jpmschweitzerandClaude Sonnet 5
3a3dc959be
`alembic/env.py` took its target from `get_settings().database_url`, composed from `.env`'s production `POSTGRES_*` values, so the most natural command in the repo — a bare `alembic current` — talked to production. `-x target=test` and `-x target=production` now name the database explicitly; anything else exits non-zero before any engine is built, and the one line it prints before migrating never shows a credential. `run_alembic` (tests/conftest.py) passes `-x target=test` and sets `TEST_DATABASE_URL` in the subprocess environment instead of overriding `POSTGRES_*` — the `_components()` shim is gone; nothing else used it. `make migrate-test`, `make migrate-production` and `make dev-test-server` are the three documented ways to reach either database now; `dev-test-server` refuses to start if the resolved database is not `core_api_test`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
97 lines
5.0 KiB
Makefile
97 lines
5.0 KiB
Makefile
# core-api — the repo's command surface (D-27).
|
|
#
|
|
# Paths resolve here rather than in callers (D-10). `python3` on this host is
|
|
# 3.8 and cannot parse these sources, and a bare `pytest` resolves only in a
|
|
# login shell — so both are named explicitly through the venv.
|
|
|
|
VENV := $(CURDIR)/.venv
|
|
PYTHON ?= python3.12
|
|
|
|
.DEFAULT_GOAL := help
|
|
|
|
.PHONY: help
|
|
help: ## Show this help
|
|
@grep -hE '^[a-z][a-z0-9_-]*:.*?## ' $(MAKEFILE_LIST) \
|
|
| awk 'BEGIN{FS=":.*?## "}{printf " \033[36m%-14s\033[0m %s\n", $$1, $$2}'
|
|
|
|
.PHONY: setup
|
|
setup: ## Create the venv, install dependencies, and prove the result is usable
|
|
$(PYTHON) -m venv .venv
|
|
$(VENV)/bin/pip install -r requirements.txt -r dev-requirements.txt
|
|
# Exit 0 from pip install is not evidence (D-24) — it is the step's job not
|
|
# to fail, so a broken result and a working one look identical from here.
|
|
# On 2026-08-09 the venv existed and pip had exited 0, but sqlalchemy was
|
|
# declared in requirements.txt and not installed; that surfaced as 11
|
|
# pytest collection errors that read as broken imports, not as a setup
|
|
# problem. `--collect-only` exercises every import the suite touches
|
|
# without running a single test, so it catches exactly that class of
|
|
# drift and stays cheap. `pip check` was considered too, but it only
|
|
# verifies the *installed* set's internal consistency against itself —
|
|
# it would not have caught this case, because sqlalchemy was still
|
|
# present as another package's transitive dependency even when dropped
|
|
# from requirements.txt. collect-only checks declared-vs-actually-usable
|
|
# directly, which is the axis that broke.
|
|
$(VENV)/bin/python -m pytest --collect-only tests/
|
|
|
|
.PHONY: test
|
|
test: ## Run the test suite
|
|
@test -x $(VENV)/bin/python || { echo "FAIL — no venv; run: make setup"; exit 69; }
|
|
$(VENV)/bin/python -m pytest tests/
|
|
|
|
# Alembic refuses to run with no named target, or any other one (core-api
|
|
# T-3) — `alembic/env.py` exits before connecting rather than falling back
|
|
# to production. These three targets are the only documented way to reach
|
|
# either database.
|
|
|
|
.PHONY: migrate-test
|
|
migrate-test: ## Upgrade core_api_test (TEST_DATABASE_URL) to head
|
|
@test -x $(VENV)/bin/alembic || { echo "FAIL — no venv; run: make setup"; exit 69; }
|
|
$(VENV)/bin/alembic -x target=test upgrade head
|
|
|
|
.PHONY: migrate-production
|
|
migrate-production: ## The one documented way to migrate production: alembic -x target=production upgrade head
|
|
@test -x $(VENV)/bin/alembic || { echo "FAIL — no venv; run: make setup"; exit 69; }
|
|
@echo "migrate-production: about to run 'alembic -x target=production upgrade head' against the production database"
|
|
$(VENV)/bin/alembic -x target=production upgrade head
|
|
|
|
.PHONY: dev-test-server
|
|
dev-test-server: ## uvicorn on :8777 against core_api_test only (refuses on any other resolved database; never prints credentials)
|
|
@test -x $(VENV)/bin/python || { echo "FAIL — no venv; run: make setup"; exit 69; }
|
|
@url="$$TEST_DATABASE_URL"; \
|
|
if [ -z "$$url" ]; then url=$$(grep -m1 '^TEST_DATABASE_URL=' .env 2>/dev/null | cut -d= -f2-); fi; \
|
|
if [ -z "$$url" ]; then echo "FAIL — TEST_DATABASE_URL is not set (environment or .env)"; exit 69; fi; \
|
|
rest=$${url#postgresql://}; creds=$${rest%%@*}; hostdb=$${rest#*@}; \
|
|
puser=$${creds%%:*}; ppass=$${creds#*:}; phost=$${hostdb%%/*}; pdb=$${hostdb#*/}; \
|
|
if [ "$$pdb" != "core_api_test" ]; then echo "FAIL — resolved database is '$$pdb', not core_api_test; refusing to start"; exit 1; fi; \
|
|
echo "dev-test-server: database=$$pdb"; \
|
|
POSTGRES_HOST="$$phost" POSTGRES_USER="$$puser" POSTGRES_PASSWORD="$$ppass" POSTGRES_DATABASE="$$pdb" \
|
|
$(VENV)/bin/python -m uvicorn src.main:app --reload --host 0.0.0.0 --port 8777
|
|
|
|
# No `lint` target, deliberately. This repo configures no linter — no ruff or
|
|
# flake8 config, and neither in requirements. Per D-27 the name is reserved for
|
|
# repos that lint; an empty target here would report clean for something never
|
|
# run. Add the target when a linter is added, not before.
|
|
|
|
# git hands a hook a non-login shell, which never sees ~/.local/bin — where
|
|
# gitleaks lands. Without this the scan reports "not installed" on every push,
|
|
# which is a check that fails open (D-24).
|
|
export PATH := $(HOME)/.local/bin:/usr/local/bin:$(PATH)
|
|
|
|
.PHONY: secrets
|
|
secrets: ## Scan the commits about to be pushed for credentials
|
|
@ci/secrets.sh
|
|
|
|
# The call surface is identical in every repo; what it runs is not.
|
|
#
|
|
# `secrets` runs first, deliberately: it is the only failure here that cannot be
|
|
# undone by fixing it afterwards. A failed lint costs another commit; a pushed
|
|
# credential is cached and indexed whether or not it is later deleted.
|
|
#
|
|
# Some of these fail today, and are left wired anyway. The state was measured
|
|
# once and written down in T-56 rather than being worked around here — a gate
|
|
# quietly narrowed to what already passes is a gate that reports success for
|
|
# doing nothing, which is the failure this workspace keeps rediscovering.
|
|
.PHONY: pre-push
|
|
pre-push: secrets ## Everything the pre-push hook runs
|
|
@echo " -- not gated here yet: lint (no linter configured) and test (T-56)"
|