Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
36 commits
Select commit Hold shift + click to select a range
ba01658
feat: migrate from CRC to minikube with disabled authentication
bobbravo2 Nov 5, 2025
d51f9d9
docs: move LOCAL_DEVELOPMENT to docs/ and remove migration files
bobbravo2 Nov 5, 2025
01d9fb2
security: implement proper local dev authentication with scoped permi…
bobbravo2 Nov 5, 2025
2378c9c
Refactor to use Podman instead of Docker as default container engine
bobbravo2 Nov 6, 2025
ccb5d51
Fix Podman compatibility with minikube
bobbravo2 Nov 6, 2025
af8884b
wip on minikube + podman
bobbravo2 Nov 6, 2025
26af422
Remove outdated analysis and documentation files for the Agentic comp…
bobbravo2 Nov 7, 2025
551f8bd
Update README for MiniKube access URLs and clean up YAML and test scr…
bobbravo2 Nov 10, 2025
3ccef91
docs: update CONTRIBUTING.md to use minikube instead of CRC
bobbravo2 Nov 10, 2025
7590438
docs: add security warnings to LOCAL_DEVELOPMENT.md
bobbravo2 Nov 10, 2025
803b305
test: add security validation tests to local-dev-test.sh
bobbravo2 Nov 10, 2025
ec3fff1
test: add CRITICAL failing tests for token minting TODO
bobbravo2 Nov 10, 2025
b893695
security: add production deployment safety verification
bobbravo2 Nov 10, 2025
843286f
chore: trigger CI re-run for lint-backend check
bobbravo2 Nov 10, 2025
6168f3b
chore: merge upstream main to fix lint issues
bobbravo2 Nov 14, 2025
4627c3a
feat: migrate test-local-dev workflow to use comprehensive test suite
bobbravo2 Nov 14, 2025
67d3df1
fix: apply individual CRD files instead of directory with kustomizati…
bobbravo2 Nov 14, 2025
8fa9a2b
fix: correct Role syntax in local-dev-rbac.yaml
bobbravo2 Nov 14, 2025
b579eec
fix: resolve test-local-dev workflow failures
bobbravo2 Nov 14, 2025
e2d1517
fix: resolve backend pod pending and missing ClusterRoles
bobbravo2 Nov 14, 2025
796a01f
fix: address critical security reviews and CI failures
bobbravo2 Nov 14, 2025
d3d38bc
fix: mark local-dev-user permission tests as known TODOs in CI mode
bobbravo2 Nov 14, 2025
ca3e79f
docs(workflow): Add comprehensive agent instructions to makefile-qual…
bobbravo2 Nov 14, 2025
a88ae1f
feat: Add Vertex AI auto-detection and complete local dev workflow
jwm4 Nov 25, 2025
1958c5f
fix: Align frontend mock token with backend expectation
jwm4 Nov 25, 2025
90c55a1
fix: Make error handling explicit in CI debug steps
jwm4 Nov 25, 2025
b71bdca
fix: Set umask in runner to allow content service to read documents
jwm4 Nov 25, 2025
be26ece
docs: Remove temporary AI-generated markdown files
jwm4 Nov 26, 2025
b5d08f8
chore: Address code review feedback
jwm4 Nov 26, 2025
274cf93
security: Tighten namespace allow-list and improve manifest validation
jwm4 Nov 26, 2025
0e85d94
fix: Run runner container as UID 1001 to match content service
jwm4 Nov 26, 2025
f963c0c
docs: Improve QUICK_START for active developers
jwm4 Nov 26, 2025
fb6acb1
fix: Detect macOS+Podman in tests and use localhost URLs
jwm4 Dec 4, 2025
37b9eaf
fix: Pass CI_MODE to local-test-dev script
jwm4 Dec 4, 2025
9618fb4
docs: Fix namespace allow-list to match code (remove default)
jwm4 Dec 4, 2025
c7e0084
fix: Use matching minikube driver for container engine
jwm4 Dec 4, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
338 changes: 338 additions & 0 deletions .github/workflows/makefile-quality.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,338 @@
name: Makefile Quality Check

# ============================================================================
# WORKFLOW MAINTENANCE INSTRUCTIONS FOR FUTURE AGENTS/DEVELOPERS
# ============================================================================
#
# This workflow validates the Makefile for quality, consistency, and best practices.
# It contains checks that reference specific Makefile content. When updating the
# Makefile, you MUST keep this workflow in sync.
#
# WHEN TO UPDATE THIS WORKFLOW:
#
# 1. ADDING/REMOVING CORE TARGETS
# - Location: "Verify all required targets exist" step (lines ~45-73)
# - Action: Update the `required_targets` array to match critical Makefile targets
# - Verify: Run `grep "^target-name:" Makefile` to confirm target exists
# - Example: If you add a new core target like "test-integration", add it to the array
#
# 2. CHANGING HELP OUTPUT FORMAT
# - Location: "Test help target output" step (lines ~129-150)
# - Action: Update the grep patterns to match new section headers
# - Verify: Run `make help | grep "Section Name:"` to see actual output
# - Example: If you rename "Quick Start:" to "Getting Started:", update line ~135
#
# 3. ADJUSTING QUALITY THRESHOLDS
# - Location: "Verify target documentation" step (lines ~152-172)
# - Action: Update percentage threshold (currently 50% minimum)
# - Rationale: Threshold represents minimum acceptable documentation coverage
# - Example: If requiring stricter docs, change line ~167 to higher percentage
#
# 4. CHANGING VARIABLE NAMES
# - Location: "Check for hardcoded values" step (lines ~109-127)
# - Action: Update search patterns if NAMESPACE or CONTAINER_ENGINE variable names change
# - Verify: Ensure grep patterns exclude the new variable declaration line
# - Example: If NAMESPACE becomes KUBE_NAMESPACE, update all references
#
# 5. ADDING NEW SCRIPT DIRECTORIES
# - Location: "on.pull_request.paths" section (lines ~5-8)
# - Action: Add new script paths that should trigger this workflow
# - Example: If adding scripts/validation/*.sh, add to paths filter
#
# HOW TO VERIFY CHANGES:
#
# 1. Test locally before committing:
# - Run: `make validate-makefile` (should pass)
# - Run: `make lint-makefile` (should pass)
# - Verify: All referenced targets exist in Makefile
# - Verify: All help output strings match actual output
#
# 2. After updating required_targets array:
# - Run: `for target in target1 target2; do grep -q "^${target}:" Makefile && echo "✓ $target" || echo "✗ MISSING: $target"; done`
#
# 3. After updating help output checks:
# - Run: `make help > /tmp/test.txt && grep -E "Section Name:" /tmp/test.txt`
#
# IMPLEMENTATION PRINCIPLES:
#
# - NO MAGIC STRINGS: All strings checked must exist in actual Makefile output
# - NO HALLUCINATIONS: All file paths must exist in repository
# - DOCUMENTED THRESHOLDS: All numeric thresholds must have rationale comments
# - FAIL-FAST: Hard requirements (missing targets) fail the workflow
# - WARN-SOFT: Quality suggestions (documentation %) show warnings only
#
# ============================================================================

on:
pull_request:
paths:
- 'Makefile'
- '.github/workflows/makefile-quality.yml'
push:
branches:
- main
paths:
- 'Makefile'

jobs:
validate-makefile:
name: Validate Makefile
runs-on: ubuntu-latest
timeout-minutes: 5

steps:
- name: Checkout code
uses: actions/checkout@v5

- name: Install shellcheck
run: |
sudo apt-get update
sudo apt-get install -y shellcheck
shellcheck --version

- name: Validate Makefile syntax
run: |
echo "🔍 Validating Makefile syntax and best practices..."
make lint-makefile

- name: Check shell scripts
run: |
echo "🔍 Checking embedded shell scripts..."
make check-shell

- name: Verify all required targets exist
run: |
echo "🔍 Verifying required targets exist..."

# AGENT INSTRUCTIONS: This array contains the minimum set of targets that must exist
# in the Makefile for the project to function correctly. Update this list when:
#
# ADD a target here if: It's a critical user-facing target that other automation depends on
# REMOVE a target if: It's being deprecated AND no other workflows/docs reference it
# VERIFY before changing: Search codebase for references to target name
#
# Current categories:
# - Core: help (required for discoverability)
# - Local dev: local-up, local-down, local-status, local-test-quick
# - Quality: validate-makefile, lint-makefile, check-shell, makefile-health
# - CI/CD: build-all, deploy, clean
#
# To verify a target exists: grep "^target-name:" Makefile
required_targets=(

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In projects I work on I try really hard to stick to a core principle that the GHA flows are "just" invoking things in a Justfile (or Makefile). It's ironic that this is about verifying a Makefile, but it's hard to execute outside of GHA.

Maybe make self-validate?

Also really, many of these targets are transitively executed by other jobs anyways...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I opened #372 to address this. It does seem like a good idea, but I'd like to try to deliver something that works and then iterate.

"help"
"local-up"
"local-down"
"local-status"
"local-test-quick"
"validate-makefile"
"lint-makefile"
"check-shell"
"makefile-health"
"build-all"
"deploy"
"clean"
)

missing_targets=()
for target in "${required_targets[@]}"; do
if ! grep -q "^${target}:" Makefile; then
missing_targets+=("$target")
fi
done

if [ ${#missing_targets[@]} -gt 0 ]; then
echo "❌ Missing required targets:"
printf ' - %s\n' "${missing_targets[@]}"
exit 1
else
echo "✅ All required targets present"
fi

- name: Verify .PHONY declarations
run: |
echo "🔍 Verifying .PHONY declarations..."

# Extract all target names (excluding internal targets starting with _)
targets=$(grep -E '^[a-zA-Z][a-zA-Z0-9_-]+:' Makefile | grep -v '^_' | cut -d: -f1 | sort -u)

# Extract .PHONY declarations
phony_targets=$(grep '^\.PHONY:' Makefile | sed 's/^\.PHONY: //' | tr ' ' '\n' | sort -u)

# Count targets and phony declarations
target_count=$(echo "$targets" | wc -l)
phony_count=$(echo "$phony_targets" | wc -l)

echo "📊 Found $target_count targets, $phony_count in .PHONY"

# Find targets not in .PHONY (excluding pattern rules and variable assignments)
not_phony=()
while IFS= read -r target; do
if ! echo "$phony_targets" | grep -q "^${target}$"; then
# Skip if it's a pattern rule or special target
if [[ ! "$target" =~ ^% ]] && [[ ! "$target" =~ ^\. ]]; then
not_phony+=("$target")
fi
fi
done <<< "$targets"

if [ ${#not_phony[@]} -gt 0 ]; then
echo "⚠️ Targets not declared in .PHONY (may be intentional for file targets):"
printf ' - %s\n' "${not_phony[@]}" | head -10
else
echo "✅ All non-file targets properly declared in .PHONY"
fi

- name: Check for hardcoded values
run: |
echo "🔍 Checking for hardcoded values that should be variables..."

# AGENT INSTRUCTIONS: This check detects hardcoded values that should use variables.
# It prevents configuration drift and ensures Makefile remains configurable.
#
# WHEN TO UPDATE THESE CHECKS:
#
# 1. IF VARIABLE NAMES CHANGE (e.g., NAMESPACE → KUBE_NAMESPACE):
# - Update the variable name in grep commands
# - Update exclusion patterns (grep -v lines)
# - Test: Ensure variable declaration line is excluded from warnings
#
# 2. IF DEFAULT VALUES CHANGE (e.g., ambient-code → new-namespace):
# - Update the search string to match new default value
# - Keep the variable name check pattern
# - Current defaults defined in Makefile lines ~7-11
#
# 3. IF ADDING NEW CONFIGURABLE VALUES:
# - Add similar check block following this pattern
# - Exclude: variable declarations, comments, help text
# - Example: Check for hardcoded registry names
#
# CURRENT CHECKS:
# - namespace: "ambient-code" should use $(NAMESPACE) variable
# - container engine: "docker" or "podman" should use $(CONTAINER_ENGINE) variable
#
# WHY THESE EXCLUSIONS:
# - "NAMESPACE ?=" = variable declaration itself (Makefile line 10)
# - "^[0-9]*:#" = comments (documentation, not code)
# - "@echo" = help text displayed to users (intentionally literal)
#
# TO VERIFY: grep -n "value" Makefile | grep -v "VARIABLE ?=" | grep -v "^[0-9]*:#"

# Check for hardcoded namespaces outside of variable declaration (should use $(NAMESPACE))
# Excludes: NAMESPACE ?= line, comments, and @echo help text
if grep -n "ambient-code" Makefile | grep -v "NAMESPACE ?=" | grep -v "^[0-9]*:#" | grep -v "@echo" | grep -q .; then
echo "⚠️ Found hardcoded 'ambient-code' references (should use \$(NAMESPACE) variable):"
grep -n "ambient-code" Makefile | grep -v "NAMESPACE ?=" | grep -v "^[0-9]*:#" | grep -v "@echo" | head -5
echo " To fix: Replace 'ambient-code' with '\$(NAMESPACE)' in these locations"
fi

# Check for hardcoded container engines outside of variable references
# Excludes: lines with CONTAINER_ENGINE variable, comments, and help text
if grep -nE "docker|podman" Makefile | grep -v "CONTAINER_ENGINE" | grep -v "^[0-9]*:#" | grep -v "@echo" | grep -q .; then
echo "⚠️ Found hardcoded docker/podman references (should use \$(CONTAINER_ENGINE) variable):"
grep -nE "docker|podman" Makefile | grep -v "CONTAINER_ENGINE" | grep -v "^[0-9]*:#" | grep -v "@echo" | head -5
echo " To fix: Replace 'docker' or 'podman' with '\$(CONTAINER_ENGINE)' in these locations"
fi

echo "✅ No problematic hardcoded values found"

- name: Test help target output
run: |
echo "🔍 Testing help target..."
make help > /tmp/help-output.txt

# AGENT INSTRUCTIONS: These strings MUST match the exact section headers in the Makefile
# help target output. When modifying the Makefile help format:
#
# 1. Run: make help | grep -E "Section Name:" to see actual output
# 2. Update the grep patterns below to match new header text exactly
# 3. Consider if renaming improves user experience (prefer clarity over brevity)
# 4. These checks ensure help output meets minimum usability standards
#
# Current required sections defined in Makefile (lines ~39-49):
# - "Quick Start:" - Essential commands for new users
# - "Quality Assurance:" - Quality/validation commands
# - "Available Targets:" - Complete target listing (auto-generated by awk)
#
# To verify: make help | grep -o "^[A-Za-z ]*:" | sort -u

if ! grep -q "Quick Start:" /tmp/help-output.txt; then
echo "❌ Help output missing 'Quick Start' section"
echo " Update this check if you renamed the section in Makefile"
exit 1
fi

if ! grep -q "Quality Assurance:" /tmp/help-output.txt; then
echo "❌ Help output missing 'Quality Assurance' section"
echo " Update this check if you renamed the section in Makefile"
exit 1
fi

if ! grep -q "Available Targets:" /tmp/help-output.txt; then
echo "❌ Help output missing 'Available Targets' section"
echo " This is auto-generated by awk in Makefile line ~49"
exit 1
fi

echo "✅ Help target produces expected output"

- name: Verify target documentation
run: |
echo "🔍 Checking target documentation..."

# AGENT INSTRUCTIONS: This check measures documentation quality by counting
# how many Makefile targets have inline help text (## comments).
#
# DOCUMENTATION FORMAT: target-name: ## Help text shown in 'make help'
#
# WHEN TO ADJUST THRESHOLD:
# - 50% minimum = Current threshold for acceptable quality
# - Increase to 75%+ if requiring comprehensive documentation
# - Decrease to 30%+ only if many internal/experimental targets exist
#
# RATIONALE FOR 50% THRESHOLD:
# - All user-facing targets SHOULD have documentation
# - Internal targets (prefixed with _) are automatically excluded
# - Helper targets may not need docs if only called by other targets
# - 50% ensures at least half of public API is documented
#
# TO ADD DOCUMENTATION: Add ## comment after target definition
# Example: my-target: ## Description of what this target does
#
# TO VERIFY: grep '^target-name:.*##' Makefile

# Count targets with documentation (excluding internal targets starting with _)
total_targets=$(grep -E '^[a-zA-Z][a-zA-Z0-9_-]+:' Makefile | grep -v '^_' | wc -l)
documented_targets=$(grep -E '^[a-zA-Z][a-zA-Z0-9_-]+:.*##' Makefile | wc -l)

echo "📊 $documented_targets/$total_targets targets have help text"

# Calculate percentage (threshold: 50% minimum for good documentation practice)
if [ "$total_targets" -gt 0 ]; then
percentage=$((documented_targets * 100 / total_targets))
echo "📈 Documentation coverage: ${percentage}%"

if [ "$percentage" -lt 50 ]; then
echo "⚠️ Documentation coverage below 50%, consider adding help text (## comments) to more targets"
echo " Add documentation by appending '## Description' after target definition"
else
echo "✅ Good target documentation coverage (${percentage}%)"
fi
fi

- name: Run comprehensive validation
run: |
echo "🔍 Running comprehensive Makefile validation..."
make validate-makefile

- name: Summary
if: success()
run: |
echo ""
echo "═══════════════════════════════════════"
echo " Makefile Quality Check Summary"
echo "═══════════════════════════════════════"
echo ""
echo "✅ All quality checks passed!"
echo ""
echo "The Makefile meets quality standards and is ready for use."

Loading
Loading