-
Notifications
You must be signed in to change notification settings - Fork 35
feat: Local Dev with MiniKube (revised) #367
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
bobbravo2
merged 36 commits into
ambient-code:main
from
jwm4:feature/update-to-use-minikube
Dec 5, 2025
Merged
Changes from all commits
Commits
Show all changes
36 commits
Select commit
Hold shift + click to select a range
ba01658
feat: migrate from CRC to minikube with disabled authentication
bobbravo2 d51f9d9
docs: move LOCAL_DEVELOPMENT to docs/ and remove migration files
bobbravo2 01d9fb2
security: implement proper local dev authentication with scoped permi…
bobbravo2 2378c9c
Refactor to use Podman instead of Docker as default container engine
bobbravo2 ccb5d51
Fix Podman compatibility with minikube
bobbravo2 af8884b
wip on minikube + podman
bobbravo2 26af422
Remove outdated analysis and documentation files for the Agentic comp…
bobbravo2 551f8bd
Update README for MiniKube access URLs and clean up YAML and test scr…
bobbravo2 3ccef91
docs: update CONTRIBUTING.md to use minikube instead of CRC
bobbravo2 7590438
docs: add security warnings to LOCAL_DEVELOPMENT.md
bobbravo2 803b305
test: add security validation tests to local-dev-test.sh
bobbravo2 ec3fff1
test: add CRITICAL failing tests for token minting TODO
bobbravo2 b893695
security: add production deployment safety verification
bobbravo2 843286f
chore: trigger CI re-run for lint-backend check
bobbravo2 6168f3b
chore: merge upstream main to fix lint issues
bobbravo2 4627c3a
feat: migrate test-local-dev workflow to use comprehensive test suite
bobbravo2 67d3df1
fix: apply individual CRD files instead of directory with kustomizati…
bobbravo2 8fa9a2b
fix: correct Role syntax in local-dev-rbac.yaml
bobbravo2 b579eec
fix: resolve test-local-dev workflow failures
bobbravo2 e2d1517
fix: resolve backend pod pending and missing ClusterRoles
bobbravo2 796a01f
fix: address critical security reviews and CI failures
bobbravo2 d3d38bc
fix: mark local-dev-user permission tests as known TODOs in CI mode
bobbravo2 ca3e79f
docs(workflow): Add comprehensive agent instructions to makefile-qual…
bobbravo2 a88ae1f
feat: Add Vertex AI auto-detection and complete local dev workflow
jwm4 1958c5f
fix: Align frontend mock token with backend expectation
jwm4 90c55a1
fix: Make error handling explicit in CI debug steps
jwm4 b71bdca
fix: Set umask in runner to allow content service to read documents
jwm4 be26ece
docs: Remove temporary AI-generated markdown files
jwm4 b5d08f8
chore: Address code review feedback
jwm4 274cf93
security: Tighten namespace allow-list and improve manifest validation
jwm4 0e85d94
fix: Run runner container as UID 1001 to match content service
jwm4 f963c0c
docs: Improve QUICK_START for active developers
jwm4 fb6acb1
fix: Detect macOS+Podman in tests and use localhost URLs
jwm4 37b9eaf
fix: Pass CI_MODE to local-test-dev script
jwm4 9618fb4
docs: Fix namespace allow-list to match code (remove default)
jwm4 c7e0084
fix: Use matching minikube driver for container engine
jwm4 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,338 @@ | ||
| name: Makefile Quality Check | ||
|
|
||
| # ============================================================================ | ||
| # WORKFLOW MAINTENANCE INSTRUCTIONS FOR FUTURE AGENTS/DEVELOPERS | ||
| # ============================================================================ | ||
| # | ||
| # This workflow validates the Makefile for quality, consistency, and best practices. | ||
| # It contains checks that reference specific Makefile content. When updating the | ||
| # Makefile, you MUST keep this workflow in sync. | ||
| # | ||
| # WHEN TO UPDATE THIS WORKFLOW: | ||
| # | ||
| # 1. ADDING/REMOVING CORE TARGETS | ||
| # - Location: "Verify all required targets exist" step (lines ~45-73) | ||
| # - Action: Update the `required_targets` array to match critical Makefile targets | ||
| # - Verify: Run `grep "^target-name:" Makefile` to confirm target exists | ||
| # - Example: If you add a new core target like "test-integration", add it to the array | ||
| # | ||
| # 2. CHANGING HELP OUTPUT FORMAT | ||
| # - Location: "Test help target output" step (lines ~129-150) | ||
| # - Action: Update the grep patterns to match new section headers | ||
| # - Verify: Run `make help | grep "Section Name:"` to see actual output | ||
| # - Example: If you rename "Quick Start:" to "Getting Started:", update line ~135 | ||
| # | ||
| # 3. ADJUSTING QUALITY THRESHOLDS | ||
| # - Location: "Verify target documentation" step (lines ~152-172) | ||
| # - Action: Update percentage threshold (currently 50% minimum) | ||
| # - Rationale: Threshold represents minimum acceptable documentation coverage | ||
| # - Example: If requiring stricter docs, change line ~167 to higher percentage | ||
| # | ||
| # 4. CHANGING VARIABLE NAMES | ||
| # - Location: "Check for hardcoded values" step (lines ~109-127) | ||
| # - Action: Update search patterns if NAMESPACE or CONTAINER_ENGINE variable names change | ||
| # - Verify: Ensure grep patterns exclude the new variable declaration line | ||
| # - Example: If NAMESPACE becomes KUBE_NAMESPACE, update all references | ||
| # | ||
| # 5. ADDING NEW SCRIPT DIRECTORIES | ||
| # - Location: "on.pull_request.paths" section (lines ~5-8) | ||
| # - Action: Add new script paths that should trigger this workflow | ||
| # - Example: If adding scripts/validation/*.sh, add to paths filter | ||
| # | ||
| # HOW TO VERIFY CHANGES: | ||
| # | ||
| # 1. Test locally before committing: | ||
| # - Run: `make validate-makefile` (should pass) | ||
| # - Run: `make lint-makefile` (should pass) | ||
| # - Verify: All referenced targets exist in Makefile | ||
| # - Verify: All help output strings match actual output | ||
| # | ||
| # 2. After updating required_targets array: | ||
| # - Run: `for target in target1 target2; do grep -q "^${target}:" Makefile && echo "✓ $target" || echo "✗ MISSING: $target"; done` | ||
| # | ||
| # 3. After updating help output checks: | ||
| # - Run: `make help > /tmp/test.txt && grep -E "Section Name:" /tmp/test.txt` | ||
| # | ||
| # IMPLEMENTATION PRINCIPLES: | ||
| # | ||
| # - NO MAGIC STRINGS: All strings checked must exist in actual Makefile output | ||
| # - NO HALLUCINATIONS: All file paths must exist in repository | ||
| # - DOCUMENTED THRESHOLDS: All numeric thresholds must have rationale comments | ||
| # - FAIL-FAST: Hard requirements (missing targets) fail the workflow | ||
| # - WARN-SOFT: Quality suggestions (documentation %) show warnings only | ||
| # | ||
| # ============================================================================ | ||
|
|
||
| on: | ||
| pull_request: | ||
| paths: | ||
| - 'Makefile' | ||
| - '.github/workflows/makefile-quality.yml' | ||
| push: | ||
| branches: | ||
| - main | ||
| paths: | ||
| - 'Makefile' | ||
|
|
||
| jobs: | ||
| validate-makefile: | ||
| name: Validate Makefile | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v5 | ||
|
|
||
| - name: Install shellcheck | ||
| run: | | ||
| sudo apt-get update | ||
| sudo apt-get install -y shellcheck | ||
| shellcheck --version | ||
|
|
||
| - name: Validate Makefile syntax | ||
| run: | | ||
| echo "🔍 Validating Makefile syntax and best practices..." | ||
| make lint-makefile | ||
|
|
||
| - name: Check shell scripts | ||
| run: | | ||
| echo "🔍 Checking embedded shell scripts..." | ||
| make check-shell | ||
|
|
||
| - name: Verify all required targets exist | ||
| run: | | ||
| echo "🔍 Verifying required targets exist..." | ||
|
|
||
| # AGENT INSTRUCTIONS: This array contains the minimum set of targets that must exist | ||
| # in the Makefile for the project to function correctly. Update this list when: | ||
| # | ||
| # ADD a target here if: It's a critical user-facing target that other automation depends on | ||
| # REMOVE a target if: It's being deprecated AND no other workflows/docs reference it | ||
| # VERIFY before changing: Search codebase for references to target name | ||
| # | ||
| # Current categories: | ||
| # - Core: help (required for discoverability) | ||
| # - Local dev: local-up, local-down, local-status, local-test-quick | ||
| # - Quality: validate-makefile, lint-makefile, check-shell, makefile-health | ||
| # - CI/CD: build-all, deploy, clean | ||
| # | ||
| # To verify a target exists: grep "^target-name:" Makefile | ||
| required_targets=( | ||
| "help" | ||
| "local-up" | ||
| "local-down" | ||
| "local-status" | ||
| "local-test-quick" | ||
| "validate-makefile" | ||
| "lint-makefile" | ||
| "check-shell" | ||
| "makefile-health" | ||
| "build-all" | ||
| "deploy" | ||
| "clean" | ||
| ) | ||
|
|
||
| missing_targets=() | ||
| for target in "${required_targets[@]}"; do | ||
| if ! grep -q "^${target}:" Makefile; then | ||
| missing_targets+=("$target") | ||
| fi | ||
| done | ||
|
|
||
| if [ ${#missing_targets[@]} -gt 0 ]; then | ||
| echo "❌ Missing required targets:" | ||
| printf ' - %s\n' "${missing_targets[@]}" | ||
| exit 1 | ||
| else | ||
| echo "✅ All required targets present" | ||
| fi | ||
|
|
||
| - name: Verify .PHONY declarations | ||
| run: | | ||
| echo "🔍 Verifying .PHONY declarations..." | ||
|
|
||
| # Extract all target names (excluding internal targets starting with _) | ||
| targets=$(grep -E '^[a-zA-Z][a-zA-Z0-9_-]+:' Makefile | grep -v '^_' | cut -d: -f1 | sort -u) | ||
|
|
||
| # Extract .PHONY declarations | ||
| phony_targets=$(grep '^\.PHONY:' Makefile | sed 's/^\.PHONY: //' | tr ' ' '\n' | sort -u) | ||
|
|
||
| # Count targets and phony declarations | ||
| target_count=$(echo "$targets" | wc -l) | ||
| phony_count=$(echo "$phony_targets" | wc -l) | ||
|
|
||
| echo "📊 Found $target_count targets, $phony_count in .PHONY" | ||
|
|
||
| # Find targets not in .PHONY (excluding pattern rules and variable assignments) | ||
| not_phony=() | ||
| while IFS= read -r target; do | ||
| if ! echo "$phony_targets" | grep -q "^${target}$"; then | ||
| # Skip if it's a pattern rule or special target | ||
| if [[ ! "$target" =~ ^% ]] && [[ ! "$target" =~ ^\. ]]; then | ||
| not_phony+=("$target") | ||
| fi | ||
| fi | ||
| done <<< "$targets" | ||
|
|
||
| if [ ${#not_phony[@]} -gt 0 ]; then | ||
| echo "⚠️ Targets not declared in .PHONY (may be intentional for file targets):" | ||
| printf ' - %s\n' "${not_phony[@]}" | head -10 | ||
| else | ||
| echo "✅ All non-file targets properly declared in .PHONY" | ||
| fi | ||
|
|
||
| - name: Check for hardcoded values | ||
| run: | | ||
| echo "🔍 Checking for hardcoded values that should be variables..." | ||
|
|
||
| # AGENT INSTRUCTIONS: This check detects hardcoded values that should use variables. | ||
| # It prevents configuration drift and ensures Makefile remains configurable. | ||
| # | ||
| # WHEN TO UPDATE THESE CHECKS: | ||
| # | ||
| # 1. IF VARIABLE NAMES CHANGE (e.g., NAMESPACE → KUBE_NAMESPACE): | ||
| # - Update the variable name in grep commands | ||
| # - Update exclusion patterns (grep -v lines) | ||
| # - Test: Ensure variable declaration line is excluded from warnings | ||
| # | ||
| # 2. IF DEFAULT VALUES CHANGE (e.g., ambient-code → new-namespace): | ||
| # - Update the search string to match new default value | ||
| # - Keep the variable name check pattern | ||
| # - Current defaults defined in Makefile lines ~7-11 | ||
| # | ||
| # 3. IF ADDING NEW CONFIGURABLE VALUES: | ||
| # - Add similar check block following this pattern | ||
| # - Exclude: variable declarations, comments, help text | ||
| # - Example: Check for hardcoded registry names | ||
| # | ||
| # CURRENT CHECKS: | ||
| # - namespace: "ambient-code" should use $(NAMESPACE) variable | ||
| # - container engine: "docker" or "podman" should use $(CONTAINER_ENGINE) variable | ||
| # | ||
| # WHY THESE EXCLUSIONS: | ||
| # - "NAMESPACE ?=" = variable declaration itself (Makefile line 10) | ||
| # - "^[0-9]*:#" = comments (documentation, not code) | ||
| # - "@echo" = help text displayed to users (intentionally literal) | ||
| # | ||
| # TO VERIFY: grep -n "value" Makefile | grep -v "VARIABLE ?=" | grep -v "^[0-9]*:#" | ||
|
|
||
| # Check for hardcoded namespaces outside of variable declaration (should use $(NAMESPACE)) | ||
| # Excludes: NAMESPACE ?= line, comments, and @echo help text | ||
| if grep -n "ambient-code" Makefile | grep -v "NAMESPACE ?=" | grep -v "^[0-9]*:#" | grep -v "@echo" | grep -q .; then | ||
| echo "⚠️ Found hardcoded 'ambient-code' references (should use \$(NAMESPACE) variable):" | ||
| grep -n "ambient-code" Makefile | grep -v "NAMESPACE ?=" | grep -v "^[0-9]*:#" | grep -v "@echo" | head -5 | ||
| echo " To fix: Replace 'ambient-code' with '\$(NAMESPACE)' in these locations" | ||
| fi | ||
|
|
||
| # Check for hardcoded container engines outside of variable references | ||
| # Excludes: lines with CONTAINER_ENGINE variable, comments, and help text | ||
| if grep -nE "docker|podman" Makefile | grep -v "CONTAINER_ENGINE" | grep -v "^[0-9]*:#" | grep -v "@echo" | grep -q .; then | ||
| echo "⚠️ Found hardcoded docker/podman references (should use \$(CONTAINER_ENGINE) variable):" | ||
| grep -nE "docker|podman" Makefile | grep -v "CONTAINER_ENGINE" | grep -v "^[0-9]*:#" | grep -v "@echo" | head -5 | ||
| echo " To fix: Replace 'docker' or 'podman' with '\$(CONTAINER_ENGINE)' in these locations" | ||
| fi | ||
|
|
||
| echo "✅ No problematic hardcoded values found" | ||
|
|
||
| - name: Test help target output | ||
| run: | | ||
| echo "🔍 Testing help target..." | ||
| make help > /tmp/help-output.txt | ||
|
|
||
| # AGENT INSTRUCTIONS: These strings MUST match the exact section headers in the Makefile | ||
| # help target output. When modifying the Makefile help format: | ||
| # | ||
| # 1. Run: make help | grep -E "Section Name:" to see actual output | ||
| # 2. Update the grep patterns below to match new header text exactly | ||
| # 3. Consider if renaming improves user experience (prefer clarity over brevity) | ||
| # 4. These checks ensure help output meets minimum usability standards | ||
| # | ||
| # Current required sections defined in Makefile (lines ~39-49): | ||
| # - "Quick Start:" - Essential commands for new users | ||
| # - "Quality Assurance:" - Quality/validation commands | ||
| # - "Available Targets:" - Complete target listing (auto-generated by awk) | ||
| # | ||
| # To verify: make help | grep -o "^[A-Za-z ]*:" | sort -u | ||
|
|
||
| if ! grep -q "Quick Start:" /tmp/help-output.txt; then | ||
| echo "❌ Help output missing 'Quick Start' section" | ||
| echo " Update this check if you renamed the section in Makefile" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if ! grep -q "Quality Assurance:" /tmp/help-output.txt; then | ||
| echo "❌ Help output missing 'Quality Assurance' section" | ||
| echo " Update this check if you renamed the section in Makefile" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if ! grep -q "Available Targets:" /tmp/help-output.txt; then | ||
| echo "❌ Help output missing 'Available Targets' section" | ||
| echo " This is auto-generated by awk in Makefile line ~49" | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "✅ Help target produces expected output" | ||
|
|
||
| - name: Verify target documentation | ||
| run: | | ||
| echo "🔍 Checking target documentation..." | ||
|
|
||
| # AGENT INSTRUCTIONS: This check measures documentation quality by counting | ||
| # how many Makefile targets have inline help text (## comments). | ||
| # | ||
| # DOCUMENTATION FORMAT: target-name: ## Help text shown in 'make help' | ||
| # | ||
| # WHEN TO ADJUST THRESHOLD: | ||
| # - 50% minimum = Current threshold for acceptable quality | ||
| # - Increase to 75%+ if requiring comprehensive documentation | ||
| # - Decrease to 30%+ only if many internal/experimental targets exist | ||
| # | ||
| # RATIONALE FOR 50% THRESHOLD: | ||
| # - All user-facing targets SHOULD have documentation | ||
| # - Internal targets (prefixed with _) are automatically excluded | ||
| # - Helper targets may not need docs if only called by other targets | ||
| # - 50% ensures at least half of public API is documented | ||
| # | ||
| # TO ADD DOCUMENTATION: Add ## comment after target definition | ||
| # Example: my-target: ## Description of what this target does | ||
| # | ||
| # TO VERIFY: grep '^target-name:.*##' Makefile | ||
|
|
||
| # Count targets with documentation (excluding internal targets starting with _) | ||
| total_targets=$(grep -E '^[a-zA-Z][a-zA-Z0-9_-]+:' Makefile | grep -v '^_' | wc -l) | ||
| documented_targets=$(grep -E '^[a-zA-Z][a-zA-Z0-9_-]+:.*##' Makefile | wc -l) | ||
|
|
||
| echo "📊 $documented_targets/$total_targets targets have help text" | ||
|
|
||
| # Calculate percentage (threshold: 50% minimum for good documentation practice) | ||
| if [ "$total_targets" -gt 0 ]; then | ||
| percentage=$((documented_targets * 100 / total_targets)) | ||
| echo "📈 Documentation coverage: ${percentage}%" | ||
|
|
||
| if [ "$percentage" -lt 50 ]; then | ||
| echo "⚠️ Documentation coverage below 50%, consider adding help text (## comments) to more targets" | ||
| echo " Add documentation by appending '## Description' after target definition" | ||
| else | ||
| echo "✅ Good target documentation coverage (${percentage}%)" | ||
| fi | ||
| fi | ||
|
|
||
| - name: Run comprehensive validation | ||
| run: | | ||
| echo "🔍 Running comprehensive Makefile validation..." | ||
| make validate-makefile | ||
|
|
||
| - name: Summary | ||
| if: success() | ||
| run: | | ||
| echo "" | ||
| echo "═══════════════════════════════════════" | ||
| echo " Makefile Quality Check Summary" | ||
| echo "═══════════════════════════════════════" | ||
| echo "" | ||
| echo "✅ All quality checks passed!" | ||
| echo "" | ||
| echo "The Makefile meets quality standards and is ready for use." | ||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In projects I work on I try really hard to stick to a core principle that the GHA flows are "just" invoking things in a Justfile (or Makefile). It's ironic that this is about verifying a Makefile, but it's hard to execute outside of GHA.
Maybe
make self-validate?Also really, many of these targets are transitively executed by other jobs anyways...
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I opened #372 to address this. It does seem like a good idea, but I'd like to try to deliver something that works and then iterate.