include $(CURDIR)/make/env.mk

PLATFORM ?= linux/amd64

ROX_PROJECT=apollo

TESTFLAGS=-race -p 4

BASE_DIR=$(CURDIR)

BENCHTIME ?= 1x

BENCHTIMEOUT ?= 20m

BENCHCOUNT ?= 1

CONTAINER_ENGINE ?= docker

export CONTAINER_ENGINE

podman =

ifeq ($(CONTAINER_ENGINE),podman)

podman = yes

else ifneq (,$(findstring podman,$(shell $(CONTAINER_ENGINE) --version 2>/dev/null)))

podman = yes

else ifneq (,$(findstring Podman,$(shell $(CONTAINER_ENGINE) version 2>/dev/null)))

podman = yes

ifeq (,$(shell command -v docker 2>/dev/null))

ifneq (,$(shell command -v podman 2>/dev/null))

podman = yes

CONTAINER_ENGINE=podman

ifdef podman

DOCKER_OPTS=--security-opt label=disable

else

DOCKER_OPTS=--user "$(shell id -u)"

SILENT ?= @

UNIT_TEST_IGNORE := "stackrox/rox/sensor/tests|stackrox/rox/operator/tests|stackrox/rox/central/reports/config/store/postgres|stackrox/rox/central/complianceoperator/v2/scanconfigurations/store/postgres|stackrox/rox/central/auth/store/postgres|stackrox/rox/scanner/e2etests"

GOBUILD := $(CURDIR)/scripts/go-build.sh

DOCKERBUILD := $(CURDIR)/scripts/docker-build.sh

GO_TEST_OUTPUT_PATH=$(CURDIR)/test-output/test.log

GOPATH_VOLUME_NAME := stackrox-rox-gopath

GOCACHE_VOLUME_NAME := stackrox-rox-gocache

GENERATE_PATH ?= ./...

ifneq (,$(findstring -debug,$(shell git rev-parse --abbrev-ref HEAD)))

DEBUG_BUILD ?= yes

DEBUG_BUILD ?= no

UNAME_S := $(shell uname -s)

UNAME_M := $(shell uname -m)

BUILD_IMAGE := quay.io/stackrox-io/apollo-ci:$(shell sed 's/\s*\#.*//' BUILD_IMAGE_VERSION)

ifneq ($(UNAME_M),x86_64)

GO_VERSION := $(shell sed -n 's/^go \([0-9]*\.[0-9]*\)\..*/\1/p' go.mod)

BUILD_IMAGE = docker.io/library/golang:$(GO_VERSION)

CENTRAL_DB_DOCKER_ARGS :=

ifeq ($(GOARCH),s390x)

CENTRAL_DB_DOCKER_ARGS := \

--build-arg="BASE_IMAGE=ubi9-minimal" \

--build-arg="BASE_TAG=9.2" \

--build-arg="RPMS_REGISTRY=quay.io" \

--build-arg="RPMS_BASE_IMAGE=centos/centos" \

--build-arg="RPMS_BASE_TAG=stream9"

BIND_GOCACHE ?= 1

BIND_GOPATH ?= 1

ifeq ($(UNAME_S),Darwin)

ifneq ($(UNAME_M),arm64)

BIND_GOCACHE ?= 0

BIND_GOPATH ?= 0

ifeq ($(BIND_GOCACHE),1)

GOCACHE_VOLUME_SRC := $(CURDIR)/linux-gocache

GOCACHE_VOLUME_SRC := $(GOCACHE_VOLUME_NAME)

ifeq ($(BIND_GOPATH),1)

GOPATH_VOLUME_SRC := $(GOPATH)

GOPATH_VOLUME_SRC := $(GOPATH_VOLUME_NAME)

LOCAL_VOLUME_ARGS := -v $(CURDIR):/src:delegated -v $(GOCACHE_VOLUME_SRC):/linux-gocache:delegated -v $(GOPATH_VOLUME_SRC):/go:delegated

LOCAL_VOLUME_ARGS += $(EXTRA_LOCAL_VOLUME_ARGS)

GOPATH_WD_OVERRIDES := -w /src -e GOPATH=/go -e GOCACHE=/linux-gocache -e GIT_CONFIG_COUNT=1 -e GIT_CONFIG_KEY_0=safe.directory -e GIT_CONFIG_VALUE_0='/src'

null :=

space := $(null) $(null)

comma := ,

.PHONY: all

all: deps style test image

include make/gotools.mk

$(call go-tool, BUF_BIN, github.com/bufbuild/buf/cmd/buf, tools/proto)

$(call go-tool, GOLANGCILINT_BIN, github.com/golangci/golangci-lint/v2/cmd/golangci-lint, tools/linters)

$(call go-tool, EASYJSON_BIN, github.com/mailru/easyjson/easyjson)

$(call go-tool, OSSLS_BIN, github.com/stackrox/ossls, tools/build)

$(call go-tool, ROXVET_BIN, ./tools/roxvet)

$(call go-tool, STRINGER_BIN, golang.org/x/tools/cmd/stringer)

$(call go-tool, MOCKGEN_BIN, go.uber.org/mock/mockgen)

$(call go-tool, GO_JUNIT_REPORT_BIN, github.com/jstemmer/go-junit-report/v2, tools/test)

$(call go-tool, PROTOLOCK_BIN, github.com/nilslice/protolock/cmd/protolock, tools/linters)

$(call go-tool, RATCHET_BIN, github.com/sethvargo/ratchet, tools/linters)

$(call go-tool, ACTIONLINT_BIN, actionlint.kjanat.dev/cmd/actionlint, tools/linters)

$(call go-tool, GOVULNCHECK_BIN, golang.org/x/vuln/cmd/govulncheck, tools/linters)

$(call go-tool, IMAGE_PREFETCHER_DEPLOY_BIN, github.com/stackrox/image-prefetcher/deploy, tools/test)

$(call go-tool, PROMETHEUS_METRIC_PARSER_BIN, github.com/stackrox/prometheus-metric-parser, tools/test)

.PHONY: style

style: golangci-lint style-slim

.PHONY: style-slim

style-slim: \

blanks \

check-cert-watcher-sync \

check-service-protos \

github-actions-pin-check \

newlines \

no-large-files \

openshift-ci-style \

proto-style \

qa-tests-style \

roxvet \

shell-style \

storage-protos-compatible \

ui-lint

GOLANGCILINT_FLAGS := --verbose --print-resources-usage

.PHONY: golangci-lint-cache-status

golangci-lint-cache-status: $(GOLANGCILINT_BIN) deps

@echo '+ $@'

@echo "Checking golangci-lint cache status"

$(GOLANGCILINT_BIN) cache status

.PHONY: golangci-lint

golangci-lint: $(GOLANGCILINT_BIN) deps

ifdef CI

@echo '+ $@'

@echo 'The environment indicates we are in CI; running linters in check mode.'

@echo 'If this fails, run `make style`.'

$(GOLANGCILINT_BIN) --version

@echo "Running with no tags..."

@# We need to enable unused linter here as it will not work without tests or in release tag.

$(GOLANGCILINT_BIN) run $(GOLANGCILINT_FLAGS) --enable=unused

@echo "Running with release tags..."

@# We use --tests=false because some unit tests don't compile with release tags,

@# since they use functions that we don't define in the release build. That's okay.

$(GOLANGCILINT_BIN) run $(GOLANGCILINT_FLAGS) --build-tags "$(subst $(comma),$(space),$(RELEASE_GOTAGS))" --tests=false

else

$(GOLANGCILINT_BIN) run $(GOLANGCILINT_FLAGS) --fix --enable=unused

$(GOLANGCILINT_BIN) run $(GOLANGCILINT_FLAGS) --fix --build-tags "$(subst $(comma),$(space),$(RELEASE_GOTAGS))" --tests=false

.PHONY: proto-style

proto-style: $(BUF_BIN) deps

@echo "+ $@"

$(BUF_BIN) format --exit-code --diff -w

.PHONY: qa-tests-style

qa-tests-style:

@echo "+ $@"

make -C qa-tests-backend/ style

.PHONY: ui-lint

ui-lint:

@echo "+ $@"

make -C ui lint

.PHONY: openshift-ci-style

openshift-ci-style:

@echo "+ $@"

make -C .openshift-ci/ style

.PHONY: shell-style

shell-style:

@echo "+ $@"

$(SILENT)$(BASE_DIR)/scripts/style/shellcheck.sh

.PHONY: update-shellcheck-skip

update-shellcheck-skip:

@echo "+ $@"

$(SILENT)rm -f scripts/style/shellcheck_skip.txt

$(SILENT)$(BASE_DIR)/scripts/style/shellcheck.sh update_failing_list

.PHONY: github-actions-lint

github-actions-lint: $(ACTIONLINT_BIN)

@echo "+ $@"

$(ACTIONLINT_BIN) -color -config-file .github/actionlint.yaml .github/workflows/*.yaml .github/workflows/*.yml

.PHONY: github-actions-pin-check

github-actions-pin-check: $(RATCHET_BIN)

@echo "+ $@"

$(RATCHET_BIN) lint -format actions .github/workflows/*.yaml .github/workflows/*.yml .github/actions/*/action.yaml

.PHONY: fast-central-build

fast-central-build: central-build-nodeps

.PHONY: central-build-nodeps

central-build-nodeps:

@echo "+ $@"

$(GOBUILD) central

.PHONY: config-controller-build-nodeps

config-controller-build-nodeps:

@echo "+ $@"

$(GOBUILD) config-controller

.PHONY: fast-central

fast-central: deps

@echo "+ $@"

$(CONTAINER_ENGINE) run $(DOCKER_OPTS) -e CGO_ENABLED --rm $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make fast-central-build

$(SILENT)$(BASE_DIR)/scripts/k8s/kill-pod.sh central

.PHONY: fast

fast: fast-central

.PHONY: fast-sensor

fast-sensor: sensor-build-dockerized

.PHONY: fast-sensor-kubernetes

fast-sensor-kubernetes: sensor-kubernetes-build-dockerized

$(SILENT)$(BASE_DIR)/scripts/k8s/kill-pod.sh sensor

.PHONY: fast-migrator

fast-migrator:

@echo "+ $@"

$(CONTAINER_ENGINE) run $(DOCKER_OPTS) -e CGO_ENABLED --rm $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make fast-migrator-build

.PHONY: fast-migrator-build

fast-migrator-build: migrator-build-nodeps

.PHONY: migrator-build-nodeps

migrator-build-nodeps:

@echo "+ $@"

$(GOBUILD) migrator

.PHONY: check-cert-watcher-sync

check-cert-watcher-sync:

@echo "+ $@"

@diff image/postgres/scripts/cert-watcher.sh scanner/image/db/scripts/cert-watcher.sh \

|| (echo "ERROR: cert-watcher.sh files are out of sync" && exit 1)

.PHONY: check-service-protos

check-service-protos:

@echo "+ $@"

$(SILENT)$(BASE_DIR)/tools/check-service-protos/run.sh

.PHONY: no-large-files

no-large-files:

$(BASE_DIR)/tools/detect-large-files.sh "$(BASE_DIR)/tools/allowed-large-files"

.PHONY: storage-protos-compatible

storage-protos-compatible: $(PROTOLOCK_BIN)

@echo "+ $@"

$(SILENT)$(PROTOLOCK_BIN) status -lockdir=$(BASE_DIR)/proto/storage -protoroot=$(BASE_DIR)/proto/storage --uptodate true

.PHONY: update-storage-protolock

update-storage-protolock: $(PROTOLOCK_BIN)

@echo "+ $@"

$(SILENT)$(PROTOLOCK_BIN) commit -lockdir=$(BASE_DIR)/proto/storage -protoroot=$(BASE_DIR)/proto/storage

.PHONY: blanks

blanks:

@echo "+ $@"

ifdef CI

$(SILENT)git grep -L '^// Code generated by .* DO NOT EDIT\.' -- '*.go' | xargs -n 1000 $(BASE_DIR)/tools/import_validate.py

else

$(SILENT)git grep -L '^// Code generated by .* DO NOT EDIT\.' -- '*.go' | xargs -n 1000 $(BASE_DIR)/tools/fix-blanks.sh

.PHONY: newlines

newlines:

@echo "+ $@"

ifdef CI

$(SILENT)git grep --cached -Il '' | xargs $(BASE_DIR)/tools/check-newlines.sh

else

$(SILENT)git grep --cached -Il '' | xargs $(BASE_DIR)/tools/check-newlines.sh --fix

.PHONY: init-githooks

init-githooks:

@echo "+ $@"

./tools/githooks/install-hooks.sh tools/githooks/pre-commit

.PHONY: dev

dev: install-dev-tools

@echo "+ $@"

PROTO_GENERATED_SRCS = $(GENERATED_PB_SRCS) $(GENERATED_VT_SRCS) $(GENERATED_COMPAT_SRCS) $(GENERATED_API_SRCS) $(GENERATED_API_GW_SRCS)

include make/protogen.mk

.PHONY: go-easyjson-srcs

go-easyjson-srcs: $(EASYJSON_BIN)

@echo "+ $@"

@# Files are ordered such that repeated runs of `make go-easyjson-srcs` don't create diffs.

$(SILENT)$(EASYJSON_BIN) pkg/compliance/compress/compress.go

.PHONY: clean-easyjson-srcs

clean-easyjson-srcs:

@echo "+ $@"

$(SILENT)find . -name '*_easyjson.go' -exec rm {} \;

.PHONY: go-generated-srcs

go-generated-srcs: deps clean-easyjson-srcs go-easyjson-srcs $(MOCKGEN_BIN) $(STRINGER_BIN)

@echo "+ $@"

PATH="$(GOTOOLS_BIN):$(PATH):$(BASE_DIR)/tools/generate-helpers" MOCKGEN_BIN="$(MOCKGEN_BIN)" go generate -v -x $(GENERATE_PATH)

proto-generated-srcs: $(PROTO_GENERATED_SRCS) $(GENERATED_API_SWAGGER_SPECS) $(GENERATED_API_SWAGGER_SPECS_V2) inject-proto-tags cleanup-swagger-json-gotags

@echo "+ $@"

$(SILENT)touch proto-generated-srcs

$(SILENT)$(MAKE) clean-obsolete-protos

clean-proto-generated-srcs:

@echo "+ $@"

git clean -xdf generated

.PHONY: config-controller-gen

config-controller-gen:

make -C config-controller/ manifests

make -C config-controller/ generate

cp config-controller/config/crd/bases/config.stackrox.io_securitypolicies.yaml image/templates/helm/stackrox-central/internal

.PHONY: generated-srcs

generated-srcs: go-generated-srcs config-controller-gen

ifdef CI

deps:

@echo "deps: CI is set — skipping go mod tidy (validated by check-generated-files)" >&2

else

deps: go.mod

@echo "+ $@"

$(SILENT)GOMOCK_REFLECT_DIRS=$$(find . -type d -name 'gomock_reflect_*'); \

if [ -n "$$GOMOCK_REFLECT_DIRS" ]; then \

echo "Found leftover gomock directories. Please remove them and rerun make deps!"; \

echo "$$GOMOCK_REFLECT_DIRS"; \

exit 1; \

fi

$(SILENT)go mod tidy

$(SILENT)touch $@

.PHONY: clean-deps

clean-deps:

@echo "+ $@"

$(SILENT)rm -f deps

.PHONY: clean-obsolete-protos

clean-obsolete-protos:

@echo "+ $@"

$(BASE_DIR)/tools/clean_autogen_protos.py --protos $(BASE_DIR)/proto --generated $(BASE_DIR)/generated

HOST_OS:=linux

ifeq ($(UNAME_S),Darwin)

HOST_OS:=darwin

.PHONY: build-prep

build-prep: deps

mkdir -p bin/{darwin_amd64,darwin_arm64,linux_amd64,linux_arm64,linux_ppc64le,linux_s390x,windows_amd64}

.PHONY: roxctl-build

roxctl-build: roxctl-linux roxctl-darwin roxctl-windows

roxctl-linux: roxctl_linux-amd64 roxctl_linux-arm64 roxctl_linux-ppc64le roxctl_linux-s390x

roxctl-darwin: roxctl_darwin-amd64 roxctl_darwin-arm64

roxctl-windows: roxctl_windows-amd64

roxctl_%: build-prep

$(eval w := $(subst -, ,$*))

$(eval os := $(firstword $(w)))

$(eval arch := $(lastword $(w)))

ifdef SKIP_CLI_BUILD

test -f bin/$(os)_$(arch)/roxctl || RACE=0 CGO_ENABLED=0 GOOS=$(os) GOARCH=$(arch) $(GOBUILD) ./roxctl

else

RACE=0 CGO_ENABLED=0 GOOS=$(os) GOARCH=$(arch) $(GOBUILD) ./roxctl

roxctl-install:

# Workaround a bug on MacOS

rm -f $(GOPATH)/bin/roxctl

# Copy the user's specific OS into gopath

mkdir -p $(GOPATH)/bin

cp bin/$(HOST_OS)_$(GOARCH)/roxctl $(GOPATH)/bin/roxctl

chmod u+w $(GOPATH)/bin/roxctl

.PHONY: roxctl

roxctl: roxctl-build roxctl-install

.PHONY: roxagent-build

roxagent-build: roxagent-linux

roxagent-linux: roxagent_linux-amd64 roxagent_linux-arm64 roxagent_linux-ppc64le roxagent_linux-s390x

roxagent_%: build-prep

$(eval w := $(subst -, ,$*))

$(eval os := $(firstword $(w)))

$(eval arch := $(lastword $(w)))

ifdef SKIP_CLI_BUILD

test -f bin/$(os)_$(arch)/roxagent || RACE=0 CGO_ENABLED=0 GOOS=$(os) GOARCH=$(arch) $(GOBUILD) ./compliance/virtualmachines/roxagent

else

RACE=0 CGO_ENABLED=0 GOOS=$(os) GOARCH=$(arch) $(GOBUILD) ./compliance/virtualmachines/roxagent

.PHONY: roxagent

roxagent: roxagent-build

.PHONY: cli-build

cli-build: roxctl-build roxagent-build

.PHONY: cli-install

cli-install: roxctl-install

.PHONY: cli

cli: cli-build cli-install

.PHONY: cli_host-arch

cli_host-arch: roxctl_$(HOST_OS)-$(GOARCH) roxagent_$(HOST_OS)-$(GOARCH)

upgrader: bin/$(HOST_OS)_$(GOARCH)/upgrader

bin/$(HOST_OS)_$(GOARCH)/upgrader: build-prep

GOOS=$(HOST_OS) GOARCH=$(GOARCH) $(GOBUILD) ./sensor/upgrader

bin/$(HOST_OS)_$(GOARCH)/admission-control: build-prep

GOOS=$(HOST_OS) GOARCH=$(GOARCH) $(GOBUILD) ./sensor/admission-control

.PHONY: build-volumes

build-volumes:

$(SILENT)mkdir -p $(CURDIR)/linux-gocache

$(SILENT)$(CONTAINER_ENGINE) volume inspect $(GOPATH_VOLUME_NAME) >/dev/null 2>&1 || $(CONTAINER_ENGINE) volume create $(GOPATH_VOLUME_NAME)

$(SILENT)$(CONTAINER_ENGINE) volume inspect $(GOCACHE_VOLUME_NAME) >/dev/null 2>&1 || $(CONTAINER_ENGINE) volume create $(GOCACHE_VOLUME_NAME)

.PHONY: main-build

main-build: build-prep main-build-dockerized

@echo "+ $@"

.PHONY: sensor-build-dockerized

sensor-build-dockerized: build-volumes

@echo "+ $@"

$(CONTAINER_ENGINE) run $(DOCKER_OPTS) --rm -e CI -e BUILD_TAG -e GOTAGS -e DEBUG_BUILD -e CGO_ENABLED $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make sensor-build

.PHONY: sensor-kubernetes-build-dockerized

sensor-kubernetes-build-dockerized: build-volumes

@echo "+ $@"

$(CONTAINER_ENGINE) run $(DOCKER_OPTS) -e CI -e BUILD_TAG -e GOTAGS -e DEBUG_BUILD -e CGO_ENABLED $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make sensor-kubernetes-build

.PHONY: sensor-build

sensor-build:

$(GOBUILD) sensor/kubernetes sensor/admission-control

CGO_ENABLED=0 $(GOBUILD) sensor/upgrader

.PHONY: sensor-kubernetes-build

sensor-kubernetes-build:

$(GOBUILD) sensor/kubernetes

.PHONY: main-build-dockerized

main-build-dockerized: build-volumes

@echo "+ $@"

$(CONTAINER_ENGINE) run $(DOCKER_OPTS) -i -e RACE -e CI -e BUILD_TAG -e SHORTCOMMIT -e GOTAGS -e DEBUG_BUILD -e CGO_ENABLED --rm $(GOPATH_WD_OVERRIDES) $(LOCAL_VOLUME_ARGS) $(BUILD_IMAGE) make main-build-nodeps

.PHONY: main-build-nodeps

main-build-nodeps:

$(GOBUILD) \

central \

central/worker \

compliance/cmd/compliance \

config-controller \

migrator \

operator/cmd \

scanner/cmd/scanner \

sensor/admission-control \

sensor/kubernetes \

sensor/upgrader \

compliance/virtualmachines/roxagent

mv bin/linux_$(GOARCH)/cmd bin/linux_$(GOARCH)/stackrox-operator

ifndef CI

CGO_ENABLED=0 $(GOBUILD) roxctl

.PHONY: scale-build

scale-build: build-prep

@echo "+ $@"

CGO_ENABLED=0 $(GOBUILD) scale/profiler scale/chaos

.PHONY: webhookserver-build

webhookserver-build: build-prep

@echo "+ $@"

CGO_ENABLED=0 $(GOBUILD) webhookserver

.PHONY: syslog-build

syslog-build:build-prep

@echo "+ $@"

CGO_ENABLED=0 $(GOBUILD) qa-tests-backend/test-images/syslog

.PHONY: gendocs

gendocs: $(GENERATED_API_DOCS)

@echo "+ $@"

.PHONY: swagger-docs

swagger-docs: $(MERGED_API_SWAGGER_SPEC) $(MERGED_API_SWAGGER_SPEC_V2)

@echo "+ $@"

UNIT_TEST_PACKAGES ?= ./...

NESTED_GO_MODULE_DIRS := $(shell find . -mindepth 2 -name go.mod -exec dirname {} \; | sed 's@^\./@@')

NESTED_GO_MODULE_REGEX := $(shell printf '%s\n' $(NESTED_GO_MODULE_DIRS) | paste -sd'|' -)

NESTED_GO_MODULES_WITH_TESTS := $(shell for dir in $(NESTED_GO_MODULE_DIRS); do git ls-files "$$dir/*_test.go" | grep -q . && echo "$$dir"; done)

.PHONY: test-prep

test-prep:

@echo "+ $@"

$(SILENT)mkdir -p test-output

.PHONY: go-unit-tests

go-unit-tests: build-prep test-prep

set -o pipefail ; \

CGO_ENABLED=1 GOEXPERIMENT=cgocheck2 MUTEX_WATCHDOG_TIMEOUT_SECS=30 GOTAGS=$(GOTAGS),test scripts/go-test.sh -timeout 25m -race -cover -coverprofile test-output/coverage.out -v \

$(shell git ls-files -- '*_test.go' | grep -v -E '^($(NESTED_GO_MODULE_REGEX))(/|$$)' | scripts/go-files-to-packages.sh | grep -Ev $(UNIT_TEST_IGNORE)) \

| tee $(GO_TEST_OUTPUT_PATH)

# Nested modules have independent coverage profiles, so keep their coverage

# out of the root profile while including their verbose output in JUnit.

@set -o pipefail; \

for module_dir in $(NESTED_GO_MODULES_WITH_TESTS); do \

echo "Run tests in $$module_dir"; \

(cd "$$module_dir" && go test -buildvcs=false -race -v ./...) 2>&1 | tee -a $(GO_TEST_OUTPUT_PATH); \

done

# Exercise the logging package for all supported logging levels to make sure that initialization works properly

@echo "Run log tests"

for encoding in console json; do \

for level in debug info warn error fatal panic; do \

LOGENCODING=$$encoding LOGLEVEL=$$level CGO_ENABLED=1 GOEXPERIMENT=cgocheck2 MUTEX_WATCHDOG_TIMEOUT_SECS=30 GOTAGS=$(GOTAGS),test scripts/go-test.sh -p 4 -race -v ./pkg/logging/... | grep -v "iteration"; \

done; \

done

.PHONY: sensor-integration-test

sensor-integration-test: build-prep test-prep

set -o pipefail ; \

CGO_ENABLED=1 GOEXPERIMENT=cgocheck2 MUTEX_WATCHDOG_TIMEOUT_SECS=30 LOGLEVEL=debug GOTAGS=$(GOTAGS),test scripts/go-test.sh -timeout 15m -race -v -p 1 ./sensor/tests/... | tee $(GO_TEST_OUTPUT_PATH)

sensor-pipeline-benchmark: build-prep test-prep

LOGLEVEL="panic" go test -bench=. -run=^# -benchtime=30s -count=5 ./sensor/tests/pipeline | tee $(CURDIR)/test-output/pipeline.results.txt

.PHONY: go-postgres-unit-tests

go-postgres-unit-tests: build-prep test-prep

set -o pipefail ; \

CGO_ENABLED=1 GOEXPERIMENT=cgocheck2 MUTEX_WATCHDOG_TIMEOUT_SECS=30 GOTAGS=$(GOTAGS),test,sql_integration scripts/go-test.sh -timeout 15m -race -cover -coverprofile test-output/coverage.out -v \

$(shell git grep -rl "//go:build sql_integration" central pkg tools | scripts/go-files-to-packages.sh -tags sql_integration | grep -Ev $(UNIT_TEST_IGNORE)) \

| tee $(GO_TEST_OUTPUT_PATH)

@# The -p 1 passed to go test is required to ensure that tests of different packages are not run in parallel, so as to avoid conflicts when interacting with the DB.

set -o pipefail ; \

CGO_ENABLED=1 GOEXPERIMENT=cgocheck2 MUTEX_WATCHDOG_TIMEOUT_SECS=30 GOTAGS=$(GOTAGS),test,sql_integration scripts/go-test.sh -p 1 -race -cover -coverprofile test-output/migrator-coverage.out -v \

$(shell git grep -rl "//go:build sql_integration" migrator | scripts/go-files-to-packages.sh -tags sql_integration | grep -Ev $(UNIT_TEST_IGNORE)) \

| tee -a $(GO_TEST_OUTPUT_PATH)

.PHONY: go-postgres-bench-tests

go-postgres-bench-tests: build-prep test-prep

set -o pipefail ; \

CGO_ENABLED=1 GOEXPERIMENT=cgocheck2 MUTEX_WATCHDOG_TIMEOUT_SECS=30 GOTAGS=$(GOTAGS),test,sql_integration scripts/go-test.sh -run=nonthing -bench=. -benchtime=$(BENCHTIME) -benchmem -timeout $(BENCHTIMEOUT) -count $(BENCHCOUNT) -v \

$(shell git grep -rl "testing.B" central pkg migrator tools | scripts/go-files-to-packages.sh -tags sql_integration | grep -Ev $(UNIT_TEST_IGNORE)) \

| tee $(GO_TEST_OUTPUT_PATH)

.PHONY: shell-unit-tests

shell-unit-tests:

@echo "+ $@"

$(SILENT)mkdir -p shell-test-output

bats --print-output-on-failure --verbose-run --recursive --report-formatter junit --output shell-test-output \

scanner/image/db/bats \

image/postgres/scripts \

scripts \

tests/e2e/bats

.PHONY: ui-build

ui-build:

ifdef SKIP_UI_BUILD

test -d ui/build || make -C ui build

else

make -C ui build

.PHONY: ui-test

ui-test:

make -C ui test

.PHONY: ui-component-tests

ui-component-tests:

make -C ui test-component

.PHONY: test

test: go-unit-tests ui-test shell-unit-tests

.PHONY: integration-unit-tests

integration-unit-tests: build-prep test-prep

set -o pipefail ; \

GOTAGS=$(GOTAGS),test,integration scripts/go-test.sh -count=1 -v \

$(shell go list ./... | grep "registries\|scanners\|notifiers") \

| tee $(GO_TEST_OUTPUT_PATH)

.PHONY: generate-junit-reports

generate-junit-reports: junit-reports/report.xml

$(GO_TEST_OUTPUT_PATH):

@echo "The test output log cannot be created via a direct Makefile rule. You must make the desired test targets"

@echo "first to ensure the file's existence."

@exit 1

junit-reports/report.xml: $(GO_TEST_OUTPUT_PATH) $(GO_JUNIT_REPORT_BIN)

@mkdir -p junit-reports

$(SILENT)$(GO_JUNIT_REPORT_BIN) <"$<" >"$@"

.PHONY: image

image: main-image

.PHONY: all-builds

all-builds: cli main-build clean-image $(MERGED_API_SWAGGER_SPEC) $(MERGED_API_SWAGGER_SPEC_V2) ui-build

.PHONY: main-image

main-image: all-builds

make docker-build-main-image

.PHONY: docker-build-main-image

docker-build-main-image: copy-binaries-to-image-dir

$(DOCKERBUILD) \

-t stackrox/main:$(TAG) \

-t $(DEFAULT_IMAGE_REGISTRY)/main:$(TAG) \

--build-arg DEBUG_BUILD="$(DEBUG_BUILD)" \

--build-arg ROX_PRODUCT_BRANDING=$(ROX_PRODUCT_BRANDING) \

--build-arg TARGET_ARCH=$(GOARCH) \

--build-arg ROX_IMAGE_FLAVOR=$(ROX_IMAGE_FLAVOR) \

--build-arg LABEL_VERSION=$(TAG) \

--build-arg LABEL_RELEASE=$(TAG) \

--build-arg QUAY_TAG_EXPIRATION=$(QUAY_TAG_EXPIRATION) \

$(CENTRAL_DB_DOCKER_ARGS) \

--file image/rhel/Dockerfile \

image/rhel

@echo "Built main image for RHEL with tag: $(TAG), image flavor: $(ROX_IMAGE_FLAVOR)"

@echo "You may wish to: export MAIN_IMAGE_TAG=$(TAG)"

.PHONY: docker-build-roxctl-image

docker-build-roxctl-image:

cp -f bin/linux_$(GOARCH)/roxctl image/roxctl/roxctl-linux

$(DOCKERBUILD) \

-t stackrox/roxctl:$(TAG) \

-t $(DEFAULT_IMAGE_REGISTRY)/roxctl:$(TAG) \

-f image/roxctl/Dockerfile \

--label quay.expires-after=$(QUAY_TAG_EXPIRATION) \

image/roxctl

.PHONY: copy-go-binaries-to-image-dir

copy-go-binaries-to-image-dir:

cp bin/linux_$(GOARCH)/central image/rhel/bin/central

cp bin/linux_$(GOARCH)/config-controller image/rhel/bin/config-controller

cp bin/linux_$(GOARCH)/worker image/rhel/bin/central-worker

ifdef CI

cp bin/linux_amd64/roxctl image/rhel/bin/roxctl-linux-amd64

cp bin/linux_arm64/roxctl image/rhel/bin/roxctl-linux-arm64

cp bin/linux_ppc64le/roxctl image/rhel/bin/roxctl-linux-ppc64le

cp bin/linux_s390x/roxctl image/rhel/bin/roxctl-linux-s390x

cp bin/darwin_amd64/roxctl image/rhel/bin/roxctl-darwin-amd64

cp bin/darwin_arm64/roxctl image/rhel/bin/roxctl-darwin-arm64

cp bin/windows_amd64/roxctl.exe image/rhel/bin/roxctl-windows-amd64.exe

else

ifneq ($(HOST_OS),linux)

cp bin/linux_$(GOARCH)/roxctl image/rhel/bin/roxctl-linux-$(GOARCH)

cp bin/$(HOST_OS)_amd64/roxctl image/rhel/bin/roxctl-$(HOST_OS)-amd64

cp bin/linux_$(GOARCH)/migrator image/rhel/bin/migrator

cp bin/linux_$(GOARCH)/kubernetes image/rhel/bin/kubernetes-sensor

cp bin/linux_$(GOARCH)/upgrader image/rhel/bin/sensor-upgrader

cp bin/linux_$(GOARCH)/admission-control image/rhel/bin/admission-control

cp bin/linux_$(GOARCH)/compliance image/rhel/bin/compliance

cp bin/linux_$(GOARCH)/roxagent image/rhel/bin/roxagent

# Workaround to bug in lima: https://github.com/lima-vm/lima/issues/602

find image/rhel/bin -not -path "*/.*" -type f -exec chmod +x {} \;

.PHONY: copy-binaries-to-image-dir

copy-binaries-to-image-dir: copy-go-binaries-to-image-dir

cp -r ui/build image/rhel/ui/

ifdef CI

$(SILENT)[ -d image/rhel/THIRD_PARTY_NOTICES ] || { echo "image/rhel/THIRD_PARTY_NOTICES dir not found! It is required for CI-built images."; exit 1; }

else

$(SILENT)[ -f image/rhel/THIRD_PARTY_NOTICES ] || mkdir -p image/rhel/THIRD_PARTY_NOTICES

$(SILENT)[ -d image/rhel/docs ] || { echo "Generated docs not found in image/rhel/docs. They are required for build."; exit 1; }

.PHONY: scale-image

scale-image: scale-build clean-image

cp bin/linux_$(GOARCH)/profiler scale/image/rhel/bin/profiler

cp bin/linux_$(GOARCH)/chaos scale/image/rhel/bin/chaos

chmod +w scale/image/rhel/bin/*

$(CONTAINER_ENGINE) build \

-t stackrox/scale:$(TAG) \

-t quay.io/rhacs-eng/scale:$(TAG) \

-f scale/image/Dockerfile scale

webhookserver-image: webhookserver-build

-mkdir webhookserver/bin

cp bin/linux_$(GOARCH)/webhookserver webhookserver/bin/webhookserver

chmod +w webhookserver/bin/webhookserver

$(CONTAINER_ENGINE) build \

-t stackrox/webhookserver:1.2 \

-t quay.io/rhacs-eng/webhookserver:1.2 \

-f webhookserver/Dockerfile webhookserver

syslog-image: syslog-build

-mkdir qa-tests-backend/test-images/syslog/bin

cp bin/linux_$(GOARCH)/syslog qa-tests-backend/test-images/syslog/bin/syslog

chmod +w qa-tests-backend/test-images/syslog/bin/syslog

$(DOCKERBUILD) \

-t stackrox/qa:syslog_server_1_0 \

-t quay.io/rhacs-eng/qa:syslog_server_1_0 \

-f qa-tests-backend/test-images/syslog/Dockerfile qa-tests-backend/test-images/syslog

.PHONY: central-db-image

central-db-image:

$(DOCKERBUILD) \

-t stackrox/central-db:$(TAG) \

-t $(DEFAULT_IMAGE_REGISTRY)/central-db:$(TAG) \

$(CENTRAL_DB_DOCKER_ARGS) \

--file image/postgres/Dockerfile \

image/postgres

@echo "Built central-db image with tag $(TAG)"

.PHONY: clean

clean: clean-image

@echo "+ $@"

.PHONY: clean-image

clean-image:

@echo "+ $@"

git clean -xf image/bin image/rhel/bin

git clean -xdf image/ui image/rhel/ui image/rhel/docs

rm -f $(CURDIR)/image/rhel/bundle.tar.gz $(CURDIR)/image/postgres/bundle.tar.gz

rm -rf $(CURDIR)/image/rhel/scripts

.PHONY: tag

tag:

@echo $(TAG)

.PHONY: shortcommit

shortcommit:

ifdef SHORTCOMMIT

@echo $(SHORTCOMMIT)

else

@git rev-parse --short HEAD

.PHONY: image-flavor

image-flavor:

@echo $(ROX_IMAGE_FLAVOR)

.PHONY: default-image-registry

default-image-registry:

@echo $(DEFAULT_IMAGE_REGISTRY)

.PHONY: product-branding

product-branding:

@echo $(ROX_PRODUCT_BRANDING)

.PHONY: ossls-audit

ossls-audit: deps $(OSSLS_BIN)

$(OSSLS_BIN) version

$(OSSLS_BIN) audit

.PHONY: ossls-notice

ossls-notice: deps $(OSSLS_BIN)

$(OSSLS_BIN) version

$(OSSLS_BIN) audit --export image/rhel/THIRD_PARTY_NOTICES

.PHONY: collector-tag

collector-tag:

@echo "$$(cat COLLECTOR_VERSION)"

.PHONY: fact-tag

fact-tag:

@echo "$$(cat FACT_VERSION)"

.PHONY: scanner-tag

scanner-tag:

@echo "$$(cat SCANNER_VERSION)"

.PHONY: clean-dev-tools

clean-dev-tools: gotools-clean

@echo "+ $@"

.PHONY: reinstall-dev-tools

reinstall-dev-tools: clean-dev-tools

@echo "+ $@"

$(SILENT)$(MAKE) install-dev-tools

.PHONY: install-dev-tools

install-dev-tools: gotools-all

@echo "+ $@"

.PHONY: roxvet

roxvet: skip-dirs := operator/pkg/clientset /generated/ /mocks

roxvet: $(ROXVET_BIN)

@echo "+ $@"

@# TODO(ROX-7574): Add options to ignore specific files or paths in roxvet

$(SILENT)go list -e ./... \

| $(foreach d,$(skip-dirs),grep -v '$(d)' |) \

xargs -n 1000 go vet -vettool "$(ROXVET_BIN)" -tags "sql_integration test_e2e test_e2e_vm test race destructive integration scanner_db_integration compliance externalbackups"

.PHONY: check-debugger

check-debugger:

/usr/bin/env DEBUG_BUILD="$(DEBUG_BUILD)" BUILD_TAG="$(BUILD_TAG)" TAG="$(TAG)" ./scripts/check-debugger.sh

ifeq ($(DEBUG_BUILD),yes)

$(warning Warning: DEBUG_BUILD is enabled. Don not use this for production builds)

.PHONY: policyutil

policyutil:

@echo "+ $@"

CGO_ENABLED=0 GOOS=$(HOST_OS) $(GOBUILD) ./tools/policyutil

go install ./tools/policyutil

.PHONY: mitre

mitre:

@echo "+ $@"

CGO_ENABLED=0 GOOS=$(HOST_OS) $(GOBUILD) ./tools/mitre

go install ./tools/mitre

.PHONY: bootstrap_migration

bootstrap_migration:

$(SILENT)if [[ "x${DESCRIPTION}" == "x" ]]; then echo "Please set a description for your migration in the DESCRIPTION environment variable"; else go run tools/generate-helpers/bootstrap-migration/main.go --root . --description "${DESCRIPTION}" ;fi

.PHONY: bootstrap_background_migration

bootstrap_background_migration:

$(SILENT)if [[ "x${DESCRIPTION}" == "x" ]]; then echo "Please set a description for your migration in the DESCRIPTION environment variable"; else go run tools/generate-helpers/bootstrap-background-migration/main.go --root . --description "${DESCRIPTION}" ;fi

.PHONY: image-prefetcher-deploy-bin

image-prefetcher-deploy-bin: $(IMAGE_PREFETCHER_DEPLOY_BIN) ## download and install

.PHONY: print-image-prefetcher-deploy-bin

print-image-prefetcher-deploy-bin:

@echo $(IMAGE_PREFETCHER_DEPLOY_BIN)

.PHONY: prometheus-metric-parser

prometheus-metric-parser: $(PROMETHEUS_METRIC_PARSER_BIN)

@echo $(PROMETHEUS_METRIC_PARSER_BIN)