Refused host targets unless you shout the magic words

Author: flyingrobots

ACTIVITY.log.jsonl

@@ -7,3 +7,4 @@
 {"who": "AGENT", "what": "Preparing commit for namespace rename to GITLEDGER", "where": [".clang-tidy", "include/libgitledger/version.h", "src/version.c"], "when": 1761212294, "why": "Need to record work before committing user-supplied METAGRAPH_ -> GITLEDGER_ changes", "how": "Reviewed diffs touching naming prefixes and version constants to ensure consistency", "protip": "Always log before you commit, especially when reconciling someone else's edits"}
 {"who": "AGENT", "what": "Containerized default build/test workflow", "where": ["Makefile", "tools/container/", "tools/testing/prepare-fixtures.sh"], "when": 1761214089, "why": "Keep local builds isolated and mirror the CI matrix to avoid corrupting developer checkouts", "how": "Added Docker image + orchestration scripts, per-matrix sandbox copies, fixture repo preparation, and host override flag; validated with make cmake/test-cmake/tidy", "protip": "Always force CI parity locally\u2014if your make target doesn't match GitHub Actions, your bug reproductions will lie to you"}
 {"who": "AGENT", "what": "Documented container-first workflow and host override", "where": ["README.md", "CONTRIBUTING.md"], "when": 1761214111, "why": "Need to warn contributors about destructive tests and explain the new Docker harness", "how": "Replaced direct build instructions with container commands, added guidance on I_KNOW_WHAT_I_AM_DOING and lint expectations", "protip": "Docs rot fast\u2014ship the how-to steps in the same change you land the tooling"}
+{"who": "AGENT", "what": "Added host safety guard for make targets", "where": ["Makefile", "README.md", "CONTRIBUTING.md"], "when": 1761216127, "why": "Ensure host builds/tests explode unless the acknowledgement flag is set when outside Docker", "how": "Added guard macro to host-* make targets and clarified docs about the requirement", "protip": "Belt-and-suspenders: gate the interface _and_ document the sharp edge you\u2019re hiding"}

CONTRIBUTING.md

@@ -16,8 +16,8 @@ Thanks for helping build `libgitledger`! This document complements the roadmap a
   These jobs copy the repo into isolated workspaces, prepare sandbox Git
   fixtures, and remove all remotes before mutating anything.
 - If you must run against the host checkout, export `I_KNOW_WHAT_I_AM_DOING=1`
-  and call the desired target. The plain make targets will refuse to run on the
-  host without that acknowledgement.
+  and call the desired target. The makefile will otherwise abort host targets
+  unless it detects the container guard.
 - Align tooling: warning flags, optional dependencies, and targets must stay consistent across CMake and Meson.
 - When adding dependencies, update both build descriptions and mention the change in the relevant issue.
 - Run `make lint` (containerised clang-format + clang-tidy) before submitting a

Makefile

@@ -6,11 +6,13 @@ CLANG_FORMAT ?= clang-format
 CLANG_TIDY ?= clang-tidy
 
 DISPATCH := tools/container/dispatch.sh
+HOST_GUARD = @if [ "$${LIBGITLEDGER_IN_CONTAINER:-0}" != "1" ] && [ "$${I_KNOW_WHAT_I_AM_DOING:-0}" != "1" ]; then echo "Refusing to run host target outside Docker without I_KNOW_WHAT_I_AM_DOING=1" >&2; exit 1; fi
 
 cmake:
 	@$(DISPATCH) cmake
 
 host-cmake:
+	$(HOST_GUARD)
 	cmake -S . -B build-debug -G Ninja -DCMAKE_BUILD_TYPE=Debug -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
 	cmake --build build-debug
 	cmake -S . -B build-release -G Ninja -DCMAKE_BUILD_TYPE=Release
@@ -20,6 +22,7 @@ meson:
 	@$(DISPATCH) meson
 
 host-meson:
+	$(HOST_GUARD)
 	@if [ -d meson-debug ]; then \
 		meson setup meson-debug --buildtype debugoptimized --reconfigure; \
 	else \
@@ -37,13 +40,15 @@ both:
 	@$(DISPATCH) both
 
 host-both:
+	$(HOST_GUARD)
 	$(MAKE) host-cmake
 	$(MAKE) host-meson
 
 test-cmake:
 	@$(DISPATCH) test-cmake
 
 host-test-cmake:
+	$(HOST_GUARD)
 	$(MAKE) host-cmake
 	ctest --test-dir build-debug --output-on-failure
 	ctest --test-dir build-release --output-on-failure
@@ -52,6 +57,7 @@ test-meson:
 	@$(DISPATCH) test-meson
 
 host-test-meson:
+	$(HOST_GUARD)
 	$(MAKE) host-meson
 	meson test -C meson-debug --print-errorlogs
 	meson test -C meson-release --print-errorlogs
@@ -60,6 +66,7 @@ test-both:
 	@$(DISPATCH) test-both
 
 host-test-both:
+	$(HOST_GUARD)
 	$(MAKE) host-test-cmake
 	$(MAKE) host-test-meson
 
@@ -73,19 +80,22 @@ format-check:
 	@$(DISPATCH) format-check
 
 host-format-check:
+	$(HOST_GUARD)
 	tools/lint/clang_format_check.sh $(CLANG_FORMAT)
 
 lint:
 	@$(DISPATCH) lint
 
 host-lint:
+	$(HOST_GUARD)
 	$(MAKE) host-format-check
 	$(MAKE) host-tidy
 
 tidy:
 	@$(DISPATCH) tidy
 
 host-tidy:
+	$(HOST_GUARD)
 	@if [ "${RUN_TIDY:-1}" = "0" ]; then \
 		echo "Skipping clang-tidy because RUN_TIDY=0"; \
 	else \

README.md

@@ -53,8 +53,8 @@ I_KNOW_WHAT_I_AM_DOING=1 make test-both
 ```
 
 You can still invoke the underlying host targets directly (`make host-cmake`,
-`make host-test-meson`, etc.), but doing so without the acknowledgement flag is
-strongly discouraged.
+`make host-test-meson`, etc.), but they now abort unless you exported the
+acknowledgement flag or are already inside the container environment.
 
 ### Clean / format helpers