chore(devex): Makefile with a uniform 'make check' (backend#1606)

[LukasWodka]

Summary

Today every repo in the org has a different incantation for "run your
tests": python manage.py test here, yarn test:coverage there,
make ci in cli, pytest tests/ -m "not slow" somewhere else. That
makes "run your tests before you push" a rule you can only obey if you
already know the repo — which means it is not really a rule, it is
tribal knowledge with a rule's wording. The people most likely to break
it are exactly the people least likely to know the incantation.

backend#1606 fixes that by giving every active repo the same three
targets:

make check lint + fast tests. Budget: UNDER 60 SECONDS.
make check-all everything CI runs, minus the CI-only heavy suites.
make setup install what those targets need.

The 60-second budget is not decoration. It is the property that decides
whether anyone runs the thing: a make check that takes ten minutes is
a rule people learn to skip, and skipping one rule teaches skipping
others. So the split between check and check-all is drawn on
measured wall-clock time, not on taste.

The Makefile is a THIN WRAPPER. Every command in it was lifted from the
workflow that already runs it. It adds no tool, no config, and no rule,
and it changes no CI workflow — making CI call make check is a
separate, later wave (decision 2 on backend#1606), deliberately kept out
of this PR so that a Makefile bug cannot redden the pipeline. No
pre-commit or pre-push hook is installed here either; that is step 4.

In this repo

make check — MEASURED 5.3 s:

bash -n on every shell script, shellcheck at error severity over the
file set installer-tests.yaml lints, the three single-source drift
guards (gen-manifest --check, check-facts --check, check-style), and
helm lint --strict for all four platform values files plus the
ingestor subchart.

HONEST GAP — this is the one repo in the wave where I could not split
fast from slow without lying. The bats suite IS this repo's unit suite
(868 tests) and it takes ~2 minutes serially on macOS. It does not
parallelise without GNU parallel, which is not on every dev machine, and
the per-file timings show no natural fast tier: the slowest file
(common.bats, 37 s) is also the most load-bearing, so any subset would
be arbitrary and would rot. So bats sits in check-all, and make check here is lint-only. A check that quietly took two minutes would
be a check nobody runs, which is worse. Splitting the bats suite is
real work and belongs in its own ticket.

make check-all adds bats, the 4-platform helm template render (with
kubeconform if you have it), and helm unittest (with the plugin install
line if you do not).

CI-only by name: the 9-distro prereq matrix, e2e-cluster (k3d),
e2e-proxy (squid), path-persist, Pester, windows-e2e, e2e-journey, and
the three k3d seal/upgrade e2e jobs.

Related

Step 1 of tracebloc/backend#1606 — a Makefile with a uniform check target in every active repo. One PR per repo; this is this repo's.

Type of change

• Tech-debt / refactor (developer experience)

Test plan

make check run for real: green in 5.3 s.

Every bats file was timed individually looking for a natural fast tier. There
isn't one: the full suite is ~2 min serially, and the slowest file
(common.bats, 37 s, 68 tests) is also the most load-bearing — any subset would
be arbitrary and would rot. That is why bats sits in check-all and why the
gap is stated above rather than papered over.

make help and the dry runs of every target parse clean.

No CI workflow is touched in this PR. CI parity — making the workflows call make check — is decision 2 on backend#1606 and lands as its own wave, deliberately after the Makefiles exist and are proven locally. No pre-commit or pre-push hook is installed here either; that is step 4.

Checklist

• Works from a clean checkout — .PHONY on every target, help is the default goal
• No CI workflow modified
• No pre-commit / pre-push hook installed
• No secrets / credentials in the diff
• Every command is copied from the workflow that already runs it — no new tool, no new config, no new rule
• Portable to GNU Make 3.81 (the macOS system make)

---

Note

Low Risk
Developer-experience only: new Makefile targets mirror existing CI commands and do not touch runtime, auth, or deployment code.

Overview
Adds a root Makefile so developers can run the same three entry points as other tracebloc repos: make check (fast pre-push), make check-all (full local CI parity), and make setup (tool presence check only—no installs or hooks).

make check wraps existing CI steps in ~4–5s: bash -n on all scripts/**/*.sh, shellcheck at error severity on the installer-tests file set, the three drift guards (gen-manifest --check, check-facts --check, check-style), and strict helm lint for client platform values plus ingestor. The 868-test bats suite stays in make check-all with helm template render (optional kubeconform) and helm unittest, because it does not fit the under-60s budget.

Commands are copied from standard-checks.yml, installer-tests.yaml, and helm-ci.yaml; no workflow files change. The lint recipe uses find … | xargs -0 -n1 bash -n instead of a read -d '' loop so parsing still runs under dash when Make uses /bin/sh—avoiding a silent no-op that CI on bash would not catch.

^{Reviewed by Cursor Bugbot for commit a9bc22a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1ec532c. Configure here.}

[shujaatTracebloc]

The Makefile itself is good — a genuine thin wrapper over the workflows, honest budget comments, and the one Bugbot finding (dash rejecting read -d and silently exiting 0) was correctly fixed to find … -print0 | xargs -0 -n1 bash -n. Content LGTM.

The only red is pii-gate / pii-check, and it isn't this PR: the check returns failure with null output, i.e. the fail-closed behaviour of the gate that was retired on 2026-08-06 (backend#1409) (documented in the very org-standards line #628 is updating). A Makefile-only diff has nothing for it to catch. This needs the pii-gate-override label or the required-check to be removed org-side — not a code change here. Everything else is green.