export NAME=ouroboros
export NAMESPACE=cozy-$(NAME)

include ../../../hack/common-envs.mk
include ../../../hack/package.mk

# Pin the upstream ouroboros chart by version AND OCI manifest digest.
#
# OUROBOROS_CHART_DIGEST below is the digest of the OCI **chart**
# manifest at ghcr.io/lexfrei/charts/ouroboros — it pins the contents
# of the helm chart artefact (templates, values.yaml, Chart.yaml).
# It is NOT the digest of the controller container image. The image
# digest lives in values.yaml under image.tag (`image.tag: "<version>@sha256:..."`)
# and pins ghcr.io/lexfrei/ouroboros (the runtime binary). Both
# digests have to land together at every chart bump — the chart
# version, the chart-manifest digest, and the controller-image
# digest all advance in lockstep with the upstream release.
#
# Bump together with the image tag+digest in values.yaml. The digest
# pin closes the supply-chain hole that a tag-only pull would leave —
# OCI registries can republish under the same tag, but the manifest
# digest is immutable. To bump: resolve the new chart-manifest digest
# with
#   crane manifest ghcr.io/lexfrei/charts/ouroboros:<new-tag> | sha256sum
# (or `oras manifest fetch ghcr.io/lexfrei/charts/ouroboros:<new-tag> | sha256sum`)
# and update both lines below; resolve the new image digest with
#   crane digest ghcr.io/lexfrei/ouroboros:<new-tag>
# and update values.yaml.
OUROBOROS_CHART_VERSION ?= 0.8.1
OUROBOROS_CHART_DIGEST ?= sha256:40fd5b639ff73594989856076eab5dfbd0dfab8ee16d1cab915756e24b54458b

test:
	helm unittest .

update:
	rm -rf charts
	# Pull by digest, then verify Chart.yaml records the expected
	# version. A digest mismatch (someone bumped DIGEST without
	# bumping VERSION, or vice versa) trips the assert and aborts.
	helm pull oci://ghcr.io/lexfrei/charts/ouroboros@$(OUROBOROS_CHART_DIGEST) --untar --untardir charts
	# Pulling by digest also leaves an empty directory named after the
	# digest ref next to the untarred chart. Git ignores empty directories
	# so it never shows as drift, which is exactly why it lingers
	# unnoticed; drop it so `make update` leaves the tree clean.
	rm -rf "charts/ouroboros@$(OUROBOROS_CHART_DIGEST)"
	@actual_version=$$(awk '/^version:/ {print $$2}' charts/ouroboros/Chart.yaml | tr -d '"'); \
	if [ "$$actual_version" != "$(OUROBOROS_CHART_VERSION)" ]; then \
	  echo "ERROR: pulled chart Chart.yaml version=$$actual_version but Makefile OUROBOROS_CHART_VERSION=$(OUROBOROS_CHART_VERSION). Bump both in lockstep."; \
	  exit 1; \
	fi
	# Drop vendored upstream helm-unittest fixtures: the upstream
	# fixtures hard-code upstream defaults that conflict with the
	# cozystack values.yaml overrides (target Service FQDN, mode,
	# Gateway-API gating). The cozystack-side fixtures in tests/
	# are the only ones CI should run.
	rm -rf charts/ouroboros/tests
