jpmschweitzerandClaude
57fa6c13fc
The hook carried ~50 lines of gitleaks logic and a comment explaining it was self-contained because "this repo has no Makefile". It has one now, so the reason is gone and the arrangement is backwards: a hook is a trigger, and logic belongs where it can be read, run by hand, and changed under review. .githooks/pre-push is now a byte-identical shim onto `make pre-push` in every repo in the workspace. The scan itself moves to ci/secrets.sh unchanged, and `make secrets` runs it on its own. The call surface is identical everywhere; what it runs is not, and should not be — each repo gates what it actually has. That is the point of standardising the name rather than the contents: nobody has to read a repo to find out how to check it. secrets runs first, deliberately. It is the only failure here that cannot be undone by fixing it afterwards — a failed lint costs another commit, a pushed credential is cached and indexed whether or not it is later deleted. Some of these gates fail today, on lint debt that predates them, and they are left wired anyway. The board was measured once and written down in T-56 instead of being worked around here. Narrowing each gate to whatever already passes would produce a gate that reports success for doing nothing, which is the failure this workspace keeps rediscovering. Co-Authored-By: Claude <noreply@anthropic.com>
75 lines
2.7 KiB
Makefile
75 lines
2.7 KiB
Makefile
.PHONY: help setup run test test-unit test-integration test-contracts lint typecheck clean
|
|
|
|
VENV := .venv
|
|
PYTHON := $(VENV)/bin/python
|
|
PIP := $(VENV)/bin/pip
|
|
PYTEST := $(VENV)/bin/pytest
|
|
RUFF := $(VENV)/bin/ruff
|
|
MYPY := $(VENV)/bin/mypy
|
|
UVICORN := $(VENV)/bin/uvicorn
|
|
|
|
HOST := 0.0.0.0
|
|
PORT := 8777
|
|
|
|
help: ## Show this help
|
|
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'
|
|
|
|
setup: ## Create venv and install all dependencies
|
|
python3 -m venv $(VENV)
|
|
$(PIP) install --upgrade pip
|
|
$(PIP) install -e ".[dev]"
|
|
|
|
run: ## Start the development server on port 8777
|
|
@mkdir -p build/logs
|
|
@if lsof -Pi :$(PORT) -sTCP:LISTEN -t >/dev/null 2>&1; then \
|
|
echo "Error: Port $(PORT) is already in use"; \
|
|
echo "Run: lsof -i :$(PORT) to see what's using it"; \
|
|
exit 1; \
|
|
fi
|
|
$(UVICORN) src.main:app --reload --host $(HOST) --port $(PORT) 2>&1 | tee build/logs/server.log
|
|
|
|
test: ## Run unit tests (no external services needed)
|
|
$(PYTEST) --ignore=tests/e2e --ignore=tests/integration --ignore=tests/contracts
|
|
|
|
test-unit: test ## Alias for test
|
|
|
|
test-integration: ## Run integration tests (needs Claude/Ollama)
|
|
$(PYTEST) tests/agents/test_tatlock_agent.py -v
|
|
|
|
test-contracts: ## Wire-level contract tests against live service boundaries
|
|
$(PYTEST) tests/contracts -v --no-cov
|
|
|
|
lint: ## Run ruff linter and formatter check
|
|
$(RUFF) check src tests
|
|
$(RUFF) format --check src tests
|
|
|
|
typecheck: ## Run mypy type checking
|
|
$(MYPY) src
|
|
|
|
clean: ## Remove build artifacts, caches, and coverage reports
|
|
rm -rf .cache build
|
|
find . -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true
|
|
|
|
# git hands a hook a non-login shell, which never sees ~/.local/bin — where
|
|
# gitleaks lands. Without this the scan reports "not installed" on every push,
|
|
# which is a check that fails open (D-24).
|
|
export PATH := $(HOME)/.local/bin:/usr/local/bin:$(PATH)
|
|
|
|
.PHONY: secrets
|
|
secrets: ## Scan the commits about to be pushed for credentials
|
|
@ci/secrets.sh
|
|
|
|
# The call surface is identical in every repo; what it runs is not.
|
|
#
|
|
# `secrets` runs first, deliberately: it is the only failure here that cannot be
|
|
# undone by fixing it afterwards. A failed lint costs another commit; a pushed
|
|
# credential is cached and indexed whether or not it is later deleted.
|
|
#
|
|
# Some of these fail today, and are left wired anyway. The state was measured
|
|
# once and written down in T-56 rather than being worked around here — a gate
|
|
# quietly narrowed to what already passes is a gate that reports success for
|
|
# doing nothing, which is the failure this workspace keeps rediscovering.
|
|
.PHONY: pre-push
|
|
pre-push: secrets lint typecheck ## Everything the pre-push hook runs
|
|
@echo " -- not gated here yet: test (T-56)"
|