From d68734267bbc11b21c77279d44529a7e5c1d9a79 Mon Sep 17 00:00:00 2001
From: sjat <sjat@ziethen.dk>
Date: Thu, 18 Jun 2026 12:45:38 +0200
Subject: [PATCH] feat(make): test-integration / test-integration-clean targets

Add ADR-025 integration-test harness targets to Makefile:
- test-integration HOST=<name> [CERTS=internal|le-staging] [KEEP=1]
- test-integration-clean (prune stale VM snapshots)

Also add tests/integration/.run/ to .gitignore.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore |  3 +++
 Makefile   | 15 ++++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index f83b0fc..b948d86 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,3 +34,6 @@ terraform/**/terraform.tfvars
 
 # Service-UI verification screenshots (kept locally on ubongo, not committed — ADR-017)
 .verify-runs/
+
+# Integration-test transient run dir (ADR-025); diagnostics live under ~/integration-runs
+tests/integration/.run/
diff --git a/Makefile b/Makefile
index a23efff..0b3bf0c 100644
--- a/Makefile
+++ b/Makefile
@@ -39,7 +39,8 @@ endif
 
 .DEFAULT_GOAL := help
 
-.PHONY: help setup collections lint test test-all check deploy encrypt decrypt \
+.PHONY: help setup collections lint test test-all test-integration test-integration-clean \
+        check deploy encrypt decrypt \
         edit-vault check-vault new-role \
         tf-init tf-plan tf-apply tf-output tf-inventory tf-inventory-offsite \
         molecule-image molecule-image-push caddy-image caddy-image-push registry-login
@@ -53,6 +54,8 @@ help:
 	@echo "  make lint                          Run yamllint + ansible-lint"
 	@echo "  make test ROLE=<name>              Run Molecule tests for a role"
 	@echo "  make test-all                      Run Molecule tests for all roles"
+	@echo "  make test-integration HOST=<name> [CERTS=internal|le-staging] [KEEP=1]   Run ADR-025 integration cycle against a VM"
+	@echo "  make test-integration-clean        Prune stale integration-test VM snapshots"
 	@echo "  make check PLAYBOOK=<name> [LIMIT=<host>] [TAGS=<tags>]   Dry-run a playbook (check mode)"
 	@echo "  make deploy PLAYBOOK=<name> [LIMIT=<host>] [TAGS=<tags>]  Run a playbook against production"
 	@echo "  make edit-vault [VAULT=<path>]     Edit the vault in nvim (auto re-encrypts + checks)"
@@ -109,6 +112,16 @@ test-all:
 	  cd $$role && PATH="$(CURDIR)/$(VENV)/bin:$$PATH" molecule test; cd ../..; \
 	done
 
+test-integration:
+ifndef HOST
+	$(error HOST is required: make test-integration HOST=<name> [CERTS=internal|le-staging] [KEEP=1])
+endif
+	PATH="$(CURDIR)/$(VENV)/bin:$$PATH" $(PYTHON) scripts/integration-vm.py cycle \
+	  --host $(HOST) $(if $(CERTS),--certs $(CERTS)) $(if $(KEEP),--keep)
+
+test-integration-clean:
+	PATH="$(CURDIR)/$(VENV)/bin:$$PATH" $(PYTHON) scripts/integration-vm.py prune
+
 # ── Playbook execution ────────────────────────────────────────────────────────
 
 check: