4 Commits

Include renames

Author	SHA1	Message	Date
jpmschweitzer	78d9b276ee	build(make): prove make setup actually works before exiting 0 (T-47) ... pip install exiting 0 is not evidence the gateway environment is usable (D-24) — a resolved-but-broken dependency or a stale venv from another Python both look identical to a clean install at the point setup exits. End the target with a cheap positive check instead: collect the test suite (imports every src module each test pulls in) and confirm ruff and mypy resolve inside the venv, the only place either binary exists. Also states explicitly, in a comment, that setup covers the gateway half only — the firmware half needs `source ~/esp-idf/export.sh` in every shell, which a Makefile recipe cannot leave sourced in the caller's shell, so build-firmware sources it itself instead.	2026-08-17 12:04:12 +02:00
jpmschweitzerandClaude	7846e48595	build(ci): move the pre-push gate into the Makefile ... The hook carried ~50 lines of gitleaks logic and a comment explaining it was self-contained because "this repo has no Makefile". It has one now, so the reason is gone and the arrangement is backwards: a hook is a trigger, and logic belongs where it can be read, run by hand, and changed under review. .githooks/pre-push is now a byte-identical shim onto `make pre-push` in every repo in the workspace. The scan itself moves to ci/secrets.sh unchanged, and `make secrets` runs it on its own. The call surface is identical everywhere; what it runs is not, and should not be — each repo gates what it actually has. That is the point of standardising the name rather than the contents: nobody has to read a repo to find out how to check it. secrets runs first, deliberately. It is the only failure here that cannot be undone by fixing it afterwards — a failed lint costs another commit, a pushed credential is cached and indexed whether or not it is later deleted. Some of these gates fail today, on lint debt that predates them, and they are left wired anyway. The board was measured once and written down in T-56 instead of being worked around here. Narrowing each gate to whatever already passes would produce a gate that reports success for doing nothing, which is the failure this workspace keeps rediscovering. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-09 18:57:22 +02:00
jpmschweitzerandClaude	5297249e58	ci(make): reserve exit 69 for "could not run" (D-26) ... Environment guards now exit 69 rather than 1, so a caller can tell a suite that could not start from one that ran and failed. The first toj test sweep reported "3 repositories failed" and none of the three had executed a test — two could not find go, one had no venv. That points the reader at the tests when the fault is in the environment. Only the environment guards change. A gitleaks finding, a failed test run and a vulncheck hit still exit 1, because those did run and did fail. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-09 15:56:25 +02:00
jpmschweitzerandClaude	2ef00c98de	build: add the root Makefile the previous commit should have carried ... ff19320 removed gateway/Makefile but the git add that was meant to stage its replacement aborted on an already-staged pathspec, so the deletion landed alone and main briefly had no Makefile at all. This is the other half. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-09 15:04:43 +02:00