-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathMakefile
More file actions
159 lines (124 loc) · 8.02 KB
/
Copy pathMakefile
File metadata and controls
159 lines (124 loc) · 8.02 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
# Defines the canonical local and CI commands for building and validating AncestryLLM.
SHELL := /bin/bash
VENV_DIR ?= .venv
UV_TOOL_DIR := .tools/uv
UV_RECEIPT := .tools/receipts/uv-bootstrap.json
DIST_DIR ?= dist
UV_BUILD_REPORT ?= build/uv-build-evaluation.json
SBOM_OUTPUT ?= sbom.json
export PYTEST_ADDOPTS ?= --cov --cov-report=term-missing
override DOCS_SCREENSHOT_SURFACE := $(value DOCS_SCREENSHOT_SURFACE)
override DOCS_SCREENSHOT_SCENARIO := $(value DOCS_SCREENSHOT_SCENARIO)
export DOCS_SCREENSHOT_SURFACE
export DOCS_SCREENSHOT_SCENARIO
ifeq ($(OS),Windows_NT)
PYTHON ?= python
UV_BIN := $(UV_TOOL_DIR)/uv.exe
VENV_PYTHON := $(VENV_DIR)/Scripts/python.exe
else
PYTHON ?= python3
UV_BIN := $(UV_TOOL_DIR)/uv
VENV_PYTHON := $(VENV_DIR)/bin/python
endif
SYSTEM_PYTHON_EXECUTABLE := $(shell "$(PYTHON)" -c 'import os, sys; print(os.path.realpath(sys.executable))' 2>/dev/null)
export UV_PYTHON := $(SYSTEM_PYTHON_EXECUTABLE)
.PHONY: help system-python verified-uv setup bootstrap console lock lock-check test lint markdown-check typecheck typecheck-ty dependency-audit security-static security pre-push sbom package evaluate-uv-build container-policy container-compose-config workflow-audit hooks desktop-install desktop-check desktop-e2e desktop-security code-docs-check docs-cutover docs-screenshots docs-screenshots-check docs-terminal-screenshots
help:
@echo "Available targets: setup bootstrap console lock lock-check test lint markdown-check typecheck typecheck-ty dependency-audit security pre-push sbom package evaluate-uv-build container-policy container-compose-config workflow-audit hooks desktop-install desktop-check desktop-e2e desktop-security code-docs-check docs-cutover docs-screenshots docs-screenshots-check docs-terminal-screenshots"
desktop-install:
@node desktop/scripts/install-locked.mjs
desktop-check:
@pnpm --dir desktop lint
@pnpm --dir desktop typecheck
@pnpm --dir desktop test
@pnpm --dir desktop build
desktop-e2e:
@pnpm --dir desktop test:e2e
desktop-security:
@pnpm --dir desktop security
@pnpm --dir desktop test:security
system-python:
@command -v "$(PYTHON)" >/dev/null 2>&1 || { echo "UVENV_PYTHON_NOT_FOUND: required system Python executable '$(PYTHON)' was not found" >&2; exit 2; }
@$(PYTHON) scripts/check_system_python.py
verified-uv: system-python
@$(PYTHON) scripts/bootstrap_uv.py bootstrap --install-dir $(UV_TOOL_DIR) --receipt $(UV_RECEIPT) >/dev/null
setup: verified-uv
@if [ -e "$(VENV_DIR)" ] || [ -L "$(VENV_DIR)" ]; then \
if [ -L "$(VENV_DIR)" ] || [ ! -d "$(VENV_DIR)" ] || [ -L "$(VENV_DIR)/pyvenv.cfg" ] || [ ! -f "$(VENV_DIR)/pyvenv.cfg" ] || ! grep -Eq '^[[:space:]]*uv[[:space:]]*=' "$(VENV_DIR)/pyvenv.cfg"; then \
echo "UVENV_VENV_REPAIR_REFUSED: $(VENV_DIR) is not a regular uv-managed virtual environment" >&2; \
exit 2; \
fi; \
if ! "$(VENV_PYTHON)" -I -c 'import encodings' >/dev/null 2>&1; then \
echo "UVENV_VENV_RECREATED: replacing the unusable generated environment at $(VENV_DIR)" >&2; \
$(UV_BIN) venv --clear --python "$(UV_PYTHON)" "$(VENV_DIR)" >/dev/null; \
fi; \
fi
@$(UV_BIN) sync --locked --all-extras --all-groups
bootstrap: setup hooks
console: verified-uv
@$(UV_BIN) run --locked ancestry
lock: verified-uv
@$(UV_BIN) lock
lock-check: verified-uv
@$(UV_BIN) lock --check
test: verified-uv
@$(UV_BIN) run --locked --group test pytest --verbose
lint: verified-uv
@$(UV_BIN) run --locked --group lint ruff check src tests scripts
@$(UV_BIN) run --locked --group lint ruff format --check src tests scripts
@$(UV_BIN) run --locked --group lint python scripts/check_gfm_markdown.py
@$(UV_BIN) run --locked --group lint python scripts/check_architecture_contracts.py
@./scripts/check_repository_safety.sh
@$(UV_BIN) run --locked --group lint python scripts/check_code_documentation.py
markdown-check: verified-uv
@$(UV_BIN) run --locked --group lint python scripts/check_gfm_markdown.py
typecheck: verified-uv
@$(UV_BIN) run --locked --group typecheck mypy src/ancestryllm
typecheck-ty: verified-uv
@$(UV_BIN) run --locked --group typecheck ty check src/ancestryllm
dependency-audit: verified-uv
@$(UV_BIN) run --locked --group security python scripts/run_dependency_audit.py --uv $(UV_BIN)
security-static: verified-uv
@$(UV_BIN) run --locked --script scripts/run_pinned_semgrep.py .
security: dependency-audit security-static
pre-push:
@$(MAKE) test
@$(MAKE) lint
@$(MAKE) typecheck
@$(MAKE) security
sbom: verified-uv
@$(UV_BIN) run --locked --group security python scripts/generate_sbom.py --python $(VENV_PYTHON) --output $(SBOM_OUTPUT) --project pyproject.toml
package: verified-uv
@$(UV_BIN) run --locked --group build python scripts/build_release.py --output-dir $(DIST_DIR)
evaluate-uv-build: verified-uv
@$(UV_BIN) run --locked --group build python scripts/evaluate_uv_build.py --uv $(UV_BIN) --report $(UV_BUILD_REPORT)
container-policy: system-python
@mkdir -p build/container-policy
@$(PYTHON) scripts/container_policy.py --base containers/compose.yaml --overlay containers/compose.local.yaml --dockerfile containers/Dockerfile --output build/container-policy/local.json
@$(PYTHON) scripts/container_policy.py --base containers/compose.yaml --overlay containers/compose.remote.yaml --dockerfile containers/Dockerfile --output build/container-policy/remote.json
container-compose-config: container-policy
@gateway_image="$${ANCESTRYLLM_GATEWAY_IMAGE:?Set ANCESTRYLLM_GATEWAY_IMAGE}"; worker_image="$${ANCESTRYLLM_WORKER_IMAGE:?Set ANCESTRYLLM_WORKER_IMAGE}"; platform="$${ANCESTRYLLM_PLATFORM:?Set ANCESTRYLLM_PLATFORM}"; \
$(PYTHON) scripts/container_policy.py --base containers/compose.yaml --overlay containers/compose.local.yaml --dockerfile containers/Dockerfile --gateway-image "$$gateway_image" --worker-image "$$worker_image" --platform "$$platform" --output build/container-policy/resolved-local.json && \
docker compose --file containers/compose.yaml --file containers/compose.local.yaml config >/dev/null
@gateway_image="$${ANCESTRYLLM_GATEWAY_IMAGE:?Set ANCESTRYLLM_GATEWAY_IMAGE}"; worker_image="$${ANCESTRYLLM_WORKER_IMAGE:?Set ANCESTRYLLM_WORKER_IMAGE}"; platform="$${ANCESTRYLLM_PLATFORM:?Set ANCESTRYLLM_PLATFORM}"; \
$(PYTHON) scripts/container_policy.py --base containers/compose.yaml --overlay containers/compose.remote.yaml --dockerfile containers/Dockerfile --gateway-image "$$gateway_image" --worker-image "$$worker_image" --platform "$$platform" --output build/container-policy/resolved-remote.json && \
docker compose --file containers/compose.yaml --file containers/compose.remote.yaml config >/dev/null
workflow-audit: verified-uv
@$(UV_BIN) run --locked --group security zizmor --persona=pedantic .github/workflows .github/actions
code-docs-check: verified-uv desktop-install
@$(UV_BIN) run --locked --group lint ruff check src tests scripts --select D100,D101,D102,D103,D104,D418,D419
@$(UV_BIN) run --locked --group lint python scripts/check_code_documentation.py
@pnpm --dir desktop docs:check
docs-cutover: verified-uv
@$(UV_BIN) run --locked --group test python scripts/verify_documentation_cutover.py --repository-root . --source docs --source-sha "$$(git rev-parse HEAD)" --exceptions docs/_data/external_link_exceptions.json
docs-screenshots: verified-uv
@selection=(); \
if [[ -n "$$DOCS_SCREENSHOT_SURFACE" ]]; then selection+=(--surface "$$DOCS_SCREENSHOT_SURFACE"); fi; \
if [[ -n "$$DOCS_SCREENSHOT_SCENARIO" ]]; then selection+=(--scenario "$$DOCS_SCREENSHOT_SCENARIO"); fi; \
$(UV_BIN) run --locked --group lint python scripts/docs_screenshots.py capture --manifest config/docs-screenshot-manifest.json --repository-root . "$${selection[@]}"
docs-screenshots-check: verified-uv
@$(UV_BIN) run --locked --group lint python scripts/docs_screenshots.py check --manifest config/docs-screenshot-manifest.json --repository-root .
docs-terminal-screenshots: verified-uv
@$(UV_BIN) run --locked --group lint python scripts/docs_screenshots.py capture --manifest config/docs-screenshot-manifest.json --repository-root . --surface terminal
hooks: verified-uv
@$(UV_BIN) run --locked --group lint pre-commit install --hook-type pre-commit --hook-type pre-push