Makefile: best practices

1 files changed, 38 insertions, 16 deletions

diff --git a/Makefile b/Makefile
index 5356244..a9a743c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,11 +1,29 @@
 # Various one-liners which I'm too lazy to remember.
 # Basically a collection of really small shell scripts.
 
-MAKEFLAGS += --warn-undefined-variables
-SHELL := bash
-.SHELLFLAGS := -eu -o pipefail -c
+MAKEFLAGS += --no-builtin-rules --no-builtin-variables --warn-undefined-variables
 .DEFAULT_GOAL := all
+.DELETE_ON_ERROR:
 .SUFFIXES:
+SHELL := bash
+.SHELLFLAGS := -eu -o pipefail -c
+
+.PHONY: DO
+DO:
+
+escape = $(subst ','\'',$(1))
+
+define noexpand
+ifeq ($$(origin $(1)),environment)
+    $(1) := $$(value $(1))
+endif
+ifeq ($$(origin $(1)),environment override)
+    $(1) := $$(value $(1))
+endif
+ifeq ($$(origin $(1)),command line)
+    override $(1) := $$(value $(1))
+endif
+endef
 
 PROJECT := fr24feed
 # Use BuildKit, which is required:
@@ -23,20 +41,21 @@ BUILDX_VERSION := v0.4.2
 # Docker Hub credentials:
 DOCKER_USERNAME := egortensin
 
+ifdef DOCKER_PASSWORD
+$(eval $(call noexpand,DOCKER_PASSWORD))
+endif
+
 curl := curl --silent --show-error --location --dump-header - --connect-timeout 20
 
 .PHONY: all
 all: build
 
-.PHONY: DO
-DO:
-
 .PHONY: login
 login:
 ifndef DOCKER_PASSWORD
 	$(error Please define DOCKER_PASSWORD)
 endif
-	@echo "$(DOCKER_PASSWORD)" | docker login --username "$(DOCKER_USERNAME)" --password-stdin
+	@echo '$(call escape,$(DOCKER_PASSWORD))' | docker login --username '$(call escape,$(DOCKER_USERNAME))' --password-stdin
 
 .PHONY: build
 # Build natively by default.
@@ -78,7 +97,7 @@ endif
 # Dockerfile's, create a manifest manually, etc.), so it's only here for
 # testing purposes, and native builds.
 docker/build/%: DO check-build
-	docker build -t "$(DOCKER_USERNAME)/$*" "$*/"
+	docker build -t '$(call escape,$(DOCKER_USERNAME))/$*' '$*/'
 
 .PHONY: docker/build
 docker/build: docker/build/dump1090 docker/build/fr24feed
@@ -87,7 +106,7 @@ docker/build: docker/build/dump1090 docker/build/fr24feed
 # (you'd have to create a manifest and push it instead), so it's only here for
 # testing purposes.
 docker/push/%: DO check-push docker/build/%
-	docker push "$(DOCKER_USERNAME)/$*"
+	docker push '$(call escape,$(DOCKER_USERNAME))/$*'
 
 .PHONY: docker/push
 docker/push: check-push docker/push/dump1090 docker/push/fr24feed
@@ -95,7 +114,7 @@ docker/push: check-push docker/push/dump1090 docker/push/fr24feed
 .PHONY: compose/install
 # Quickly install a newer Compose version:
 compose/install:
-	$(curl) --output /usr/local/bin/docker-compose -- "https://github.com/docker/compose/releases/download/$(COMPOSE_VERSION)/docker-compose-$$(uname -s)-$$(uname -m)"
+	$(curl) --output /usr/local/bin/docker-compose -- 'https://github.com/docker/compose/releases/download/$(call escape,$(COMPOSE_VERSION))'"/docker-compose-$$(uname -s)-$$(uname -m)"
 	chmod +x -- /usr/local/bin/docker-compose
 
 .PHONY: compose/build
@@ -110,33 +129,36 @@ compose/push: check-push compose/build
 
 # The simple way to build multiarch repos is `docker buildx`.
 
+binfmt_image := docker/binfmt:66f9012c56a8316f9244ffd7622d7c21c1f6f28d
 .PHONY: fix-binfmt
 # Re-register binfmt_misc formats with the F flag (required e.g. on Bionic):
 fix-binfmt:
-	docker run --rm --privileged docker/binfmt:66f9012c56a8316f9244ffd7622d7c21c1f6f28d
+	docker run --rm --privileged '$(call escape,$(binfmt_image))'
+
+buildx_url := https://github.com/docker/buildx/releases/download/$(BUILDX_VERSION)/buildx-$(BUILDX_VERSION).linux-amd64
 
 .PHONY: buildx/install
 buildx/install:
 	mkdir -p -- ~/.docker/cli-plugins/
-	$(curl) --output ~/.docker/cli-plugins/docker-buildx -- 'https://github.com/docker/buildx/releases/download/$(BUILDX_VERSION)/buildx-$(BUILDX_VERSION).linux-amd64'
+	$(curl) --output ~/.docker/cli-plugins/docker-buildx -- '$(call escape,$(buildx_url))'
 	chmod +x -- ~/.docker/cli-plugins/docker-buildx
 
 .PHONY: buildx/create
 buildx/create: fix-binfmt
-	docker buildx create --use --name "$(PROJECT)_builder"
+	docker buildx create --use --name '$(call escape,$(PROJECT))_builder'
 
 .PHONY: buildx/rm
 buildx/rm:
-	docker buildx rm "$(PROJECT)_builder"
+	docker buildx rm '$(call escape,$(PROJECT))_builder'
 
 buildx/build/%: DO
-	docker buildx build -t "$(DOCKER_USERNAME)/$*" --platform "$(PLATFORMS)" "$*/"
+	docker buildx build -t '$(call escape,$(DOCKER_USERNAME))/$*' --platform '$(call escape,$(PLATFORMS))' '$*/'
 
 .PHONY: buildx/build
 buildx/build: buildx/build/dump1090 buildx/build/fr24feed
 
 buildx/push/%: DO
-	docker buildx build -t "$(DOCKER_USERNAME)/$*" --platform "$(PLATFORMS)" --push "$*/"
+	docker buildx build -t '$(call escape,$(DOCKER_USERNAME))/$*' --platform '$(call escape,$(PLATFORMS))' --push '$*/'
 
 .PHONY: buildx/push
 buildx/push: buildx/push/dump1090 buildx/push/fr24feed