contextsafe/Makefile at roadmap/b-043-accessibility-gates · ghzhost/contextsafe · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
.PHONY: a11y a11y-full a11y-install audit format format-fix hygiene i18n lint publication-sweep secret-scan sync test typecheck verify

SAFETY_MODULES := src/contextsafe/models.py,src/contextsafe/validation.py,src/contextsafe/evaluator.py,src/contextsafe/receipt.py,src/contextsafe/contract_validation.py,src/contextsafe/jsonio.py,src/contextsafe/pack.py,src/contextsafe/plan.py,src/contextsafe/evidence.py,src/contextsafe/preflight.py,src/contextsafe/evidence_store.py

verify: sync lint format typecheck test audit hygiene publication-sweep i18n a11y

sync:
	# --locked fails when uv.lock has drifted from pyproject.toml.
	# --frozen installs the stale lock and exits 0, so it cannot gate drift.
	uv sync --locked

lint:
	uv run ruff check .

format:
	uv run ruff format --check .

format-fix:
	uv run ruff check --fix .
	uv run ruff format .

typecheck:
	uv run mypy --strict src

test:
	uv run pytest --cov=contextsafe --cov-branch --cov-report=term-missing --cov-fail-under=90
	uv run coverage report --include='$(SAFETY_MODULES)' --fail-under=95

audit:
	uv run pip-audit --skip-editable --cache-dir .cache/pip-audit

# Deliberately not part of `verify`: it needs a pinned gitleaks on PATH, which a
# clean clone does not have, and `verify` must stay the byte-for-byte gate that
# ci.yml runs. The security workflow and the release workflow both call this
# target directly, so CI and a maintainer run the identical scan.
secret-scan:
	./tools/secret-scan-full-history.sh

# Keeps the publication-readiness sweep true as commits land, instead of true
# as of the day somebody ran it by hand. Stdlib only, so it costs `verify`
# nothing and needs no tool a clean clone does not already have.
publication-sweep:
	uv run python tools/publication_sweep.py

# Catalog parity, placeholder parity, review consistency, and the rule that a
# machine-translated string may never reach a surface claiming human review.
# Stdlib plus the package itself, so it belongs in `verify` rather than in a
# job somebody remembers to run.
i18n:
	uv run python tools/i18n_gate.py

# The stdlib half of B-043: structural validity, contrast computed from the
# stylesheet, no colour-only encoding, and print. In `verify` because it needs
# nothing a clean clone does not have. It fails rather than passing when it has
# examined no page, and it refuses to treat a rule axe cannot decide as decided.
a11y:
	uv run python tools/a11y_gate.py --engines builtin

# Adds axe-core in a headless DOM. Separate from `verify` because it needs the
# node harness, which a clean clone does not have; the security workflow runs it
# after `make a11y-install`. A requested engine that cannot run is a failure, so
# this target cannot quietly degrade into the target above.
a11y-full:
	uv run python tools/a11y_gate.py --engines builtin,axe --json .a11y/report.json

a11y-install:
	npm ci --prefix tools/a11y

hygiene:
	! rg -n '(TODO|FIXME|HACK)' src tests
	! find . -maxdepth 2 -type f \( -name 'ruff.toml' -o -name 'pytest.ini' -o -name 'mypy.ini' -o -name 'setup.cfg' -o -name 'setup.py' -o -name 'tox.ini' -o -name '.flake8' -o -name 'requirements.txt' \) | grep .