tegwick
9aa2ac6cdd
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
142 lines
5.3 KiB
Makefile
142 lines
5.3 KiB
Makefile
SHELL := /usr/bin/env bash
|
|
.DEFAULT_GOAL := help
|
|
|
|
GITEA_RELEASE ?= forgejo
|
|
GITEA_NAMESPACE ?= forgejo
|
|
GITEA_CHART ?= gitea-charts/gitea
|
|
GITEA_VALUES ?= helm/gitea-values.sops.yaml
|
|
GITEA_REGISTRY_VALUES ?= helm/gitea-registry-values.yaml
|
|
GITEA_INGRESS ?= manifests/gitea-ingress.yaml
|
|
GITEA_HTTP_SERVICE ?= forgejo-gitea-http
|
|
GITEA_SSH_SERVICE ?= forgejo-ssh-nodeport
|
|
GITEA_DB_CLUSTER ?= forgejo-db
|
|
GITEA_DB_NAMESPACE ?= databases
|
|
REGISTRY_DOCS ?= docs/gitea-container-registry.md docs/gitea-package-registry.md
|
|
EVIDENCE_DOCS ?= docs/observability-operating-evidence.md docs/ci-runner-actions-gitops-ownership.md docs/backup-restore-secret-handoff.md
|
|
RUNNER_DOCS ?= docs/gitea-actions-runner-substrate.md docs/gitea-actions-runner-evidence.md
|
|
SOPS_SENTINEL ?= $(GITEA_VALUES)
|
|
|
|
##@ Operator checks
|
|
|
|
check-tools: ## Check local tools used by forge operator targets
|
|
@missing=0; \
|
|
for tool in kubectl helm sops; do \
|
|
if command -v $$tool >/dev/null 2>&1; then \
|
|
echo "ok: $$tool"; \
|
|
else \
|
|
echo "missing: $$tool"; \
|
|
missing=1; \
|
|
fi; \
|
|
done; \
|
|
if command -v tea >/dev/null 2>&1; then \
|
|
echo "ok: tea"; \
|
|
else \
|
|
echo "optional: tea not found"; \
|
|
fi; \
|
|
exit $$missing
|
|
|
|
check-sops: ## Verify the configured SOPS sentinel can decrypt
|
|
sops -d $(SOPS_SENTINEL) >/dev/null
|
|
|
|
registry-docs: ## Print canonical registry docs
|
|
@for doc in $(REGISTRY_DOCS); do \
|
|
printf '\n## %s\n\n' "$$doc"; \
|
|
sed -n '1,220p' "$$doc"; \
|
|
done
|
|
|
|
evidence-docs: ## Print forge evidence and handoff contracts
|
|
@for doc in $(EVIDENCE_DOCS); do \
|
|
printf '\n## %s\n\n' "$$doc"; \
|
|
sed -n '1,260p' "$$doc"; \
|
|
done
|
|
|
|
runner-docs: ## Print Forgejo Actions runner substrate docs and evidence
|
|
@for doc in $(RUNNER_DOCS); do \
|
|
printf '\n## %s\n\n' "$$doc"; \
|
|
sed -n '1,260p' "$$doc"; \
|
|
done
|
|
|
|
runner-status: ## Read-only Actions runner, host, and inter-hub registry probes
|
|
bash tools/gitea-runner-status.sh
|
|
|
|
forgejo-runner-status: ## Read-only Forgejo Actions runner and endpoint probes
|
|
bash tools/forgejo-runner-status.sh
|
|
|
|
forge-observe: ## Capture non-secret forge capacity, recovery, and allocation evidence
|
|
python3 tools/observe_forge_resources.py \
|
|
$(if $(REMOTE),--remote $(REMOTE),) \
|
|
--output-dir docs/evidence/resource-railiance-forgejo/observations
|
|
|
|
test-unit: ## Run non-live forge evidence tests
|
|
python3 -m unittest discover -s tests -p 'test_*.py' -v
|
|
|
|
check-runner-tools: ## Check local tools used by runner inspection targets
|
|
@missing=0; \
|
|
for tool in curl ssh docker; do \
|
|
if command -v $$tool >/dev/null 2>&1; then \
|
|
echo "ok: $$tool"; \
|
|
else \
|
|
echo "missing: $$tool"; \
|
|
missing=1; \
|
|
fi; \
|
|
done; \
|
|
for tool in skopeo act_runner; do \
|
|
if command -v $$tool >/dev/null 2>&1; then \
|
|
echo "ok: $$tool"; \
|
|
else \
|
|
echo "optional: $$tool not found"; \
|
|
fi; \
|
|
done; \
|
|
exit $$missing
|
|
|
|
##@ Current Forgejo (target names keep the legacy gitea- prefix)
|
|
|
|
gitea-deploy: ## Deploy / upgrade the Forgejo runtime via the Gitea chart (review first: live source is railiance-apps forgejo-values)
|
|
helm upgrade --install $(GITEA_RELEASE) $(GITEA_CHART) \
|
|
-f <(sops -d $(GITEA_VALUES)) \
|
|
-f $(GITEA_REGISTRY_VALUES) \
|
|
--namespace $(GITEA_NAMESPACE) --create-namespace
|
|
|
|
gitea-ingress-deploy: ## Apply the public Forgejo HTTPS ingress
|
|
kubectl apply -f $(GITEA_INGRESS)
|
|
|
|
forgejo-status: gitea-status ## Read-only status for Forgejo runtime and database (alias)
|
|
|
|
gitea-status: ## Read-only status for Forgejo runtime and database
|
|
kubectl get pods -n $(GITEA_NAMESPACE) -l app.kubernetes.io/instance=$(GITEA_RELEASE)
|
|
kubectl get svc -n $(GITEA_NAMESPACE) $(GITEA_HTTP_SERVICE) --ignore-not-found
|
|
kubectl get svc -n $(GITEA_NAMESPACE) $(GITEA_SSH_SERVICE) --ignore-not-found
|
|
kubectl get ingress -n $(GITEA_NAMESPACE) $(GITEA_RELEASE) --ignore-not-found
|
|
@if kubectl cnpg status $(GITEA_DB_CLUSTER) -n $(GITEA_DB_NAMESPACE) >/dev/null 2>&1; then \
|
|
kubectl cnpg status $(GITEA_DB_CLUSTER) -n $(GITEA_DB_NAMESPACE); \
|
|
else \
|
|
echo "kubectl cnpg plugin not available; falling back to cnpg resources"; \
|
|
kubectl get cluster $(GITEA_DB_CLUSTER) -n $(GITEA_DB_NAMESPACE); \
|
|
kubectl get pods -n $(GITEA_DB_NAMESPACE) -l cnpg.io/cluster=$(GITEA_DB_CLUSTER); \
|
|
fi
|
|
|
|
##@ Help
|
|
|
|
help: ## Show this help
|
|
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} \
|
|
/^[a-zA-Z0-9_-]+:.*?##/ { printf " \033[36m%-20s\033[0m %s\n", $$1, $$2 } \
|
|
/^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST)
|
|
|
|
.PHONY: check-tools check-sops registry-docs evidence-docs runner-docs runner-status forgejo-runner-status forge-observe test-unit check-runner-tools gitea-deploy gitea-ingress-deploy gitea-status forgejo-status help
|
|
|
|
##@ Secret detection
|
|
|
|
GO ?= go
|
|
|
|
test-secret-detection: ## Verify receive-path refusal with an explicitly admitted test scanner
|
|
@test -n "$${FORGE_TEST_GITLEAKS:-}" || { echo "FORGE_TEST_GITLEAKS must name the admitted test binary" >&2; exit 2; }
|
|
cd tools/receive-secret-scan && $(GO) test -count=1 ./...
|
|
|
|
.PHONY: test-secret-detection
|
|
|
|
# CUST-WP-0079-T05: staged-source generation; hook uses the isolated recipe.
|
|
.PHONY: generated-work-records generated-work-records-check
|
|
generated-work-records:
|
|
$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records
|
|
generated-work-records-check:
|
|
$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check
|