include .make_scripts/release-management/release-management-makefile
# This includes make: tag-major, tag-major-beta, tag-minor, tag-minor-beta, tag-patch, tag-patch-beta, tag-latest-beta, tag-major-minor-ruleset, hard-reset-tags, check-for-release and sync-release-assets.
include .make_scripts/mkdocs-documentation/mkdocs-documentation-makefile.mk
include ./.make_scripts/project-infrastructure/project-infrastructure-makefile

# Ruff discovers its own files from `include` in pyproject.toml
# (examples, neops, neops_worker_sdk, tests). Passing explicit paths here
# silently overrode that and left ./neops unlinted; keep these bare so the
# config stays the single source of truth.
lint:
	uv run ruff format --check
	uv run ruff check

lint-fix:
	uv run ruff format
	uv run ruff check --fix

format:
	uv run ruff format

typeCheck:
	uv run pyrefly check ./neops_worker_sdk ./examples ./tests ./neops

typeCheck-baseline:
	uv run pyrefly check ./neops_worker_sdk ./examples ./tests ./neops --baseline pyrefly-baseline.json

audit:
	# Scope to the runtime dependency closure. pip-audit pulls `pip-api`
	# -> `pip`, and the latest pip carries CVE-2026-3219 with no fixed
	# version available — but pip is not a runtime dep, so scanning the
	# audit toolchain itself produces noise without security signal.
	# Exporting `--no-dev` requirements first scopes the scan to what
	# actually ships. `--group fb` is included because the image installs
	# it (the function-block-only deps live in a group to keep them out of
	# the published PyPI metadata); this keeps the exported closure equal
	# to the shipped one. pip-audit still skips the scrapli-cfg URL
	# requirement itself. Use `make audit-dev` to scan the dev environment.
	uv export --no-dev --group fb --no-hashes -o /tmp/neops-worker-sdk-prod-reqs.txt
	uv run pip-audit --disable-pip --no-deps --skip-editable \
		-r /tmp/neops-worker-sdk-prod-reqs.txt

audit-dev:
	# Full-environment scan including dev tooling. Carries the pip CVE
	# above; document any new ignore here with a justification.
	uv run pip-audit --strict --ignore-vuln CVE-2026-3219

test:
	uv run pytest -q

test-examples:
	uv run pytest -q -m "examples and not remote_lab"

test-function-blocks:
	uv run pytest -q -m "function_block or remote_lab"

test-all:
	uv run pytest -q -m ""

# Docker build helpers. No build secrets or tokens — this repo is pure Python.
#
#   make build-docker                    # the runtime image, exactly as CI builds it
#   make build-docker IMAGE_NAME=foo     # tag it foo:latest instead
#   make build-docker-ci                 # the in-image lint + test stage (see caveat below)
#
# build-docker mirrors CI: default target, context `.`, no build args
# (.github/workflows/ci.yml) — this is what ships as quay.io/zebbra/neops-worker-sdk.
IMAGE_NAME ?= neops-worker-sdk

build-docker:
	docker build -t $(IMAGE_NAME):latest .


build-docker-ci:
	docker build --target run-ci -t $(IMAGE_NAME):ci .

# -----------------------------------------------------------------------------
# Local lab
# -----------------------------------------------------------------------------
# The turn-key containerlab environment (CMS + engine + web client + worker +
# 15 FRR/SR Linux devices) now lives in its OWN repo: zebbra/neops-lab. The
# `local-env-*` / `local-lab-*` targets, the compose files and the device
# definitions moved there wholesale — run them from a sibling checkout.
#
#   git clone git@github.com:zebbra/neops-lab.git ../neops-lab
#   make -C ../neops-lab local-env-init local-lab-up local-lab-discover
#
# `local-env-init` is required first: local-lab-up aborts with "run
# 'make local-env-init' first" if cms_api_key.env is missing. The lab also needs
# a Linux host with sudo-less containerlab — see ../neops-lab/README.md.
#
# The lab defaults to the PUBLISHED worker image, which is built from
# origin/develop and carries NO base function blocks (no `COPY ./neops`, and
# neops/fb is empty there) — so discovery cannot run on it. Building here and
# pointing the lab at the local tag is MANDATORY from this branch:
#
#   make build-docker
#   export NEOPS_WORKER_SDK_IMAGE=neops-worker-sdk:latest
#   make -C ../neops-lab local-env-init local-lab-up local-lab-discover
#
# ⚠️ The lab pins fb.base.neops.io/global_discover_network:0.1.0 by exact
# version (its Makefile + workflows/simple-lab-discovery.workflow.yaml).
# Renaming or version-bumping that block in neops/fb/base/global/ breaks the lab
# at runtime with nothing failing at build time. See AGENTS.md § Local Lab.
