# pdac-knowledge-agent — developer entry points. The security targets are this repo's copy
# of the shared surface ADR-0014 standardizes across the fleet.
.PHONY: help security-scan security-baseline install-hooks test smoke smoke-report

help:
	@echo "make install-hooks      Install the pre-push hook (security gate + GitHub mirror sync on prod deploys)."
	@echo "make security-scan      Run the security scan (pip-audit, bandit, gitleaks; trivy N/A)."
	@echo "make security-baseline  Regenerate the accepted-findings bandit baseline."
	@echo "make test               Run the test suite."
	@echo "make smoke              One smoke run against the LIVE sources (no model call), appended to .smoke/."
	@echo "make smoke-report       The reliability week from .smoke/results.jsonl (>= 95%, no unstructured failure)."

# One scan definition; the pre-push hook and a manual run both call it, so the check
# cannot drift between entry points.
security-scan:
	@bash scripts/security_scan.sh

# Only after intentionally accepting a new finding. Review the diff before committing —
# a new entry is a new accepted suppression and must be justified in
# security/ACCEPTED-FINDINGS.md. Targets match the scan: src/ + root-level modules.
security-baseline:
	@if command -v bandit >/dev/null 2>&1; then B="bandit"; else B="uvx bandit"; fi; \
	$$B -r src $$(git ls-files '*.py' | grep -v /) -ll -c bandit.yaml \
	  -f json -o security/bandit-baseline.json -q; \
	echo "Wrote security/bandit-baseline.json — review the diff and document any new suppression."

# Git never commits .git/hooks, so this installs one (idempotent).
# `--git-path hooks` resolves correctly from a linked worktree, where .git is a file.
# It installs a SHIM, not a copy: scripts/hooks/pre-push-shim runs the tracked hook as it is
# on `dev`, so an edited gate never needs re-installing (a stale copy silently disabled a gate
# in pdac-analysis-orchestrator for six days). Run once per clone.
install-hooks:
	@hooks_dir="$$(git rev-parse --git-path hooks)"; mkdir -p "$$hooks_dir"; \
	cp scripts/hooks/pre-push-shim "$$hooks_dir/pre-push"; chmod +x "$$hooks_dir/pre-push"; \
	echo "Installed $$hooks_dir/pre-push — every push now runs dev's security gate on the pushed commit."

test:
	@python -m pytest tests/ -q

# Phase 3 (docs/plans/PLAN-phase3-review-hardening.md). The only live-network targets besides
# scripts/record_fixtures.py; where and how often they run on a schedule is the plan's D1/D2.
smoke:
	@python scripts/smoke_live.py

smoke-report:
	@python scripts/smoke_live.py --report .smoke/results.jsonl --days 7