tegwick
d710bf0088
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
32 lines
1.4 KiB
Makefile
32 lines
1.4 KiB
Makefile
SHELL := /usr/bin/env bash
|
|
.DEFAULT_GOAL := test
|
|
|
|
IMAGE ?= forgejo.coulomb.social/coulomb/approval-engine
|
|
VERSION ?= 0.1.0
|
|
# trivy is the sanctioned scanner (operator decision, 2026-09-06).
|
|
TRIVY ?= aquasec/trivy:latest
|
|
|
|
test: ## Run unit tests
|
|
python3 -m pytest -q
|
|
|
|
image-build: ## Build the production image locally
|
|
docker build -f Containerfile -t approval-engine:local -t $(IMAGE):$(VERSION) .
|
|
|
|
image-scan: ## Scan the built image; fails on any CRITICAL or HIGH finding
|
|
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock $(TRIVY) \
|
|
image --scanners vuln --severity CRITICAL,HIGH \
|
|
--exit-code 1 $(IMAGE):$(VERSION)
|
|
|
|
image-release: image-build image-scan ## Build, scan, then push. Push only runs if the scan passes.
|
|
docker push $(IMAGE):$(VERSION)
|
|
@echo "Pin this digest in deploy/approval-engine.yaml (never the tag):"
|
|
@docker inspect --format '{{index .RepoDigests 0}}' $(IMAGE):$(VERSION)
|
|
|
|
deploy-dry-run: ## Validate Kubernetes manifests without applying them
|
|
kubectl apply --dry-run=client -f deploy/approval-engine.yaml -f deploy/networkpolicies.yaml -f deploy/keycape-ingress.yaml
|
|
|
|
help: ## Show this help
|
|
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} \
|
|
/^[a-zA-Z_-]+:.*?##/ { printf " \033[36m%-24s\033[0m %s\n", $$1, $$2 }' $(MAKEFILE_LIST)
|
|
|
|
.PHONY: test image-build image-scan image-release deploy-dry-run help
|