# This is the Coder Makefile. The build directory for most tasks is `build/`.

#

# These are the targets you're probably looking for:

# - clean

# - build-fat: builds all "fat" binaries for all architectures

# - build-slim: builds all "slim" binaries (no frontend or slim binaries

# embedded) for all architectures

# - release: simulate a release (mostly, does not push images)

# - build/coder(-slim)?_${os}_${arch}(.exe)?: build a single fat binary

# - build/coder_${os}_${arch}.(zip|tar.gz): build a release archive

# - build/coder_linux_${arch}.(apk|deb|rpm): build a release Linux package

# - build/coder_${version}_linux_${arch}.tag: build a release Linux Docker image

# - build/coder_helm.tgz: build a release Helm chart

.DEFAULT_GOAL := build-fat

# Use a single bash shell for each job, and immediately exit on failure

SHELL := bash

.SHELLFLAGS := -ceu

.ONESHELL:

# When MAKE_TIMED=1, replace SHELL with a wrapper that prints

# elapsed wall-clock time for each recipe. pre-commit and pre-push

# set this on their sub-makes so every parallel job reports its

# duration. Ad-hoc usage: make MAKE_TIMED=1 test

ifdef MAKE_TIMED

SHELL := $(CURDIR)/scripts/lib/timed-shell.sh

.SHELLFLAGS = $@ -ceu

export MAKE_TIMED

export MAKE_LOGDIR

endif

# This doesn't work on directories.

# See https://stackoverflow.com/questions/25752543/make-delete-on-error-for-directory-targets

.DELETE_ON_ERROR:

# Protect git-tracked generated files from deletion on interrupt.

# .DELETE_ON_ERROR is desirable for most targets but for files that

# are committed to git and serve as inputs to other rules, deletion

# is worse than a stale file — `git restore` is the recovery path.

.PRECIOUS: \

coderd/database/dump.sql \

coderd/database/querier.go \

coderd/database/unique_constraint.go \

coderd/database/dbmetrics/querymetrics.go \

coderd/database/dbauthz/dbauthz.go \

coderd/database/dbmock/dbmock.go \

coderd/database/pubsub/psmock/psmock.go \

agent/agentcontainers/acmock/acmock.go \

coderd/httpmw/loggermw/loggermock/loggermock.go \

codersdk/workspacesdk/agentconnmock/agentconnmock.go \

tailnet/tailnettest/coordinatormock.go \

tailnet/tailnettest/coordinateemock.go \

tailnet/tailnettest/workspaceupdatesprovidermock.go \

tailnet/tailnettest/subscriptionmock.go \

coderd/aibridged/aibridgedmock/clientmock.go \

coderd/aibridged/aibridgedmock/poolmock.go \

tailnet/proto/tailnet.pb.go \

agent/proto/agent.pb.go \

agent/agentsocket/proto/agentsocket.pb.go \

agent/boundarylogproxy/codec/boundary.pb.go \

provisionersdk/proto/provisioner.pb.go \

provisionerd/proto/provisionerd.pb.go \

vpn/vpn.pb.go \

coderd/aibridged/proto/aibridged.pb.go \

site/src/api/typesGenerated.ts \

site/e2e/provisionerGenerated.ts \

site/src/api/chatModelOptionsGenerated.json \

site/src/api/rbacresourcesGenerated.ts \

site/src/api/countriesGenerated.ts \

site/src/theme/icons.json \

examples/examples.gen.json \

docs/manifest.json \

docs/admin/integrations/prometheus.md \

docs/admin/security/audit-logs.md \

docs/reference/cli/index.md \

coderd/apidoc/swagger.json \

coderd/rbac/object_gen.go \

coderd/rbac/scopes_constants_gen.go \

codersdk/rbacresources_gen.go \

codersdk/apikey_scopes_gen.go

# atomic_write runs a command, captures stdout into a temp file, and

# atomically replaces $@. An optional second argument is a formatting

# command that receives the temp file path as its argument.

# Usage: $(call atomic_write,GENERATE_CMD[,FORMAT_CMD])

define atomic_write

tmpdir=$$(mktemp -d -p _gen) && tmpfile=$$(realpath "$$tmpdir")/$(notdir $@) && \

$(1) > "$$tmpfile" && \

$(if $(2),$(2) "$$tmpfile" &&) \

mv "$$tmpfile" "$@" && rm -rf "$$tmpdir"

endef

# CLI doc generation reflects over the assembled CLI tree. Track command

# definitions plus the top-level SDK types they expose in help text and flag

# values, without pulling in unrelated generated sources.

CLIDOC_SRC_FILES := \

$(shell find ./cli ./enterprise/cli -type f -name '*.go' -not -name '*_test.go') \

$(wildcard codersdk/*.go) \

$(wildcard buildinfo/*.go)

CLIDOCGEN_INPUTS := \

$(wildcard scripts/clidocgen/*.go) \

scripts/clidocgen/command.tpl \

$(CLIDOC_SRC_FILES)

# Helper binaries that import repo packages need their compile-time inputs on

# the binary target. Most generated outputs keep these binaries as order-only

# prereqs, so stale binaries otherwise survive source changes.

RBAC_GO_FILES := \

$(wildcard coderd/rbac/*.go) \

$(wildcard coderd/rbac/policy/*.go)

DBDUMP_INPUTS := \

$(wildcard coderd/database/migrations/*.go) \

$(wildcard coderd/database/migrations/*.sql)

# Exclude generated RBAC files to avoid cycles with typegen outputs. The

# output rules still order generated RBAC prerequisites where needed.

TYPEGEN_RBAC_GO_FILES := \

$(filter-out coderd/rbac/%_gen.go,$(wildcard coderd/rbac/*.go)) \

$(wildcard coderd/rbac/policy/*.go)

TYPEGEN_INPUTS := \

$(wildcard scripts/typegen/*.go) \

$(wildcard scripts/typegen/*.gotmpl) \

$(wildcard scripts/typegen/*.tstmpl) \

$(TYPEGEN_RBAC_GO_FILES) \

$(wildcard coderd/util/strings/*.go) \

codersdk/countries.go

# Helper binary targets. Built with go build -o to avoid caching

# link-stage executables in GOCACHE. Each binary is a real Make

# target so parallel -j builds serialize correctly instead of

# racing on the same output path.

_gen/bin/apitypings: $(wildcard scripts/apitypings/*.go) $(wildcard codersdk/*.go) | _gen

@mkdir -p _gen/bin

go build -o $@ ./scripts/apitypings

_gen/bin/auditdocgen: $(wildcard scripts/auditdocgen/*.go) $(wildcard enterprise/audit/*.go) | _gen

@mkdir -p _gen/bin

go build -o $@ ./scripts/auditdocgen

_gen/bin/check-scopes: $(wildcard scripts/check-scopes/*.go) $(RBAC_GO_FILES) | _gen

@mkdir -p _gen/bin

go build -o $@ ./scripts/check-scopes

# clidocgen reflects over the full CLI tree, so it must rebuild when its

# command definitions, flag types, or embedded template change.

_gen/bin/clidocgen: $(CLIDOCGEN_INPUTS) | _gen

@mkdir -p _gen/bin

go build -o $@ ./scripts/clidocgen

_gen/bin/dbdump: $(wildcard coderd/database/gen/dump/*.go) $(DBDUMP_INPUTS) | _gen

@mkdir -p _gen/bin

go build -o $@ ./coderd/database/gen/dump

_gen/bin/examplegen: $(wildcard scripts/examplegen/*.go) | _gen

@mkdir -p _gen/bin

go build -o $@ ./scripts/examplegen

_gen/bin/gensite: $(wildcard scripts/gensite/*.go) | _gen

@mkdir -p _gen/bin

go build -o $@ ./scripts/gensite

_gen/bin/apikeyscopesgen: $(wildcard scripts/apikeyscopesgen/*.go) $(RBAC_GO_FILES) | _gen

@mkdir -p _gen/bin

go build -o $@ ./scripts/apikeyscopesgen

_gen/bin/aibridgepricesgen: $(wildcard scripts/aibridgepricesgen/*.go) | _gen

@mkdir -p _gen/bin

go build -o $@ ./scripts/aibridgepricesgen

_gen/bin/metricsdocgen: $(wildcard scripts/metricsdocgen/*.go) | _gen

@mkdir -p _gen/bin

go build -o $@ ./scripts/metricsdocgen

_gen/bin/metricsdocgen-scanner: $(wildcard scripts/metricsdocgen/scanner/*.go) | _gen

@mkdir -p _gen/bin

go build -o $@ ./scripts/metricsdocgen/scanner

_gen/bin/modeloptionsgen: $(wildcard scripts/modeloptionsgen/*.go) $(wildcard codersdk/*.go) | _gen

@mkdir -p _gen/bin

go build -o $@ ./scripts/modeloptionsgen

_gen/bin/typegen: $(TYPEGEN_INPUTS) | _gen

@mkdir -p _gen/bin

go build -o $@ ./scripts/typegen

# Shared temp directory for atomic writes. Lives at the project root

# so all targets share the same filesystem, and is gitignored.

# Order-only prerequisite: recipes that need it depend on | _gen

_gen:

mkdir -p _gen

# Don't print the commands in the file unless you specify VERBOSE. This is

# essentially the same as putting "@" at the start of each line.

ifndef VERBOSE

.SILENT:

endif

# Create the output directories if they do not exist.

$(shell mkdir -p build site/out/bin)

GOOS := $(shell go env GOOS)

GOARCH := $(shell go env GOARCH)

GOOS_BIN_EXT := $(if $(filter windows, $(GOOS)),.exe,)

VERSION := $(shell ./scripts/version.sh)

POSTGRES_VERSION ?= 17

POSTGRES_IMAGE ?= us-docker.pkg.dev/coder-v2-images-public/public/postgres:$(POSTGRES_VERSION)

# Limit parallel Make jobs in pre-commit/pre-push. Defaults to

# nproc/4 (min 2) since test, lint, and build targets have internal

# parallelism. Override: make pre-push PARALLEL_JOBS=8

PARALLEL_JOBS ?= $(shell n=$$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 8); echo $$(( n / 4 > 2 ? n / 4 : 2 )))

# Use the highest ZSTD compression level in release builds to

# minimize artifact size. For non-release CI builds (e.g. main

# branch preview), use multithreaded level 6 which is ~99% faster

# at the cost of ~30% larger archives.

ifeq ($(CODER_RELEASE),true)

ZSTDFLAGS := -22 --ultra

else

ZSTDFLAGS := -6 -T0

endif

# Common paths to exclude from find commands, this rule is written so

# that it can be it can be used in a chain of AND statements (meaning

# you can simply write `find . $(FIND_EXCLUSIONS) -name thing-i-want`).

# Note, all find statements should be written with `.` or `./path` as

# the search path so that these exclusions match.

FIND_EXCLUSIONS= \

-not \( \( -path '*/.git/*' -o -path './build/*' -o -path './vendor/*' -o -path './.coderv2/*' -o -path '*/node_modules/*' -o -path '*/out/*' -o -path './coderd/apidoc/*' -o -path '*/.next/*' -o -path '*/.terraform/*' -o -path './_gen/*' \) -prune \)

# Source files used for make targets, evaluated on use.

GO_SRC_FILES := $(shell find . $(FIND_EXCLUSIONS) -type f -name '*.go' -not -name '*_test.go')

# All the shell files in the repo, excluding ignored files.

SHELL_SRC_FILES := $(shell find . $(FIND_EXCLUSIONS) -type f -name '*.sh')

MIGRATION_FILES := $(shell find ./coderd/database/migrations/ -maxdepth 1 $(FIND_EXCLUSIONS) -type f -name '*.sql')

FIXTURE_FILES := $(shell find ./coderd/database/migrations/testdata/fixtures/ $(FIND_EXCLUSIONS) -type f -name '*.sql')

# Ensure we don't use the user's git configs which might cause side-effects

GIT_FLAGS = GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null

# All ${OS}_${ARCH} combos we build for. Windows binaries have the .exe suffix.

OS_ARCHES := \

linux_amd64 linux_arm64 linux_armv7 \

darwin_amd64 darwin_arm64 \

windows_amd64.exe windows_arm64.exe

# Archive formats and their corresponding ${OS}_${ARCH} combos.

ARCHIVE_TAR_GZ := linux_amd64 linux_arm64 linux_armv7

ARCHIVE_ZIP := \

darwin_amd64 darwin_arm64 \

windows_amd64 windows_arm64

# All package formats we build and the ${OS}_${ARCH} combos we build them for.

PACKAGE_FORMATS := apk deb rpm

PACKAGE_OS_ARCHES := linux_amd64 linux_armv7 linux_arm64

# All architectures we build Docker images for (Linux only).

DOCKER_ARCHES := amd64 arm64 armv7

# Computed variables based on the above.

CODER_SLIM_BINARIES := $(addprefix build/coder-slim_$(VERSION)_,$(OS_ARCHES))

CODER_FAT_BINARIES := $(addprefix build/coder_$(VERSION)_,$(OS_ARCHES))

CODER_ALL_BINARIES := $(CODER_SLIM_BINARIES) $(CODER_FAT_BINARIES)

CODER_TAR_GZ_ARCHIVES := $(foreach os_arch, $(ARCHIVE_TAR_GZ), build/coder_$(VERSION)_$(os_arch).tar.gz)

CODER_ZIP_ARCHIVES := $(foreach os_arch, $(ARCHIVE_ZIP), build/coder_$(VERSION)_$(os_arch).zip)

CODER_ALL_ARCHIVES := $(CODER_TAR_GZ_ARCHIVES) $(CODER_ZIP_ARCHIVES)

CODER_ALL_PACKAGES := $(foreach os_arch, $(PACKAGE_OS_ARCHES), $(addprefix build/coder_$(VERSION)_$(os_arch).,$(PACKAGE_FORMATS)))

CODER_ARCH_IMAGES := $(foreach arch, $(DOCKER_ARCHES), build/coder_$(VERSION)_linux_$(arch).tag)

CODER_ARCH_IMAGES_PUSHED := $(addprefix push/, $(CODER_ARCH_IMAGES))

CODER_MAIN_IMAGE := build/coder_$(VERSION)_linux.tag

CODER_SLIM_NOVERSION_BINARIES := $(addprefix build/coder-slim_,$(OS_ARCHES))

CODER_FAT_NOVERSION_BINARIES := $(addprefix build/coder_,$(OS_ARCHES))

CODER_ALL_NOVERSION_IMAGES := $(foreach arch, $(DOCKER_ARCHES), build/coder_linux_$(arch).tag) build/coder_linux.tag

CODER_ALL_NOVERSION_IMAGES_PUSHED := $(addprefix push/, $(CODER_ALL_NOVERSION_IMAGES))

# If callers are only building Docker images and not the packages and archives,

# we can skip those prerequisites as they are not actually required and only

# specified to avoid concurrent write failures.

ifdef DOCKER_IMAGE_NO_PREREQUISITES

CODER_ARCH_IMAGE_PREREQUISITES :=

else

CODER_ARCH_IMAGE_PREREQUISITES := \

build/coder_$(VERSION)_%.apk \

build/coder_$(VERSION)_%.deb \

build/coder_$(VERSION)_%.rpm \

build/coder_$(VERSION)_%.tar.gz

endif

clean:

rm -rf build/ site/build/ site/out/

rm -rf _gen/bin

mkdir -p build/

git restore site/out/

.PHONY: clean

build-slim: $(CODER_SLIM_BINARIES)

.PHONY: build-slim

build-fat build-full build: $(CODER_FAT_BINARIES)

.PHONY: build-fat build-full build

release: $(CODER_FAT_BINARIES) $(CODER_ALL_ARCHIVES) $(CODER_ALL_PACKAGES) $(CODER_ARCH_IMAGES) build/coder_helm_$(VERSION).tgz

.PHONY: release

build/coder-slim_$(VERSION)_checksums.sha1: site/out/bin/coder.sha1

cp "$<" "$@"

site/out/bin/coder.sha1: $(CODER_SLIM_BINARIES)

pushd ./site/out/bin

openssl dgst -r -sha1 coder-* | tee coder.sha1

popd

build/coder-slim_$(VERSION).tar: build/coder-slim_$(VERSION)_checksums.sha1 $(CODER_SLIM_BINARIES)

pushd ./site/out/bin

tar cf "../../../build/$(@F)" coder-*

popd

# delete the uncompressed binaries from the embedded dir

rm -f site/out/bin/coder-*

site/out/bin/coder.tar.zst: build/coder-slim_$(VERSION).tar.zst

cp "$<" "$@"

build/coder-slim_$(VERSION).tar.zst: build/coder-slim_$(VERSION).tar

zstd $(ZSTDFLAGS) \

--force \

--long \

--no-progress \

-o "build/coder-slim_$(VERSION).tar.zst" \

"build/coder-slim_$(VERSION).tar"

# Redirect from version-less targets to the versioned ones. There is a similar

# target for slim binaries below.

#

# Called like this:

# make build/coder_linux_amd64

# make build/coder_windows_amd64.exe

$(CODER_FAT_NOVERSION_BINARIES): build/coder_%: build/coder_$(VERSION)_%

rm -f "$@"

ln "$<" "$@"

# Same as above, but for slim binaries.

#

# Called like this:

# make build/coder-slim_linux_amd64

# make build/coder-slim_windows_amd64.exe

$(CODER_SLIM_NOVERSION_BINARIES): build/coder-slim_%: build/coder-slim_$(VERSION)_%

rm -f "$@"

ln "$<" "$@"

# "fat" binaries always depend on the site and the compressed slim binaries.

$(CODER_FAT_BINARIES): \

site/out/index.html \

site/out/bin/coder.sha1 \

site/out/bin/coder.tar.zst

# This is a handy block that parses the target to determine whether it's "slim"

# or "fat", which OS was specified and which architecture was specified.

#

# It populates the following variables: mode, os, arch_ext, arch, ext (without

# dot).

define get-mode-os-arch-ext =

mode="$$([[ "$@" = build/coder-slim* ]] && echo "slim" || echo "fat")"

os="$$(echo $@ | cut -d_ -f3)"

arch_ext="$$(echo $@ | cut -d_ -f4)"

if [[ "$$arch_ext" == *.* ]]; then

arch="$$(echo $$arch_ext | cut -d. -f1)"

ext="$${arch_ext#*.}"

else

arch="$$arch_ext"

ext=""

fi

endef

# This task handles all builds, for both "fat" and "slim" binaries. It parses

# the target name to get the metadata for the build, so it must be specified in

# this format:

# build/coder(-slim)?_${version}_${os}_${arch}(.exe)?

#

# You should probably use the non-version targets above instead if you're

# calling this manually.

$(CODER_ALL_BINARIES): go.mod go.sum \

$(GO_SRC_FILES) \

$(shell find ./examples/templates) \

site/static/error.html

$(get-mode-os-arch-ext)

if [[ "$$os" != "windows" ]] && [[ "$$ext" != "" ]]; then

echo "ERROR: Invalid build binary extension" 1>&2

exit 1

fi

if [[ "$$os" == "windows" ]] && [[ "$$ext" != exe ]]; then

echo "ERROR: Windows binaries must have an .exe extension." 1>&2

exit 1

fi

build_args=( \

--os "$$os" \

--arch "$$arch" \

--version "$(VERSION)" \

--output "$@" \

)

if [ "$$mode" == "slim" ]; then

build_args+=(--slim)

fi

./scripts/build_go.sh "$${build_args[@]}"

if [[ "$$mode" == "slim" ]]; then

dot_ext=""

if [[ "$$ext" != "" ]]; then

dot_ext=".$$ext"

fi

cp "$@" "./site/out/bin/coder-$$os-$$arch$$dot_ext"

if [[ "$${CODER_SIGN_GPG:-0}" == "1" ]]; then

cp "$@.asc" "./site/out/bin/coder-$$os-$$arch$$dot_ext.asc"

fi

fi

# This task builds all archives. It parses the target name to get the metadata

# for the build, so it must be specified in this format:

# build/coder_${version}_${os}_${arch}.${format}

#

# The following OS/arch/format combinations are supported:

# .tar.gz: linux_amd64, linux_arm64, linux_armv7

# .zip: darwin_amd64, darwin_arm64, windows_amd64, windows_arm64

#

# This depends on all fat binaries because it's difficult to do dynamic

# dependencies due to the .exe requirement on Windows. These targets are

# typically only used during release anyways.

$(CODER_ALL_ARCHIVES): $(CODER_FAT_BINARIES)

$(get-mode-os-arch-ext)

bin_ext=""

if [[ "$$os" == "windows" ]]; then

bin_ext=".exe"

fi

./scripts/archive.sh \

--format "$$ext" \

--os "$$os" \

--output "$@" \

"build/coder_$(VERSION)_$${os}_$${arch}$${bin_ext}"

# This task builds all packages. It parses the target name to get the metadata

# for the build, so it must be specified in this format:

# build/coder_${version}_linux_${arch}.${format}

#

# Supports apk, deb, rpm for all linux targets.

#

# This depends on all Linux fat binaries and archives because it's difficult to

# do dynamic dependencies due to the extensions in the filenames. These targets

# are typically only used during release anyways.

#

# Packages need to run after the archives are built, otherwise they cause tar

# errors like "file changed as we read it".

CODER_PACKAGE_DEPS := $(foreach os_arch, $(PACKAGE_OS_ARCHES), build/coder_$(VERSION)_$(os_arch) build/coder_$(VERSION)_$(os_arch).tar.gz)

$(CODER_ALL_PACKAGES): $(CODER_PACKAGE_DEPS)

$(get-mode-os-arch-ext)

./scripts/package.sh \

--arch "$$arch" \

--format "$$ext" \

--version "$(VERSION)" \

--output "$@" \

"build/coder_$(VERSION)_$${os}_$${arch}"

# This task builds a Windows amd64 installer. Depends on makensis.

build/coder_$(VERSION)_windows_amd64_installer.exe: build/coder_$(VERSION)_windows_amd64.exe

./scripts/build_windows_installer.sh \

--version "$(VERSION)" \

--output "$@" \

"$<"

# Redirect from version-less Docker image targets to the versioned ones.

#

# Called like this:

# make build/coder_linux_amd64.tag

$(CODER_ALL_NOVERSION_IMAGES): build/coder_%: build/coder_$(VERSION)_%

.PHONY: $(CODER_ALL_NOVERSION_IMAGES)

# Redirect from version-less push Docker image targets to the versioned ones.

#

# Called like this:

# make push/build/coder_linux_amd64.tag

$(CODER_ALL_NOVERSION_IMAGES_PUSHED): push/build/coder_%: push/build/coder_$(VERSION)_%

.PHONY: $(CODER_ALL_NOVERSION_IMAGES_PUSHED)

# This task builds all Docker images. It parses the target name to get the

# metadata for the build, so it must be specified in this format:

# build/coder_${version}_${os}_${arch}.tag

#

# Supports linux_amd64, linux_arm64, linux_armv7.

#

# Images need to run after the archives and packages are built, otherwise they

# cause errors like "file changed as we read it".

$(CODER_ARCH_IMAGES): build/coder_$(VERSION)_%.tag: build/coder_$(VERSION)_% $(CODER_ARCH_IMAGE_PREREQUISITES)

$(get-mode-os-arch-ext)

image_tag="$$(./scripts/image_tag.sh --arch "$$arch" --version "$(VERSION)")"

./scripts/build_docker.sh \

--arch "$$arch" \

--target "$$image_tag" \

--version "$(VERSION)" \

"build/coder_$(VERSION)_$${os}_$${arch}"

echo "$$image_tag" > "$@"

# Multi-arch Docker image. This requires all architecture-specific images to be

# built AND pushed.

$(CODER_MAIN_IMAGE): $(CODER_ARCH_IMAGES_PUSHED)

image_tag="$$(./scripts/image_tag.sh --version "$(VERSION)")"

./scripts/build_docker_multiarch.sh \

--target "$$image_tag" \

--version "$(VERSION)" \

$(foreach img, $^, "$$(cat "$(img:push/%=%)")")

echo "$$image_tag" > "$@"

# Push a Docker image.

$(CODER_ARCH_IMAGES_PUSHED): push/%: %

image_tag="$$(cat "$<")"

docker push "$$image_tag"

.PHONY: $(CODER_ARCH_IMAGES_PUSHED)

# Push the multi-arch Docker manifest.

push/$(CODER_MAIN_IMAGE): $(CODER_MAIN_IMAGE)

image_tag="$$(cat "$<")"

docker manifest push "$$image_tag"

.PHONY: push/$(CODER_MAIN_IMAGE)

# Helm charts that are available

charts = coder provisioner

# Shortcut for Helm chart package.

$(foreach chart,$(charts),build/$(chart)_helm.tgz): build/%_helm.tgz: build/%_helm_$(VERSION).tgz

rm -f "$@"

ln "$<" "$@"

# Helm chart package.

$(foreach chart,$(charts),build/$(chart)_helm_$(VERSION).tgz): build/%_helm_$(VERSION).tgz:

./scripts/helm.sh \

--version "$(VERSION)" \

--chart $* \

--output "$@"

node_modules/.installed: package.json pnpm-lock.yaml

./scripts/pnpm_install.sh

touch "$@"

offlinedocs/node_modules/.installed: offlinedocs/package.json offlinedocs/pnpm-lock.yaml

(cd offlinedocs/ && ../scripts/pnpm_install.sh)

touch "$@"

site/node_modules/.installed: site/package.json site/pnpm-lock.yaml

(cd site/ && ../scripts/pnpm_install.sh)

touch "$@"

scripts/apidocgen/node_modules/.installed: scripts/apidocgen/package.json scripts/apidocgen/pnpm-lock.yaml

(cd scripts/apidocgen && ../../scripts/pnpm_install.sh)

touch "$@"

SITE_GEN_FILES := \

site/src/api/typesGenerated.ts \

site/src/api/rbacresourcesGenerated.ts \

site/src/api/countriesGenerated.ts \

site/src/api/chatModelOptionsGenerated.json \

site/src/theme/icons.json

site/out/index.html: \

site/node_modules/.installed \

site/static/install.sh \

$(SITE_GEN_FILES) \

$(shell find ./site $(FIND_EXCLUSIONS) -type f \( -name '*.ts' -o -name '*.tsx' \))

cd site/

# prevents this directory from getting to big, and causing "too much data" errors

rm -rf out/assets/

pnpm build

offlinedocs/out/index.html: offlinedocs/node_modules/.installed $(shell find ./offlinedocs $(FIND_EXCLUSIONS) -type f) $(shell find ./docs $(FIND_EXCLUSIONS) -type f | sed 's: :\\ :g')

cd offlinedocs/

../scripts/pnpm_install.sh

pnpm export

build/coder_docs_$(VERSION).tgz: offlinedocs/out/index.html

tar -czf "$@" -C offlinedocs/out .

install: build/coder_$(VERSION)_$(GOOS)_$(GOARCH)$(GOOS_BIN_EXT)

install_dir="$$(go env GOPATH)/bin"

output_file="$${install_dir}/coder$(GOOS_BIN_EXT)"

mkdir -p "$$install_dir"

cp "$<" "$$output_file"

.PHONY: install

# Only wildcard the go files in the develop directory to avoid rebuilds

# when project files are changd. Technically changes to some imports may

# not be detected, but it's unlikely to cause any issues.

build/.bin/develop: go.mod go.sum $(wildcard scripts/develop/*.go)

CGO_ENABLED=0 go build -o $@ ./scripts/develop

BOLD := $(shell tput bold 2>/dev/null)

GREEN := $(shell tput setaf 2 2>/dev/null)

RED := $(shell tput setaf 1 2>/dev/null)

YELLOW := $(shell tput setaf 3 2>/dev/null)

DIM := $(shell tput dim 2>/dev/null || tput setaf 8 2>/dev/null)

RESET := $(shell tput sgr0 2>/dev/null)

fmt: fmt/ts fmt/go fmt/terraform fmt/shfmt fmt/biome fmt/markdown

.PHONY: fmt

# Subset of fmt that does not require Go or Node toolchains.

fmt-light: fmt/shfmt fmt/terraform fmt/markdown

.PHONY: fmt-light

fmt/go:

ifdef FILE

# Format single file

if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.go ]] && ! grep -q "DO NOT EDIT" "$(FILE)"; then \

echo "$(GREEN)==>$(RESET) $(BOLD)fmt/go$(RESET) $(FILE)"; \

./scripts/format_go_file.sh "$(FILE)"; \

fi

else

go mod tidy

echo "$(GREEN)==>$(RESET) $(BOLD)fmt/go$(RESET)"

# VS Code users should check out

# https://github.com/mvdan/gofumpt#visual-studio-code

find . $(FIND_EXCLUSIONS) -type f -name '*.go' -print0 | \

xargs -0 grep -E --null -L '^// Code generated .* DO NOT EDIT\.$$' | \

xargs -0 ./scripts/format_go_file.sh

endif

.PHONY: fmt/go

fmt/ts: site/node_modules/.installed

ifdef FILE

# Format single TypeScript/JavaScript file

if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.ts ]] || [[ "$(FILE)" == *.tsx ]] || [[ "$(FILE)" == *.js ]] || [[ "$(FILE)" == *.jsx ]]; then \

echo "$(GREEN)==>$(RESET) $(BOLD)fmt/ts$(RESET) $(FILE)"; \

(cd site/ && pnpm exec biome format --write "../$(FILE)"); \

fi

else

echo "$(GREEN)==>$(RESET) $(BOLD)fmt/ts$(RESET)"

cd site

# Avoid writing files in CI to reduce file write activity

ifdef CI

pnpm run check --linter-enabled=false

else

pnpm run check:fix

endif

endif

.PHONY: fmt/ts

fmt/biome: site/node_modules/.installed

ifdef FILE

# Format single file with biome

if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.ts ]] || [[ "$(FILE)" == *.tsx ]] || [[ "$(FILE)" == *.js ]] || [[ "$(FILE)" == *.jsx ]]; then \

echo "$(GREEN)==>$(RESET) $(BOLD)fmt/biome$(RESET) $(FILE)"; \

(cd site/ && pnpm exec biome format --write "../$(FILE)"); \

fi

else

echo "$(GREEN)==>$(RESET) $(BOLD)fmt/biome$(RESET)"

cd site/

# Avoid writing files in CI to reduce file write activity

ifdef CI

pnpm run format:check

else

pnpm run format

endif

endif

.PHONY: fmt/biome

fmt/terraform: $(wildcard *.tf)

ifdef FILE

# Format single Terraform file

if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.tf ]] || [[ "$(FILE)" == *.tfvars ]]; then \

echo "$(GREEN)==>$(RESET) $(BOLD)fmt/terraform$(RESET) $(FILE)"; \

terraform fmt "$(FILE)"; \

fi

else

echo "$(GREEN)==>$(RESET) $(BOLD)fmt/terraform$(RESET)"

terraform fmt -recursive

endif

.PHONY: fmt/terraform

fmt/shfmt: $(SHELL_SRC_FILES)

ifdef FILE

# Format single shell script

if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.sh ]]; then \

echo "$(GREEN)==>$(RESET) $(BOLD)fmt/shfmt$(RESET) $(FILE)"; \

shfmt -w "$(FILE)"; \

fi

else

echo "$(GREEN)==>$(RESET) $(BOLD)fmt/shfmt$(RESET)"

# Only do diff check in CI, errors on diff.

ifdef CI

shfmt -d $(SHELL_SRC_FILES)

else

shfmt -w $(SHELL_SRC_FILES)

endif

endif

.PHONY: fmt/shfmt

fmt/markdown: node_modules/.installed

ifdef FILE

# Format single markdown file

if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.md ]]; then \

echo "$(GREEN)==>$(RESET) $(BOLD)fmt/markdown$(RESET) $(FILE)"; \

pnpm exec markdown-table-formatter "$(FILE)"; \

fi

else

echo "$(GREEN)==>$(RESET) $(BOLD)fmt/markdown$(RESET)"

pnpm format-docs

endif

.PHONY: fmt/markdown

# Note: we don't run zizmor in the lint target because it takes a while.

# GitHub Actions linters are run in a separate CI job (lint-actions) that only

# triggers when workflow files change, so we skip them here when CI=true.

LINT_ACTIONS_TARGETS := $(if $(CI),,lint/actions/actionlint)

lint: lint/shellcheck lint/go lint/ts lint/examples lint/helm lint/site-icons lint/markdown lint/check-scopes lint/migrations lint/bootstrap lint/architecture lint/emdash lint/agents $(LINT_ACTIONS_TARGETS)

.PHONY: lint

# Subset of lint that does not require Go or Node toolchains.

lint-light: lint/shellcheck lint/markdown lint/helm lint/bootstrap lint/migrations lint/actions/actionlint lint/typos lint/emdash

.PHONY: lint-light

lint/site-icons:

./scripts/check_site_icons.sh

.PHONY: lint/site-icons

lint/ts: site/node_modules/.installed

cd site/

pnpm lint

.PHONY: lint/ts

lint/go:

linter_ver=$$(grep -Eo '^golangci-lint = "[^"]+"' mise.toml | sed -E 's/.*"([^"]+)"/\1/')

go run github.com/golangci/golangci-lint/cmd/golangci-lint@v$$linter_ver run

go tool github.com/coder/paralleltestctx/cmd/paralleltestctx -custom-funcs="testutil.Context,chatdTestContext" ./...

go run ./scripts/intxcheck ./...

.PHONY: lint/go

lint/examples: | _gen/bin/examplegen

_gen/bin/examplegen -lint

.PHONY: lint/examples

# Use shfmt to determine the shell files, takes editorconfig into consideration.

lint/shellcheck: $(SHELL_SRC_FILES)

echo "--- shellcheck"

shellcheck --external-sources $(SHELL_SRC_FILES)

.PHONY: lint/shellcheck

lint/bootstrap:

bash scripts/check_bootstrap_quotes.sh

.PHONY: lint/bootstrap

lint/emdash:

bash scripts/check_emdash.sh

.PHONY: lint/emdash

lint/architecture:

./scripts/check_architecture.sh

.PHONY: lint/architecture

lint/agents:

./scripts/check_agents_structure.sh

.PHONY: lint/agents

lint/helm:

cd helm/

make lint

.PHONY: lint/helm

lint/markdown: node_modules/.installed

pnpm lint-docs

.PHONY: lint/markdown

lint/actions: lint/actions/actionlint lint/actions/zizmor

.PHONY: lint/actions

lint/actions/actionlint:

go tool github.com/rhysd/actionlint/cmd/actionlint

.PHONY: lint/actions/actionlint

lint/actions/zizmor:

./scripts/zizmor.sh \

--strict-collection \

--persona=regular \

.

.PHONY: lint/actions/zizmor

# Verify api_key_scope enum contains all RBAC <resource>:<action> values.

lint/check-scopes: coderd/database/dump.sql | _gen/bin/check-scopes

_gen/bin/check-scopes

.PHONY: lint/check-scopes

# Verify migrations do not hardcode the public schema.

lint/migrations:

./scripts/check_pg_schema.sh "Migrations" $(MIGRATION_FILES)

./scripts/check_pg_schema.sh "Fixtures" $(FIXTURE_FILES)

.PHONY: lint/migrations

TYPOS_VERSION := $(shell grep -oP 'crate-ci/typos@\S+\s+\#\s+v\K[0-9.]+' .github/workflows/ci.yaml)

# Map uname values to typos release asset names.

TYPOS_ARCH := $(shell uname -m)

# typos release assets use aarch64, but macOS ARM reports arm64 via uname -m.

ifeq ($(TYPOS_ARCH),arm64)

TYPOS_ARCH := aarch64

endif

ifeq ($(shell uname -s),Darwin)

TYPOS_OS := apple-darwin

else

TYPOS_OS := unknown-linux-musl

endif

build/typos-$(TYPOS_VERSION):

mkdir -p build/

curl -sSfL "https://github.com/crate-ci/typos/releases/download/v$(TYPOS_VERSION)/typos-v$(TYPOS_VERSION)-$(TYPOS_ARCH)-$(TYPOS_OS).tar.gz" \

| tar -xzf - -C build/ ./typos

mv build/typos "$@"

lint/typos: build/typos-$(TYPOS_VERSION)

build/typos-$(TYPOS_VERSION) --config .github/workflows/typos.toml

.PHONY: lint/typos

# pre-commit and pre-push mirror CI checks locally.

#

# pre-commit runs checks that don't need external services (Docker,

# Playwright). This is the git pre-commit hook default since Docker

# and browser issues in the local environment would otherwise block

# all commits.

#

# pre-push adds heavier checks: Go tests, JS tests, and site build.

# The pre-push hook is allowlisted, see scripts/githooks/pre-push.

#

# pre-commit uses two phases: gen+fmt first, then lint+build. This

# avoids races where gen creates temporary .go files that lint's

# find-based checks pick up. Within each phase, targets run in

# parallel via -j. It fails if any tracked files have unstaged

# changes afterward.

define check-unstaged

unstaged="$$(git diff --name-only)"

if [[ -n $$unstaged ]]; then

echo "$(RED)✗ check unstaged changes$(RESET)"

echo "$$unstaged" | sed 's/^/ - /'

echo ""

echo "$(DIM) Verify generated changes are correct before staging:$(RESET)"

echo "$(DIM) git diff$(RESET)"

echo "$(DIM) git add -u && git commit$(RESET)"

exit 1

fi

endef

define check-untracked

untracked=$$(git ls-files --other --exclude-standard)

if [[ -n $$untracked ]]; then

echo "$(YELLOW)? check untracked files$(RESET)"

echo "$$untracked" | sed 's/^/ - /'

echo ""

echo "$(DIM) Review if these should be committed or added to .gitignore.$(RESET)"

fi

endef

pre-commit:

start=$$(date +%s)

logdir=$$(mktemp -d "$${TMPDIR:-/tmp}/coder-pre-commit.XXXXXX")

echo "$(BOLD)pre-commit$(RESET) ($$logdir)"

echo "gen + fmt:"

$(MAKE) --no-print-directory -j$(PARALLEL_JOBS) MAKE_TIMED=1 MAKE_LOGDIR=$$logdir gen fmt

$(check-unstaged)

echo "lint + build:"

$(MAKE) --no-print-directory -j$(PARALLEL_JOBS) MAKE_TIMED=1 MAKE_LOGDIR=$$logdir \

lint \

lint/typos \

build/coder-slim_$(GOOS)_$(GOARCH)$(GOOS_BIN_EXT)

$(check-unstaged)

$(check-untracked)

rm -rf $$logdir

echo "$(GREEN)✓ pre-commit passed$(RESET) ($$(( $$(date +%s) - $$start ))s)"

.PHONY: pre-commit

# Lightweight pre-commit for changes that don't touch Go or

# TypeScript. Skips gen, lint/go, lint/ts, fmt/go, fmt/ts, and

# the binary build. Used by the pre-commit hook when only docs,

# shell, terraform, helm, or other fast-to-check files changed.

pre-commit-light:

start=$$(date +%s)

logdir=$$(mktemp -d "$${TMPDIR:-/tmp}/coder-pre-commit-light.XXXXXX")

echo "$(BOLD)pre-commit-light$(RESET) ($$logdir)"

echo "fmt:"

$(MAKE) --no-print-directory -j$(PARALLEL_JOBS) MAKE_TIMED=1 MAKE_LOGDIR=$$logdir fmt-light

$(check-unstaged)

echo "lint:"

$(MAKE) --no-print-directory -j$(PARALLEL_JOBS) MAKE_TIMED=1 MAKE_LOGDIR=$$logdir lint-light

$(check-unstaged)

$(check-untracked)

rm -rf $$logdir

echo "$(GREEN)✓ pre-commit-light passed$(RESET) ($$(( $$(date +%s) - $$start ))s)"

.PHONY: pre-commit-light

pre-push:

start=$$(date +%s)

logdir=$$(mktemp -d "$${TMPDIR:-/tmp}/coder-pre-push.XXXXXX")

echo "$(BOLD)pre-push$(RESET) ($$logdir)"

test -d site/node_modules/.cache/storybook || (cd site/ && pnpm exec node scripts/warmup-storybook-cache.mjs)

echo "test + build site:"

$(MAKE) --no-print-directory -j$(PARALLEL_JOBS) MAKE_TIMED=1 MAKE_LOGDIR=$$logdir \

test \

test-js \

site/out/index.html

# Storybook tests run after Go tests and the site build to avoid

# CPU starvation. Rolldown's tokio workers in Vite's transform

# pipeline stall when competing with Go compilation and the

# production build, causing browser import() calls to hang

# indefinitely (vitest has no import-phase timeout).

echo "test storybook:"

$(MAKE) --no-print-directory MAKE_TIMED=1 MAKE_LOGDIR=$$logdir \

test-storybook

rm -rf $$logdir

echo "$(GREEN)✓ pre-push passed$(RESET) ($$(( $$(date +%s) - $$start ))s)"

.PHONY: pre-push

offlinedocs/check: offlinedocs/node_modules/.installed

cd offlinedocs/

pnpm format:check

pnpm lint

pnpm export

.PHONY: offlinedocs/check

# All files generated by the database should be added here, and this can be used

# as a target for jobs that need to run after the database is generated.

DB_GEN_FILES := \

coderd/database/dump.sql \

coderd/database/querier.go \

coderd/database/unique_constraint.go \

coderd/database/dbmetrics/querymetrics.go \

coderd/database/dbauthz/dbauthz.go \

coderd/database/dbmock/dbmock.go

TAILNETTEST_MOCKS := \

tailnet/tailnettest/coordinatormock.go \

tailnet/tailnettest/coordinateemock.go \

tailnet/tailnettest/workspaceupdatesprovidermock.go \

tailnet/tailnettest/subscriptionmock.go

AIBRIDGED_MOCKS := \

coderd/aibridged/aibridgedmock/clientmock.go \

coderd/aibridged/aibridgedmock/poolmock.go

GEN_FILES := \

tailnet/proto/tailnet.pb.go \

agent/proto/agent.pb.go \

agent/agentsocket/proto/agentsocket.pb.go \

agent/boundarylogproxy/codec/boundary.pb.go \

provisionersdk/proto/provisioner.pb.go \

provisionerd/proto/provisionerd.pb.go \

vpn/vpn.pb.go \

coderd/aibridged/proto/aibridged.pb.go \

$(DB_GEN_FILES) \

$(SITE_GEN_FILES) \

coderd/rbac/object_gen.go \

codersdk/rbacresources_gen.go \

coderd/rbac/scopes_constants_gen.go \

codersdk/apikey_scopes_gen.go \

docs/admin/integrations/prometheus.md \

docs/reference/cli/index.md \

docs/admin/security/audit-logs.md \

coderd/apidoc/swagger.json \

docs/manifest.json \

provisioner/terraform/testdata/version \

scripts/metricsdocgen/generated_metrics \

site/e2e/provisionerGenerated.ts \

examples/examples.gen.json \

$(TAILNETTEST_MOCKS) \

coderd/database/pubsub/psmock/psmock.go \

agent/agentcontainers/acmock/acmock.go \

agent/agentcontainers/dcspec/dcspec_gen.go \

coderd/httpmw/loggermw/loggermock/loggermock.go \

codersdk/workspacesdk/agentconnmock/agentconnmock.go \

$(AIBRIDGED_MOCKS)

# all gen targets should be added here and to gen/mark-fresh

# Set GEN_SKIP_GOLDEN=1 to skip gen/golden-files (which needs Docker to

# start PostgreSQL via testcontainers).

GEN_SKIP_GOLDEN ?=

gen: gen/db $(if $(GEN_SKIP_GOLDEN),,gen/golden-files) $(GEN_FILES)

.PHONY: gen