Makefile

# Darkly — pure-Docker orchestration. The host needs only Docker + make.
# Every target runs inside the `darkly-ci` image (Node + Playwright browsers).
# Build/lint/test/bench run with NO network (--network none) — proving the
# report and its checks need zero external access. Only deps/audit get network.

IMAGE   := darkly-ci
STAMP   := .docker-image-built
DEPS    := node_modules/.installed
UID     := $(shell id -u):$(shell id -g)
MOUNT   := -v "$(CURDIR)":/work -w /work
# Hardened, offline (non-browser): no network, no new privileges, all caps dropped,
# read-only root filesystem (only the bind mount + a tmpfs /tmp are writable).
RUN     := docker run --rm --network none --security-opt no-new-privileges --cap-drop ALL --read-only --tmpfs /tmp -u $(UID) -e HOME=/tmp $(MOUNT) $(IMAGE)
# Browser (tests/bench): offline, no new privileges, isolated IPC namespace with
# enough /dev/shm for chromium (keeps default caps so the namespace sandbox works).
RUN_BROWSER := docker run --rm --network none --shm-size=1g --security-opt no-new-privileges -u $(UID) -e HOME=/tmp $(MOUNT) $(IMAGE)
# Networked: only dependency install + supply-chain audit.
RUN_NET := docker run --rm --security-opt no-new-privileges -u $(UID) -e HOME=/tmp $(MOUNT) $(IMAGE)

.DEFAULT_GOAL := help
.PHONY: help image deps typecheck lint build test a11y gdpr security bench audit all verify clean distclean

help: ## Show this help
	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) \
	  | awk 'BEGIN{FS=":.*?## "}{printf "  \033[36m%-12s\033[0m %s\n", $$1, $$2}'

image: $(STAMP) ## Build the Docker CI image (cached)
$(STAMP): docker/Dockerfile
	docker build -t $(IMAGE) -f docker/Dockerfile .
	@touch $(STAMP)

deps: $(DEPS) ## Install node deps into ./node_modules (in Docker, networked)
$(DEPS): package.json package-lock.json | image
	$(RUN_NET) npm ci --no-audit --no-fund
	@touch $(DEPS)

typecheck: deps ## Strict TypeScript type-check (no emit)
	$(RUN) tsc --noEmit -p tsconfig.json

lint: deps ## ESLint (strict type-checked rules)
	$(RUN) eslint .

build: deps ## Generate the breach folders + report/index.html from src/data.ts
	$(RUN) tsx scripts/build.ts

test: build ## Playwright e2e + axe WCAG AA + RGPD + security (in Docker)
	$(RUN_BROWSER) playwright test -c tests/playwright.config.ts

a11y: build ## Only the axe WCAG 2.1 AA accessibility suite
	$(RUN_BROWSER) playwright test -c tests/playwright.config.ts a11y

gdpr: build ## Only the RGPD / no-external-request / no-cookies suite
	$(RUN_BROWSER) playwright test -c tests/playwright.config.ts gdpr

security: build ## Only the CSP / output-encoding / DOM-XSS suite
	$(RUN_BROWSER) playwright test -c tests/playwright.config.ts security

bench: build ## Measure & benchmark the report (perf, CLS, bytes)
	$(RUN_BROWSER) tsx bench/bench.ts

audit: build ## Security audit: supply chain + artifact CSP/encoding + DOM-XSS
	@echo "— supply chain: production deps must be clean —"
	$(RUN_NET) npm audit --omit=dev --audit-level=high
	@echo "— full dependency audit (informational: dev tooling only) —"
	-$(RUN_NET) npm audit
	@echo "— artifact: output-encoding, strict CSP, no external refs —"
	$(RUN) tsx scripts/security-check.ts
	$(RUN_BROWSER) playwright test -c tests/playwright.config.ts security

all: typecheck lint build test bench audit ## Full pipeline incl. security audit
	@echo "✓ all green"

verify: all ## Alias for `all`

clean: ## Remove generated deliverables (report build + bench results)
	rm -rf report/index.html report/styles.css dist bench/results

distclean: clean ## Also drop deps + Docker image stamp
	rm -rf node_modules $(STAMP)
	-docker rmi $(IMAGE)