification
# (prerequisites in internal/interop/oidcstack/conformance/run.sh).
.PHONY: conformance
conformance:
	@./internal/interop/oidcstack/conformance/run.sh

# A sign-in with a real provider account (LIVE_OIDC_* variables, a person
# at the keyboard): see e2e/oidc-live/run.sh.
.PHONY: e2e-oidc-live
e2e-oidc-live:
	@./e2e/oidc-live/run.sh

.PHONY: tidy
tidy: generate
	@go work sync
	@for mod in $(MODULES); do \
		echo "==> tidy $$mod"; \
		(cd "$$mod" && GOWORK=off go mod tidy) || exit 1; \
	done
	@for tool in $(TOOLS); do \
		echo "==> tidy tools/$$tool"; \
		(cd "tools/$$tool" && GOWORK=off go mod tidy) || exit 1; \
	done
	@go work sync