CONFIG = config/application.yml

HOST ?= localhost

PORT ?= 3000

ORIGIN_PORT ?= $(PORT)

GZIP_COMMAND ?= gzip

ARTIFACT_DESTINATION_FILE ?= ./tmp/idp.tar.gz

.PHONY: \

analytics_events \

audit \

brakeman \

build_artifact \

check \

clobber_db \

clobber_assets \

clobber_logs \

watch_events \

download_acuant_sdk \

help \

lint \

lint_analytics_events \

lint_analytics_events_sorted \

lint_tracker_events \

lint_country_dialing_codes \

lint_database_schema_files \

lint_erb \

lint_font_glyphs \

lint_lockfiles \

lint_new_typescript_files \

lint_optimized_assets \

lint_yaml \

lint_js_workspaces \

lint_asset_bundle_size \

lint_readme \

lint_spec_file_name \

lintfix \

lint_openapi \

normalize_yaml \

optimize_assets \

optimize_svg \

run \

tidy \

update \

urn \

README.md \

setup \

test \

update_pinpoint_supported_countries

help: ## Show this help

@echo "--- Help ---"

@ruby lib/makefile_help_parser.rb

all: check

setup $(CONFIG): config/application.yml.default ## Runs setup scripts (updates packages, dependencies, databases, etc)

bin/setup

check: lint test ## Runs lint tests and spec tests

lint: ## Runs all lint tests

# Ruby

@echo "--- erb_lint ---"

make lint_erb

@echo "--- rubocop ---"

mkdir -p tmp

ifdef JUNIT_OUTPUT

bundle exec rubocop --parallel --format progress --format junit --out rubocop.xml --display-only-failed --color 2> tmp/rubocop.txt || (cat tmp/rubocop.txt; exit 1)

else

bundle exec rubocop --parallel --color 2> tmp/rubocop.txt || (cat tmp/rubocop.txt; exit 1)

awk 'NF {exit 1}' tmp/rubocop.txt || (printf "Error: Unexpected stderr output from Rubocop\n"; cat tmp/rubocop.txt; exit 1)

@echo "--- analytics_events ---"

make lint_analytics_events

make lint_analytics_events_sorted

make lint_tracker_events

@echo "--- brakeman ---"

make brakeman

# JavaScript

@echo "--- eslint ---"

npm run lint

@echo "--- typescript ---"

npm run typecheck

# Other

@echo "--- lint yaml ---"

make lint_yaml

@echo "--- lint font glyphs ---"

make lint_font_glyphs

@echo "--- lint JS workspaces ---"

make lint_js_workspaces

@echo "--- lint new TypeScript files ---"

make lint_new_typescript_files

@echo "--- lint lockfiles ---"

make lint_lockfiles

@echo "--- check assets are optimized ---"

make lint_optimized_assets

@echo "--- stylelint ---"

npm run lint:css

@echo "--- README.md ---"

make lint_readme

@echo "--- lint spec file names ---"

make lint_spec_file_name

@echo "--- lint migrations ---"

make lint_migrations

@echo "--- lint openapi spec ---"

make lint_openapi

audit: ## Checks packages for vulnerabilities

@echo "--- bundler-audit ---"

bundle exec bundler-audit check --update

@echo "--- npm audit ---"

npm audit --audit-level=high --omit=dev

lint_erb: ## Lints ERB files

bundle exec erb_lint app/views app/components

lint_yaml: normalize_yaml ## Lints YAML files

(! git diff --name-only | grep "^config/.*\.yml") || (echo "Error: Run 'make normalize_yaml' to normalize YAML"; exit 1)

lint_font_glyphs: ## Lints to validate content glyphs match expectations from fonts

scripts/yaml_characters \

--exclude-locale=zh \

--exclude-path=config/locales/telephony \

--exclude-gem-path=faker \

--exclude-gem-path=good_job \

--exclude-gem-path=i18n-tasks \

--exclude-key-scope=user_mailer \

> app/assets/fonts/glyphs.txt

(! git diff --name-only | grep "glyphs\.txt$$") || (echo "Error: New character data found. Follow 'Fonts' instructions in 'docs/frontend.md' to regenerate fonts."; exit 1)

lint_js_workspaces: ## Lints JS workspace packages

scripts/validate-workspaces.mjs

lint_asset_bundle_size: ## Lints JavaScript and CSS compiled bundle size

@# This enforces an asset size budget to ensure that download sizes are reasonable and to protect

@# against accidentally importing large pieces of third-party libraries. If you're here debugging

@# a failing build, check to ensure that you've not added more JavaScript or CSS than necessary,

@# and you have no options to split that from the common bundles. If you need to increase this

@# budget and accept the fact that this will force end-users to endure longer load times, you

@# should set the new budget to within a few thousand bytes of the production-compiled size.

find app/assets/builds/application.css -size -105000c | grep .

find public/packs/application-*.digested.js -size -5000c | grep .

lint_migrations:

scripts/migration_check

lint_gemfile_lock: Gemfile Gemfile.lock ## Lints the Gemfile and its lockfile

@bundle check

@git diff --quiet HEAD Gemfile.lock || (echo "Error: There are uncommitted changes after running 'bundle install'"; exit 1)

lint_package_lock: package.json package-lock.json ## Lints the package.json and its lockfile

@npm install --ignore-scripts

@(! git diff --name-only | grep package-lock.json) || (echo "Error: There are uncommitted changes after running 'npm install'"; exit 1)

lint_lockfiles: lint_gemfile_lock lint_package_lock ## Lints to ensure lockfiles are in sync

lint_new_typescript_files:

scripts/enforce-typescript-files.mjs

lint_readme: README.md ## Lints README.md

(! git diff --name-only | grep "^README.md$$") || (echo "Error: Run 'make README.md' to regenerate the README.md"; exit 1)

lint_spec_file_name:

@find spec/*/** -type f \

-name '*.rb' \

-and -not -name '*_spec.rb' \

-and -not -path 'spec/factories/*' \

-and -not -path 'spec/support/*' \

-and -not -path '*/previews/*' \

-exec false {} + \

-exec echo "Error: Spec files named incorrectly, should end in '_spec.rb':" {} +

@find app/javascript/packages -type f \

"(" -name '*spec.js' -or -name '*spec.ts' -or -name '*spec.jsx' -or -name '*spec.tsx' ")" \

-and -not \

"(" -name '*.spec.js' -or -name '*.spec.ts' -or -name '*.spec.jsx' -or -name '*.spec.tsx' ")" \

-exec false {} + \

-exec echo "Error: Spec files named incorrectly, should end in '.spec.(js|ts|jsx|tsx)':" {} +

lint_openapi:

@npm run lint:openapi

lintfix: ## Try to automatically fix any Ruby, ERB, JavaScript, YAML, or CSS lint errors

@echo "--- rubocop fix ---"

bundle exec rubocop -a

@echo "--- erb_lint fix ---"

bundle exec erb_lint app/views app/components -a

@echo "--- eslint fix ---"

npm run lint -- --fix

@echo "--- stylelint fix ---"

npm run lint:css -- --fix

@echo "--- normalize yaml ---"

make normalize_yaml

brakeman: ## Runs brakeman code security check

(bundle exec brakeman) || (echo "Error: update code as needed to remove security issues. For known exceptions already in brakeman.ignore, use brakeman to interactively update exceptions."; exit 1)

public/packs/manifest.json: package-lock.json $(shell find app/javascript -type f) ## Builds JavaScript assets

npm run build:js

browsers.json: package-lock.json .browserslistrc ## Generates browsers.json browser support file

npm run generate-browsers-json

test: export RAILS_ENV := test

test: $(CONFIG) ## Runs RSpec and JS tests

bundle exec rspec && npm run test

test_serial: export RAILS_ENV := test

test_serial: $(CONFIG) ## Runs RSpec and JS tests serially

bundle exec rake spec && npm run test

tmp/$(HOST).key tmp/$(HOST).crt: ## Self-signed cert for local HTTPS development

mkdir -p tmp

openssl req \

-newkey rsa:2048 \

-x509 \

-sha256 \

-nodes \

-days 365 \

-subj "/C=US/ST=District of Columbia/L=Washington/O=GSA/OU=Login.gov/CN=$(HOST)" \

-addext "subjectAltName=IP:$(HOST)" \

-keyout tmp/$(HOST).key \

-out tmp/$(HOST).crt

run: browsers.json ## Runs the development server

foreman start -p $(PORT)

urn:

@echo "⚱️"

make run

run-https: tmp/$(HOST).key tmp/$(HOST).crt ## Runs the development server with HTTPS

HTTPS=on FOREMAN_HOST="ssl://$(HOST):$(PORT)?key=tmp/$(HOST).key&cert=tmp/$(HOST).crt" foreman start -p $(PORT)

normalize_yaml: ## Normalizes YAML files (alphabetizes keys, fixes line length, smart quotes)

npm run normalize-yaml -- .rubocop.yml --disable-sort-keys --disable-smart-punctuation

find ./config/locales/transliterate -type f -name '*.yml' -exec npm run normalize-yaml -- --disable-sort-keys --disable-smart-punctuation {} \;

npm run normalize-yaml -- --disable-smart-punctuation --ignore-key-sort development,production,test config/application.yml.default

find ./config/locales/telephony -type f -name '*.yml' | xargs npm run normalize-yaml -- --disable-smart-punctuation

find ./config/locales -not \( -path "./config/locales/telephony*" -o -path "./config/locales/transliterate/*" \) -type f -name '*.yml' | \

xargs npm run normalize-yaml \

config/pinpoint_supported_countries.yml \

config/pinpoint_overrides.yml \

config/country_dialing_codes.yml

find ./docs/attempts-api -type f -name '*.yml' | xargs npm run normalize-yaml -- --disable-smart-punctuation --disable-sort-keys

optimize_svg: ## Optimizes SVG images

# Exclusions:

# - `login-icon-bimi.svg` is hand-optimized and includes required metadata that would be stripped by SVGO

find app/assets/images public -name '*.svg' -not -name 'login-icon-bimi.svg' -not -name 'selfie-capture-accept-help.svg' | xargs ./node_modules/.bin/svgo

optimize_assets: optimize_svg ## Optimizes all assets

lint_optimized_assets: optimize_assets ## Checks that assets are optimized

(! git diff --name-only | grep "\.svg$$") || (echo "Error: Optimize assets using 'make optimize_assets'"; exit 1)

update_pinpoint_supported_countries: ## Updates list of countries supported by Pinpoint for voice and SMS

bundle exec ./scripts/pinpoint-supported-countries > config/pinpoint_supported_countries.yml

bundle exec ./scripts/deep-merge-yaml \

--comment 'Generated from `make update_pinpoint_supported_countries`' \

--sources \

-- \

config/pinpoint_supported_countries.yml \

config/pinpoint_overrides.yml \

> config/country_dialing_codes.yml

npm run normalize-yaml config/country_dialing_codes.yml config/pinpoint_supported_countries.yml

lint_country_dialing_codes: update_pinpoint_supported_countries ## Checks that countries supported by Pinpoint for voice and SMS are up to date

(! git diff --name-only | grep config/country_dialing_codes.yml) || (echo "Error: Run 'make update_pinpoint_supported_countries' to update country codes"; exit 1)

lint_database_schema_files: ## Checks that database schema files have not changed

(! git diff --name-only | grep db/schema.rb) || (echo "Error: db/schema.rb does not match after running migrations"; exit 1)

(! git diff --name-only | grep db/worker_jobs_schema.rb) || (echo "Error: db/worker_jobs_schema.rb does not match after running migrations"; exit 1)

build_artifact $(ARTIFACT_DESTINATION_FILE): ## Builds zipped tar file artifact with IDP source code and Ruby/JS dependencies

@echo "Building artifact into $(ARTIFACT_DESTINATION_FILE)"

bundle config set --local cache_all true

bundle package

tar \

--exclude './config/agencies.yml' \

--exclude './config/iaa_gtcs.yml' \

--exclude './config/iaa_orders.yml' \

--exclude './config/iaa_statuses.yml' \

--exclude './config/integration_statuses.yml' \

--exclude './config/integrations.yml' \

--exclude './config/partner_account_statuses.yml' \

--exclude './config/partner_accounts.yml' \

--exclude './config/service_providers.yml' \

--exclude='./certs/sp' \

--exclude='./identity-idp-config' \

--exclude='./tmp' \

--exclude='./log' \

--exclude='./app/javascript/packages/**/node_modules' \

--exclude='./node_modules' \

--exclude='./geo_data/GeoLite2-City.mmdb' \

--exclude='./pwned_passwords/pwned_passwords.txt' \

--exclude='./vendor/ruby' \

--exclude='./config/application.yml' \

-cf - "." | "$(GZIP_COMMAND)" > $(ARTIFACT_DESTINATION_FILE)

analytics_events: public/api/_analytics-events.json ## Generates a JSON file that documents analytics events for events.log

lint_analytics_events: .yardoc ## Checks that all methods on AnalyticsEvents are documented

bundle exec ruby lib/analytics_events_documenter.rb --class-name="AnalyticsEvents" --check $<

lint_analytics_events_sorted:

(grep '^ def ' app/services/analytics_events.rb | LC_COLLATE='C.UTF-8' sort -c) || \

(echo '\033[1;31mError: methods in analytics_events.rb are not sorted alphabetically\033[0m' && exit 1)

lint_tracker_events: .yardoc ## Checks that all methods on AnalyticsEvents are documented

bundle exec ruby lib/analytics_events_documenter.rb --class-name="AttemptsApi::TrackerEvents" --check --skip-extra-params $<

public/api/_analytics-events.json: .yardoc .yardoc/objects/root.dat

mkdir -p public/api

bundle exec ruby lib/analytics_events_documenter.rb --class-name="AnalyticsEvents" --json $< > $@

.yardoc .yardoc/objects/root.dat: app/services/analytics_events.rb app/services/attempts_api/tracker_events.rb

bundle exec yard doc \

--no-progress \

--fail-on-warning \

--type-tag identity.idp.previous_event_name:"Previous Event Name" \

--no-output \

--db $@ \

-- $^

update: ## Update dependencies, useful after a git pull

bundle install

npm install

bundle exec rails db:migrate

README.md: docs/ ## Generates README.md based on the contents of the docs directory

bundle exec ruby scripts/generate_readme.rb --docs-dir $< > $@

download_acuant_sdk: ## Downloads the most recent Acuant SDK release from Github

@scripts/download_acuant_sdk.sh

clobber_db: ## Resets the database for make setup

bin/rake db:create

bin/rake db:environment:set

bin/rake db:reset

bin/rake db:environment:set

bin/rake dev:prime

clobber_assets: ## Removes (clobbers) assets

bin/rake assets:clobber

RAILS_ENV=test bin/rake assets:clobber

clobber_logs: ## Purges logs and tmp/

rm -f log/*

rm -rf tmp/cache/*

rm -rf tmp/encrypted_doc_storage

rm -rf tmp/letter_opener

rm -rf tmp/mails

watch_events: ## Prints events logging as they happen

@tail -F -n0 log/events.log | jq "select(.name | test(\".*$$EVENT_NAME.*\"; \"i\")) | ."

tidy: clobber_assets clobber_logs ## Remove assets, logs, and unused gems, but leave DB alone

bundle clean

compile_openapi_spec: ## Compiles the OpenAPI spec for the Attempts API

npm run build:openapi