tegwick
f41d1b705f
Two-stage python:3.12-slim build with no toolchain in the runtime layer, running non-root (uid 10001) and writing nothing to disk — its state is the database. reference/ is a real build input, because the service delegates validation to it so the two cannot disagree about what a valid package is. Migrations deliberately do not run at start-up. A schema change is a deployment step with its own rollback, not something that races between replicas. tools/smoke.py asserts what can be known about a running service: liveness, readiness, fleet health shape, migration revision, and that the index and registry are queryable. stdlib only, so it runs inside the runtime image; non-zero exit, so a deployment gate can call it directly. Verified by running it, not by inspection: the container starts, all six checks pass against it, the reference CLI installs a package from it over HTTP, and the checks fail correctly against a wrong --expect-migration — so migration-at-head is a real check rather than a decorative one. Without --expect-migration the check can only confirm the schema is stamped at all, and says so rather than implying it verified the head. Cluster-level checks a rapp contract also names — NetworkPolicies present, external secrets ready, private-Service-only, live image digest match — are properties of the deployment and belong to rapp-canned-prompts. The digest rapp.yaml would pin does not exist yet. The image was built locally and verified, but never pushed; that digest exists only once the image is published to the fleet registry, which needs credentials and is outward-facing enough not to do unasked. The follow-on sequence for rapp-canned-prompts is recorded in the workplan. CANP-WP-0006 is finished. Service tests 33, reference 105. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
28 lines
770 B
Makefile
28 lines
770 B
Makefile
# Service build and verification. Run from `service/`.
|
|
IMAGE ?= canned-prompts-service
|
|
TAG ?= dev
|
|
BASE ?= http://127.0.0.1:8000
|
|
HEAD := $(shell .venv/bin/alembic heads 2>/dev/null | awk '{print $$1}')
|
|
|
|
.PHONY: test image smoke migrate run head
|
|
|
|
test:
|
|
.venv/bin/python -m pytest -q
|
|
|
|
image:
|
|
cd .. && docker build -f service/Dockerfile -t $(IMAGE):$(TAG) .
|
|
|
|
head:
|
|
@echo $(HEAD)
|
|
|
|
migrate:
|
|
.venv/bin/alembic upgrade head
|
|
|
|
run:
|
|
.venv/bin/uvicorn canned_prompts_service.api:create_app --factory
|
|
|
|
# The service-level half of a rapp smoke contract. Cluster-level checks
|
|
# (NetworkPolicies, external secrets, private-Service-only) belong to
|
|
# rapp-canned-prompts, which can call this for the rest.
|
|
smoke:
|
|
python3 tools/smoke.py --base $(BASE) --expect-migration $(HEAD)
|