- 07 · Reference
- Makefile
Make targets
The single entrypoint for every workflow in the repository — 53 targets, read from the Makefile's own ## comments when this site is built. There are no undocumented steps.
Targets #
| Target | What it does |
|---|---|
| General | |
| make help | Show available targets |
| application | |
| make build | Compile and package every service |
| make test | Run the full test suite (unit, slice, and Testcontainers integration) |
| make check | Run tests plus the formatting gate, exactly as CI does |
| make coverage | Run the tests and print per-service line coverage |
| make fmt | Reformat sources in place |
| make run-api | Run the API on the host against local backing stores (profile: local) |
| make run-worker | Run the worker on the host against local backing stores |
| make clean | Remove build output |
| make deps | Print the resolved runtime dependency tree for the API |
| make modules | Report the JDK modules jdeps can see (a review aid for the jlink list) |
| container | |
| make images | Build the hardened image for every service |
| make image-<name> | Build the hardened image for one service (e.g. make image-worker) |
| make image-cds | Build the API image with a class-data-sharing archive (faster start, larger image) |
| make image-size | Report the size of the built images |
| local stack | |
| make bootstrap | Bring up the whole local stack from nothing and verify it works |
| make up | Start the local stack in the background, running freshly built images |
| make down | Stop the local stack and delete its volumes |
| make logs | Follow logs from every service |
| make logs-<name> | Follow one service's logs (e.g. make logs-worker) |
| make ps | Show the state of the local stack |
| make smoke | Run the smoke tests against a running stack |
| make dlq | Print anything sitting in the dead-letter topic |
| make lag | Show consumer group lag for the worker |
| make topics | List Kafka topics and their partition counts |
| make redis-cli | Open a redis-cli against the local cache |
| make psql | Open a psql shell against the local database |
| observability | |
| make obs-validate | Validate every observability config and run the alert unit tests, as CI does |
| make obs-reload | Apply edited alert rules and Alertmanager routing without restarting anything |
| make load | Steady load through the local gateway, gated on the SLOs (RATE=60 DURATION=5m) |
| make drill | Zero-downtime drill: roll the API under load in a local kind cluster, fail on any error |
| make drill-down | Delete the drill's kind cluster |
| make restore-drill | Back up Postgres, destroy it, restore to a point in time; fail on one wrong row (ROWS=20000) |
| make alerts | List the alerts firing right now |
| infrastructure | |
| make tf-init | Initialise terraform (needs object storage credentials for the state backend) |
| make tf-plan | Show what terraform would change |
| make tf-apply | Apply a plan produced by tf-plan - never applies without reading one first |
| make tf-lint | Format check and validate every terraform module |
| make provision | Run the ansible playbook against the node (BLUEPRINT_NODE_IP from tf output) |
| make provision-check | Dry-run the playbook and show the diff |
| make ansible-lint | Lint the playbook at the production profile, as CI does |
| kubernetes | |
| make k8s-build | Render every kustomization into .rendered/manifests |
| make k8s-validate | Render every kustomization and check it against the Kubernetes schemas |
| make k8s-scan | Scan the rendered manifests with checkov, as the security workflow does |
| make secrets-edit | Edit a SOPS-encrypted secret in place (FILE=deploy/k8s/config/prod/app-secrets.enc.yaml) |
| make flux-status | Show what Flux is reconciling and whether it is healthy |
| supply chain / ci | |
| make verify-pins | Fail if any GitHub Action is referenced by tag instead of commit SHA |
| make verify-image | Verify a published image's signature, SBOM and provenance (IMAGE=...) |
| make lint-ci | Lint the workflow files and shell scripts the way CI does |
| documentation | |
| make site | Build the documentation site into site/dist and fail on any broken internal link |
| make site-dev | Serve the documentation site with live reload at http://localhost:4321 |
| diagnostics | |
| make version | Print the version this build would produce |
| make doctor | Report which tools the workflows found on this machine |
The Makefile detects Docker or podman, the compose implementation and the runtime socket, and applies the SELinux
overlay for rootless podman where it is needed; make doctor prints what it found. Targets that need
cloud credentials — tf-plan, provision — read them from the environment and never from a
file in the repository.