Sharang Parnerkar
d82f86fc95
CI / detect-changes (pull_request) Successful in 9s
CI / branch-name (pull_request) Successful in 1s
CI / guardrail-integrity (pull_request) Successful in 7s
CI / secret-scan (pull_request) Successful in 11s
CI / dep-audit (pull_request) Failing after 58s
CI / sbom-scan (pull_request) Failing after 1m4s
CI / build-sha-integrity (pull_request) Successful in 6s
CI / validate-canonical-controls (pull_request) Successful in 4s
CI / loc-budget (pull_request) Successful in 25s
CI / go-lint (pull_request) Failing after 22s
CI / python-lint (pull_request) Failing after 13s
CI / nodejs-lint (pull_request) Failing after 1m15s
CI / nodejs-build (pull_request) Successful in 3m12s
CI / test-go (pull_request) Successful in 57s
CI / iace-gt-coverage (pull_request) Successful in 16s
CI / test-python-backend (pull_request) Successful in 25s
CI / test-python-document-crawler (pull_request) Successful in 14s
CI / test-python-dsms-gateway (pull_request) Successful in 10s
- Add .infisical.json linking the repo to the breakpilot-compliance project on the self-hosted secrets.meghsakha.com instance. - Add Makefile with infisical-aware targets (make dev, dev-build, dev-down, secrets, secrets-set). `make dev` runs `infisical run --env=dev -- docker compose up`, so secrets are injected at run time and .env files no longer touch disk. - Add INFISICAL_SETUP.md with per-developer onboarding (CLI install, login, verify project link, run targets, Claude Code usage patterns, troubleshooting). - Update README Quick Start to drop the cp .env.example .env step and point at make dev + INFISICAL_SETUP.md. - Remove HashiCorp Vault references from CLAUDE.md (core-services list + sensitive-files list) and compliance-checklist.md TOM section; replace with Infisical. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
58 lines
1.8 KiB
Makefile
58 lines
1.8 KiB
Makefile
# breakpilot-compliance — developer workflow
|
|
#
|
|
# Secrets are managed in Infisical (secrets.meghsakha.com). The project
|
|
# link lives in .infisical.json. To get started:
|
|
# 1) infisical login --domain https://secrets.meghsakha.com (once per machine)
|
|
# 2) make dev
|
|
#
|
|
# .env / .env.local are NOT used in this repo anymore. Anything that needs
|
|
# secrets MUST be launched through `infisical run` so the values come from
|
|
# the secrets store instead of disk.
|
|
|
|
INFISICAL ?= infisical
|
|
INFISICAL_DOMAIN ?= https://secrets.meghsakha.com
|
|
ENV ?= dev
|
|
|
|
INFISICAL_RUN := $(INFISICAL) --domain $(INFISICAL_DOMAIN) run --env=$(ENV) --
|
|
INFISICAL_SECRETS := $(INFISICAL) --domain $(INFISICAL_DOMAIN) secrets --env=$(ENV)
|
|
|
|
.PHONY: help dev dev-build dev-down dev-logs dev-ps secrets secrets-set check-loc
|
|
|
|
help:
|
|
@echo "Targets:"
|
|
@echo " dev Start the full compose stack with secrets injected from Infisical"
|
|
@echo " dev-build Same as dev, but force a rebuild first"
|
|
@echo " dev-down Stop the compose stack (no secrets needed)"
|
|
@echo " dev-logs Tail logs from all services"
|
|
@echo " dev-ps Show running containers"
|
|
@echo " secrets List all secrets in the current env ($(ENV))"
|
|
@echo " secrets-set Set a secret (KEY=... VALUE=...)"
|
|
@echo " check-loc Run the 500-line LOC guard"
|
|
|
|
dev:
|
|
$(INFISICAL_RUN) docker compose up
|
|
|
|
dev-build:
|
|
$(INFISICAL_RUN) docker compose up --build
|
|
|
|
dev-down:
|
|
docker compose down
|
|
|
|
dev-logs:
|
|
docker compose logs -f
|
|
|
|
dev-ps:
|
|
docker compose ps
|
|
|
|
secrets:
|
|
$(INFISICAL_SECRETS)
|
|
|
|
secrets-set:
|
|
@if [ -z "$(KEY)" ] || [ -z "$(VALUE)" ]; then \
|
|
echo "Usage: make secrets-set KEY=MY_KEY VALUE=my_value"; exit 1; \
|
|
fi
|
|
$(INFISICAL) --domain $(INFISICAL_DOMAIN) secrets set $(KEY)=$(VALUE) --env=$(ENV)
|
|
|
|
check-loc:
|
|
bash scripts/check-loc.sh
|