Nguyen Minh Phuc
c76154aeaa
ci / lint (push) Successful in 34s
ci / unit (push) Successful in 1m41s
ci / types (push) Successful in 1m41s
ci / dockerfile (push) Successful in 18s
ci / security (push) Successful in 1m27s
ci / chart (push) Failing after 1m11s
ci / integration (push) Successful in 1m10s
ci / image (api) (push) Has been skipped
ci / image (reconciler) (push) Has been skipped
ci / image (worker) (push) Has been skipped
ci / bump (push) Has been skipped
CORRECTNESS - lost-lease race: complete()/fail() did not check ownership, so a worker whose lease expired could mark a task done while another worker was running it, or requeue a task someone else owned. Reproduced, fixed with a CAS on (state, locked_by), pinned by two regression tests. - worker died on report failure: _run_one's docstring claimed no exception escapes the TaskGroup; fail()/complete() were outside the guarded block, so a DB blip cancelled every sibling provision on the pod. - claim query used an INNER join, which could strand a just-claimed task and report 'queue empty'. LEFT join. - InstanceRepo.set_error bypassed the state machine and had no callers. Deleted. - handle_deprovision ignored its CAS result, so a wrong-state instance kept a dangling endpoint and got re-provisioned by the drift check 60s later. - handle_verify re-notified on every retry: five pages for one halt. DEPLOY-BREAKING - the migration Job could never succeed: no Dockerfile copied migrations/, and migrate.py resolved the path relative to the source tree, which only works for an editable install. Added COPY + SVCFORGE_MIGRATIONS_DIR. - ServiceMonitor selector did not match the Service: API metrics never scraped. - SvcforgeReconcilerStale fired permanently from every pod, because the gauge is module-level and every service exports it as 0. Scoped to the reconciler job. - SvcforgeTaskFailed latched forever on a monotonic counter. Now increase()[15m]. - the digest guard accepted the all-zeros placeholder. - worker terminationGracePeriodSeconds was 60s against a 600s helm timeout. DEAD CODE THAT SHOULD NOT HAVE BEEN - adapters/k8s.py was never called, so tenant namespaces were never created and the first provision for a new team would fail. Wired into handle_provision. - adapters/redis.py was never imported by any service. Rate limiting is now wired into the API, failing open. - Settings.check_production() had no callers. Given an explicit environment and called from every entrypoint. OBSERVABILITY - the API never called obs.setup(): no JSON logs, no trace correlation, log_json silently inert. - LogNotifier's structured fields were discarded by the stdlib->structlog bridge. - bind_task_context cleared the 'service' binding for the life of every task. - split tasks_failed into task_attempts_failed and tasks_dead_lettered. SECURITY - trivy correctly blocked the worker/reconciler images: helm 3.16.2 and kubectl 1.31.2 carry CRITICAL Go stdlib CVEs. Bumped to helm 3.21.3 and kubectl 1.35.3, which also closes a four-minor skew against the v1.35.3 cluster. TESTS THAT COULD NOT FAIL - the concurrency cap test passed on a fully serial worker. - the alert/metric cross-check asserted a hardcoded list instead of reading the chart, so it could not catch a rename on the chart side. - fixed OTel tracer-provider pollution between test files. DOCS - ARCHITECTURE.md: mermaid diagrams, user stories, and the helm-vs-ArgoCD guarantee (verified with --dry-run=server). - AGENTS.md + CLAUDE.md. - prose sweep for back-and-forth phrasing across 19 files.
72 lines
2.7 KiB
Makefile
72 lines
2.7 KiB
Makefile
.PHONY: dev lint test migrate run-api run-worker run-reconciler integration ci chart
|
|
|
|
dev:
|
|
uv sync
|
|
|
|
lint:
|
|
uv run ruff check . && uv run ruff format --check . && uv run mypy .
|
|
|
|
test:
|
|
uv run pytest tests/unit
|
|
|
|
integration:
|
|
uv run pytest tests/integration
|
|
|
|
migrate:
|
|
uv run python -m svcforge_core.migrate
|
|
|
|
run-api:
|
|
uv run uvicorn services.api.main:create_app --factory --reload --port 8000
|
|
|
|
run-worker:
|
|
uv run python -m services.worker.main
|
|
|
|
run-reconciler:
|
|
uv run python -m services.reconciler.main
|
|
|
|
# Every gate CI runs, except the image build — that needs a docker daemon and three
|
|
# minutes, and the point of this target is to find out you failed before pushing.
|
|
# Same commands as .gitea/workflows/ci.yaml, deliberately: a gate that only exists in CI
|
|
# is a gate you debug through a web UI. Each recipe line below is the command from the
|
|
# corresponding job, character for character. If you change one, change both.
|
|
ci:
|
|
uv run ruff check . && uv run ruff format --check .
|
|
uv run mypy --strict .
|
|
uv run pytest tests/unit --cov=svcforge_core.domain --cov-fail-under=90
|
|
uv run python -m svcforge_core.migrate
|
|
uv run pytest tests/integration
|
|
uv run --with 'bandit[toml]' bandit -c pyproject.toml -r libs services -ll
|
|
uv export --frozen --no-dev \
|
|
--no-emit-project --no-emit-package svcforge-core \
|
|
-o /tmp/requirements-audit.txt
|
|
uv run --with pip-audit pip-audit --strict -r /tmp/requirements-audit.txt
|
|
hadolint services/*/Dockerfile
|
|
$(MAKE) chart
|
|
|
|
# The chart's own gates, mirroring the `chart` job in ci.yaml.
|
|
#
|
|
# `helm template` against plain values.yaml MUST FAIL: the digests there are all-zeros
|
|
# placeholders and _helpers.tpl refuses to build an image reference from one. So this
|
|
# asserts the failure rather than running the command bare — a bare `helm template` here
|
|
# would report the guard working as a broken build, and the previous version of this
|
|
# target did exactly that.
|
|
#
|
|
# The second render uses well-formed dummy digests to prove the templates themselves are
|
|
# valid, with both values-gated monitoring blocks turned on.
|
|
chart:
|
|
helm lint deploy/chart
|
|
@if helm template svcforge deploy/chart >/dev/null 2>&1; then \
|
|
echo "FAIL: chart rendered against the placeholder digests in values.yaml."; \
|
|
echo "The digest guard in _helpers.tpl is not guarding."; \
|
|
exit 1; \
|
|
fi
|
|
@echo "ok: placeholder digests rejected"
|
|
helm template svcforge deploy/chart \
|
|
--set image.api.digest=sha256:$(shell printf 'a%.0s' $$(seq 64)) \
|
|
--set image.worker.digest=sha256:$(shell printf 'b%.0s' $$(seq 64)) \
|
|
--set image.reconciler.digest=sha256:$(shell printf 'c%.0s' $$(seq 64)) \
|
|
--set serviceMonitor.enabled=true \
|
|
--set prometheusRule.enabled=true \
|
|
>/dev/null
|
|
@echo "ok: chart renders"
|