canned-prompts/service/Makefile

29 lines
770 B
Makefile
Raw Normal View History

CANP-WP-0006 T06: container image and smoke checks Two-stage python:3.12-slim build with no toolchain in the runtime layer, running non-root (uid 10001) and writing nothing to disk — its state is the database. reference/ is a real build input, because the service delegates validation to it so the two cannot disagree about what a valid package is. Migrations deliberately do not run at start-up. A schema change is a deployment step with its own rollback, not something that races between replicas. tools/smoke.py asserts what can be known about a running service: liveness, readiness, fleet health shape, migration revision, and that the index and registry are queryable. stdlib only, so it runs inside the runtime image; non-zero exit, so a deployment gate can call it directly. Verified by running it, not by inspection: the container starts, all six checks pass against it, the reference CLI installs a package from it over HTTP, and the checks fail correctly against a wrong --expect-migration — so migration-at-head is a real check rather than a decorative one. Without --expect-migration the check can only confirm the schema is stamped at all, and says so rather than implying it verified the head. Cluster-level checks a rapp contract also names — NetworkPolicies present, external secrets ready, private-Service-only, live image digest match — are properties of the deployment and belong to rapp-canned-prompts. The digest rapp.yaml would pin does not exist yet. The image was built locally and verified, but never pushed; that digest exists only once the image is published to the fleet registry, which needs credentials and is outward-facing enough not to do unasked. The follow-on sequence for rapp-canned-prompts is recorded in the workplan. CANP-WP-0006 is finished. Service tests 33, reference 105. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
2026-09-06 21:25:48 +02:00
# Service build and verification. Run from `service/`.
IMAGE ?= canned-prompts-service
TAG ?= dev
BASE ?= http://127.0.0.1:8000
HEAD := $(shell .venv/bin/alembic heads 2>/dev/null | awk '{print $$1}')
.PHONY: test image smoke migrate run head
test:
.venv/bin/python -m pytest -q
image:
cd .. && docker build -f service/Dockerfile -t $(IMAGE):$(TAG) .
head:
@echo $(HEAD)
migrate:
.venv/bin/alembic upgrade head
run:
.venv/bin/uvicorn canned_prompts_service.api:create_app --factory
# The service-level half of a rapp smoke contract. Cluster-level checks
# (NetworkPolicies, external secrets, private-Service-only) belong to
# rapp-canned-prompts, which can call this for the rest.
smoke:
python3 tools/smoke.py --base $(BASE) --expect-migration $(HEAD)