Makefile: best practices

1 files changed, 40 insertions, 14 deletions

diff --git a/Makefile b/Makefile
index 4975dcc..703f44b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,11 +1,30 @@
 # Various one-liners which I'm too lazy to remember.
 # Basically a collection of really small shell scripts.
 
-MAKEFLAGS += --warn-undefined-variables
-SHELL := bash
-.SHELLFLAGS := -eu -o pipefail -c
+MAKEFLAGS += --no-builtin-rules --no-builtin-variables --warn-undefined-variables
+unexport MAKEFLAGS
 .DEFAULT_GOAL := all
+.DELETE_ON_ERROR:
 .SUFFIXES:
+SHELL := bash
+.SHELLFLAGS := -eu -o pipefail -c
+
+.PHONY: DO
+DO:
+
+escape = $(subst ','\'',$(1))
+
+define noexpand
+ifeq ($$(origin $(1)),environment)
+    $(1) := $$(value $(1))
+endif
+ifeq ($$(origin $(1)),environment override)
+    $(1) := $$(value $(1))
+endif
+ifeq ($$(origin $(1)),command line)
+    override $(1) := $$(value $(1))
+endif
+endef
 
 PROJECT := cgitize
 # Enable buildx support:
@@ -17,7 +36,9 @@ BUILDX_VERSION := v0.4.2
 # Docker Hub credentials:
 DOCKER_USERNAME := egortensin
 
-curl := curl --silent --show-error --location --dump-header - --connect-timeout 20
+ifdef DOCKER_PASSWORD
+$(eval $(call noexpand,DOCKER_PASSWORD))
+endif
 
 .PHONY: all
 all: build
@@ -27,7 +48,7 @@ login:
 ifndef DOCKER_PASSWORD
 	$(error Please define DOCKER_PASSWORD)
 endif
-	@echo "$(DOCKER_PASSWORD)" | docker login --username "$(DOCKER_USERNAME)" --password-stdin
+	@echo '$(call escape,$(DOCKER_PASSWORD))' | docker login --username '$(call escape,$(DOCKER_USERNAME))' --password-stdin
 
 .PHONY: build
 # Build natively by default.
@@ -58,40 +79,45 @@ endif
 # Dockerfile's, create a manifest manually, etc.), so it's only here for
 # testing purposes, and native builds.
 docker/build: check-build
-	docker build -t "$(DOCKER_USERNAME)/$(PROJECT)" .
+	docker build -t '$(call escape,$(DOCKER_USERNAME))/$(call escape,$(PROJECT))' .
 
 .PHONY: docker/push
 # `docker push` would replace the multiarch repo with a single image by default
 # (you'd have to create a manifest and push it instead), so it's only here for
 # testing purposes.
 docker/push: check-push docker/build
-	docker push "$(DOCKER_USERNAME)/$(PROJECT)"
+	docker push '$(call escape,$(DOCKER_USERNAME))/$(call escape,$(PROJECT))'
 
 # The simple way to build multiarch repos is `docker buildx`.
 
+binfmt_image := docker/binfmt:66f9012c56a8316f9244ffd7622d7c21c1f6f28d
+
 .PHONY: fix-binfmt
-# Re-register binfmt_misc formats with the F flag (required e.g. on Bionic):
 fix-binfmt:
-	docker run --rm --privileged docker/binfmt:66f9012c56a8316f9244ffd7622d7c21c1f6f28d
+	docker run --rm --privileged '$(call escape,$(binfmt_image))'
+
+curl := curl --silent --show-error --location --dump-header - --connect-timeout 20
+
+buildx_url := https://github.com/docker/buildx/releases/download/$(BUILDX_VERSION)/buildx-$(BUILDX_VERSION).linux-amd64
 
 .PHONY: buildx/install
 buildx/install:
 	mkdir -p -- ~/.docker/cli-plugins/
-	$(curl) --output ~/.docker/cli-plugins/docker-buildx -- 'https://github.com/docker/buildx/releases/download/$(BUILDX_VERSION)/buildx-$(BUILDX_VERSION).linux-amd64'
+	$(curl) --output ~/.docker/cli-plugins/docker-buildx -- '$(call escape,$(buildx_url))'
 	chmod +x -- ~/.docker/cli-plugins/docker-buildx
 
 .PHONY: buildx/create
 buildx/create: fix-binfmt
-	docker buildx create --use --name "$(PROJECT)_builder"
+	docker buildx create --use --name '$(call escape,$(PROJECT))_builder'
 
 .PHONY: buildx/rm
 buildx/rm:
-	docker buildx rm "$(PROJECT)_builder"
+	docker buildx rm '$(call escape,$(PROJECT))_builder'
 
 .PHONY: buildx/build
 buildx/build:
-	docker buildx build -t "$(DOCKER_USERNAME)/$(PROJECT)" --platform "$(PLATFORMS)" --progress plain .
+	docker buildx build -t '$(call escape,$(DOCKER_USERNAME))/$(call escape,$(PROJECT))' --platform '$(call escape,$(PLATFORMS))' --progress plain .
 
 .PHONY: buildx/push
 buildx/push:
-	docker buildx build -t "$(DOCKER_USERNAME)/$(PROJECT)" --platform "$(PLATFORMS)" --progress plain --push .
+	docker buildx build -t '$(call escape,$(DOCKER_USERNAME))/$(call escape,$(PROJECT))' --platform '$(call escape,$(PLATFORMS))' --progress plain --push .