Makefile

.DEFAULT_GOAL := help
SHELL := /bin/bash

# Load .env if present so SCAN_TARGET_DIR / DAST_TARGET_URL etc. are available.
ifneq (,$(wildcard .env))
include .env
export
endif

.PHONY: help install dev build scan scan-sast scan-sca scan-iac scan-dast lint format test integration e2e typecheck clean

help: ## Show this help
	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) \
		| awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-12s\033[0m %s\n", $$1, $$2}'

install: ## Install workspace dependencies
	pnpm install

dev: ## Start the dashboard (Vite dev server)
	pnpm --filter @devsec/web dev

build: ## Build all packages
	pnpm -r build

scan: ## Run all scanners and write the unified report
	pnpm --filter @devsec/cli scan

scan-sast: ## Run SAST only (Semgrep)
	pnpm --filter @devsec/cli scan -- --only sast

scan-sca: ## Run SCA only (Trivy fs)
	pnpm --filter @devsec/cli scan -- --only sca

scan-iac: ## Run IaC only (Checkov)
	pnpm --filter @devsec/cli scan -- --only iac

scan-dast: ## Run DAST only (OWASP ZAP baseline)
	pnpm --filter @devsec/cli scan -- --only dast

scan-supply: ## Run supply-chain analysis only (OSV-Scanner)
	pnpm --filter @devsec/cli scan -- --only supply

scan-socket: ## Run supply-chain risk only (local heuristics; Socket.dev with SOCKET_API_KEY)
	pnpm --filter @devsec/cli scan -- --only socket

scan-image: ## Scan a container image (set SCAN_IMAGE_REF or IMAGE=...)
	pnpm --filter @devsec/cli scan -- --only image --image $(or $(IMAGE),$(SCAN_IMAGE_REF))

lint: ## Lint and check formatting
	pnpm lint

format: ## Auto-format the codebase
	pnpm format

test: ## Run the unit test suite
	pnpm test

integration: ## Run real-scanner integration tests (needs Docker)
	pnpm test:integration

e2e: ## Run the Playwright browser tests
	pnpm test:e2e

typecheck: ## Type-check all packages
	pnpm typecheck

clean: ## Remove build output and caches
	rm -rf packages/*/dist packages/web/dist coverage **/*.tsbuildinfo