openrunner/Makefile at main · jqueguiner/openrunner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
.PHONY: install dev test lint format migrate migration up down logs up-prod build ps smoke artifact-smoke precommit-install precommit test-security deploy deploy-api deploy-web

install:
	cd src/api && uv pip install -e ".[dev]"

dev:
	cd src/api && uvicorn app.main:app --reload --host 0.0.0.0 --port 8000

test:
	cd src/api && .venv/bin/python -m pytest tests/ -x --tb=short -q

lint:
	cd src/api && ruff check . && ruff format --check .

format:
	cd src/api && ruff format .

migrate:
	cd src/api && alembic -c migrations/alembic.ini upgrade head

migration:
	cd src/api && alembic -c migrations/alembic.ini revision --autogenerate -m "$(msg)"

up:
	docker compose up -d

down:
	docker compose down

logs:
	docker compose logs -f

up-prod:
	docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d

build:
	docker compose build

ps:
	docker compose ps

# End-to-end self-host smoke: down -v -> up -d -> /health/full -> SDK run -> assert -> down -v.
# One-line PASS/FAIL with elapsed time on stdout. Targets <= 8 min wall-clock.
# Set SMOKE_KEEP=1 to leave the stack running after the run for triage.
smoke:
	@bash scripts/smoke.sh

# Artifact upload->download contract smoke (GLA-8): boots stack, registers a
# user, then runs sdk/tests/integration/test_artifact_round_trip.py against
# the live API. Set ARTIFACT_SMOKE_KEEP=1 to leave the stack up afterwards.
artifact-smoke:
	@bash scripts/artifact_smoke.sh

# ---------------------------------------------------------------------------
# Prod deploy (run ON the prod host, compose project `openrun`). merge != deploy:
# main is served by prebuilt images, so a merged change is live only after a
# rebuild + `up -d`. These targets encode the exact hand-flow (build with
# --network=host since compose build lacks it; up -d --no-deps runs migrations on
# api boot). NEVER `down -v` — that wipes volumes (user data). See CLAUDE.md.
# ---------------------------------------------------------------------------
COMPOSE_PROJECT ?= openrun

deploy-api:
	docker build --network=host -t openrun-api ./src/api
	docker compose -p $(COMPOSE_PROJECT) up -d --no-deps api
	@sleep 8
	@docker compose -p $(COMPOSE_PROJECT) exec -T api sh -c "cd /app && alembic -c migrations/alembic.ini current" | tail -1
	@curl -sf http://127.0.0.1:8000/api/v1/health >/dev/null && echo "api healthy" || (echo "API UNHEALTHY" && exit 1)

deploy-web:
	docker build --network=host --target runtime -t openrun-web:prod ./src/web
	docker compose -p $(COMPOSE_PROJECT) up -d --no-deps web
	@sleep 5
	@curl -sf -o /dev/null -w "web HTTP %{http_code}\n" http://127.0.0.1:3000/

# Full deploy: rebuild + restart api (runs migrations) and web, then verify.
deploy: deploy-api deploy-web
	@echo "deploy complete — api on migration head + healthy, web up."

# Secret-leakage guardrail (GLA-1111). See SECURITY.md "Secret-leakage detection".
precommit-install:
	@command -v pre-commit >/dev/null 2>&1 || pip install pre-commit
	pre-commit install
	@echo "pre-commit installed. Hooks run automatically on git commit."

# Run the full pre-commit sweep against the working tree.
precommit:
	pre-commit run --all-files

# Self-test that the secret-leakage guardrail blocks a synthetic leak.
test-security:
	@bash tests/security/test_precommit_catches_leak.sh