jpmschweitzerandClaude
b1cb3eb899
Twelve tests in test_database_integration.py carry @pytest.mark.integration and need a real Postgres. The marker was registered in pytest.ini and used correctly on the file — but `make test` never deselected it and no target ever selected it. So those tests neither ran nor passed: they errored on every invocation, and `make test` exited 2 permanently, which teaches a reader that the exit code means nothing. That is worse than either running them or not having them. `make test` is now hermetic per D-26 — 164 passed, 19 deselected, exit 0, verified inside an unprivileged network namespace as well as outside. WHY THE AUDIT MISSED THIS, which is the part worth keeping. T-55 measured each suite with and without a network and treated identical results as proof of no live dependency. These twelve fail identically both ways, because postgres-shared is a Docker-internal name that a host process cannot resolve in either condition. A namespace proves a test does not reach the network; it cannot distinguish that from a test whose dependency is unreachable regardless. The positive control was run against a host that WAS reachable, so it never covered this case. The new target refuses an empty selection: pytest exit 5 fails with its own message and a collection error gets a different one, so "nothing to run" can never be read as "everything passed". Mutation-checked — anchor asserted unique, marker renamed, target failed at exit 2 with the intended message, Makefile restored byte-identical. It reports honestly when Postgres is absent rather than skipping: 6 passed, 1 skipped, 12 errors from this host, which is the true state. Co-Authored-By: Claude <noreply@anthropic.com>
94 lines
4.7 KiB
Makefile
94 lines
4.7 KiB
Makefile
# scheduler — the repo's command surface (D-27).
|
|
#
|
|
# There is no venv in this working tree today, even though CLAUDE.md documents
|
|
# `.venv/bin/python -m pytest`. `make test` says so rather than failing with a
|
|
# bare "No such file or directory", and `make setup` creates one.
|
|
#
|
|
# `python3` on this host is 3.8; PYTHON names 3.12 explicitly (D-26).
|
|
|
|
VENV := $(CURDIR)/.venv
|
|
PYTHON ?= python3.12
|
|
|
|
.DEFAULT_GOAL := help
|
|
|
|
.PHONY: help
|
|
help: ## Show this help
|
|
@grep -hE '^[a-z][a-z0-9_-]*:.*?## ' $(MAKEFILE_LIST) \
|
|
| awk 'BEGIN{FS=":.*?## "}{printf " \033[36m%-14s\033[0m %s\n", $$1, $$2}'
|
|
|
|
.PHONY: setup
|
|
setup: ## Create the venv, install the test extra, and prove it actually works
|
|
$(PYTHON) -m venv .venv
|
|
$(VENV)/bin/pip install -e ".[test]"
|
|
@# Exit 0 from `pip install` is not evidence (D-24) — pip reports success even
|
|
@# when the result is unusable. Prove the environment works instead of trusting
|
|
@# the install step: `--collect-only` imports every test module and therefore
|
|
@# every src module each one pulls in, which is exactly the failure mode this
|
|
@# target exists to catch (T-47 — this repo had no venv at all on 2026-08-09,
|
|
@# and the documented test command could not work). It runs zero tests, so it
|
|
@# stays cheap, and unlike a bare `import src.main` it exercises the tests/
|
|
@# tree too, not just the package.
|
|
$(VENV)/bin/python -m pytest tests/ --collect-only -q
|
|
|
|
.PHONY: test
|
|
test: ## Run the test suite — hermetic, no live services (D-26)
|
|
@test -x $(VENV)/bin/python || { echo "FAIL — no venv in this tree; run: make setup"; exit 69; }
|
|
# Integration tests are deselected here, not skipped by accident. Twelve
|
|
# tests in test_database_integration.py carry @pytest.mark.integration and
|
|
# need a real Postgres; they errored on every run of this target because
|
|
# nothing deselected them, and the marker had no target to select it either.
|
|
# So they neither passed nor ran — they just made `make test` exit 2 forever,
|
|
# which trains a reader to ignore the exit code (T-55).
|
|
#
|
|
# They were invisible to the netns audit that found the rest of this: they
|
|
# fail identically with and without a network, because postgres-shared is a
|
|
# Docker-internal name a host process cannot resolve in either case. A
|
|
# namespace proves a test does not reach the network; it cannot tell that
|
|
# apart from a test whose dependency is unreachable anyway.
|
|
$(VENV)/bin/python -m pytest tests/ -m "not integration"
|
|
|
|
.PHONY: test-integration
|
|
test-integration: ## Run only the tests that need live Postgres/Redis
|
|
@test -x $(VENV)/bin/python || { echo "FAIL — no venv in this tree; run: make setup"; exit 69; }
|
|
# Refuses an empty selection. A target that passes because it selected
|
|
# nothing is the defect this repo keeps meeting from the other side, so
|
|
# pytest's exit 5 (no tests collected) is a failure with its own message,
|
|
# and a collection error gets a different one — "nothing to run" must never
|
|
# read as "everything passed" (D-24).
|
|
@$(VENV)/bin/python -m pytest tests/ -m integration --collect-only -q >/dev/null 2>&1; \
|
|
rc=$$?; \
|
|
if [ $$rc -eq 5 ]; then \
|
|
echo "FAIL test-integration — selected 0 tests (marker renamed, moved, or lost — this is a defect, not a pass)"; exit 1; \
|
|
elif [ $$rc -ne 0 ]; then \
|
|
echo "FAIL test-integration — collection errored (rc=$$rc)"; exit 1; \
|
|
fi
|
|
$(VENV)/bin/python -m pytest tests/ -m integration -v
|
|
|
|
# No `lint` target, deliberately. CLAUDE.md states it outright: no linter is
|
|
# configured, no ruff or flake8 config, neither in the dependencies. Per D-27
|
|
# the name is reserved for repos that lint rather than mandated everywhere — a
|
|
# target here could only fail or report clean for something never run.
|
|
|
|
# git hands a hook a non-login shell, which never sees ~/.local/bin — where
|
|
# gitleaks lands. Without this the scan reports "not installed" on every push,
|
|
# which is a check that fails open (D-24).
|
|
export PATH := $(HOME)/.local/bin:/usr/local/bin:$(PATH)
|
|
|
|
.PHONY: secrets
|
|
secrets: ## Scan the commits about to be pushed for credentials
|
|
@ci/secrets.sh
|
|
|
|
# The call surface is identical in every repo; what it runs is not.
|
|
#
|
|
# `secrets` runs first, deliberately: it is the only failure here that cannot be
|
|
# undone by fixing it afterwards. A failed lint costs another commit; a pushed
|
|
# credential is cached and indexed whether or not it is later deleted.
|
|
#
|
|
# Some of these fail today, and are left wired anyway. The state was measured
|
|
# once and written down in T-56 rather than being worked around here — a gate
|
|
# quietly narrowed to what already passes is a gate that reports success for
|
|
# doing nothing, which is the failure this workspace keeps rediscovering.
|
|
.PHONY: pre-push
|
|
pre-push: secrets ## Everything the pre-push hook runs
|
|
@echo " -- not gated here yet: lint (no linter configured) and test (T-56)"
|