From f830153cf4cb387eefcff7ff16c325d82428a3c2 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Thu, 10 Sep 2026 16:57:38 +0200
Subject: [PATCH] build(make): run every local suite from make test in a
 project virtualenv

make test installed the project into whatever PYTHON pointed at, which is
the system python3 by default. On Manjaro, Debian and Ubuntu that Python
is externally managed, so pip refuses (PEP 668) and not a single suite
runs, although AGENTS.md requires make test before every commit. It also
stopped at the first failing suite, so one broken linter hid the result
of every test behind it.

make test now creates .venv on first use and runs ci with --keep-going
and that interpreter, so every suite runs and make lists each failed
target. The path is fixed to the checkout: an exported VENV, which other
tooling sets, would otherwise redirect it. It is absolute because
run-e2e.sh changes into app/ before starting Flask. All other targets
keep PYTHON ?= python3.

Verified with a full make test: actionlint, ruff, yamllint, eslint,
hadolint, shellcheck, the lint, security, unit and integration suites,
bandit, pip-audit and 107 Cypress tests all pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .gitignore | 1 +
 Makefile   | 9 +++++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 23ef080..f3cb84c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,7 @@ app/static/cache/*
 .env
 app/cypress/screenshots/*
 .ruff_cache/
+.venv/
 app/node_modules/
 app/static/vendor/
 hadolint-results.sarif
diff --git a/Makefile b/Makefile
index 4c2d886..f31cc4e 100644
--- a/Makefile
+++ b/Makefile
@@ -7,6 +7,8 @@ endif
 
 PYTHON ?= python3
 ACT ?= act
+TEST_VENV := $(CURDIR)/.venv
+TEST_PYTHON ?= $(TEST_VENV)/bin/python
 
 # Bootstrap the local .env from the checked-in env.example template.
 # Idempotent: leaves an existing .env untouched.
@@ -252,5 +254,8 @@ ci: lint security test-unit test-integration test-e2e
 	# Run the local CI suite.
 
 .PHONY: test
-test: ci
-	# Run the full validation suite.
+test:
+	# Run every local suite in a project virtualenv, since PEP 668 refuses pip on
+	# a system Python, and keep going so each failing suite reports.
+	@[ -x "$(TEST_PYTHON)" ] || python3 -m venv "$(TEST_VENV)"
+	$(MAKE) --keep-going ci PYTHON="$(TEST_PYTHON)"