Add Makefile shims for cibuild and precommit (closes #34)

script/cibuild and script/precommit both existed and were already the
documented CI and pre-commit entrypoints, but neither had a Makefile
target, so the standing rule to drive the repo through make targets
rather than the underlying tool could not be followed for either.

It matters most for the build. A bare `docker build .` fails closed on
the CHECK_EPOCH guard by design, so script/cibuild is one of only three
supported ways to build an image here, and it was the only one of the
three without a target while `make docker` had one.

The two targets are thin shims in the same style as every other target
and change nothing about what the scripts do. .PHONY was already
complete for the targets that existed and now lists both new ones.

README.md's Entrypoints section gains the script-to-target mapping so
the two documents agree, including the two names that do not match:
script/install-precommit is `make hooks`, and script/precommit is
`make precommit`. It also warns that `make cibuild` runs two container
builds and costs minutes, so nobody types it expecting the runtime the
other make targets have.

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks serve
+.PHONY: bootstrap setup test lint fmt fmt-check check docker cibuild precommit hooks serve
 
 bootstrap:
 	@script/bootstrap
@@ -24,6 +24,12 @@ check:
 docker:
 	@script/docker
 
+cibuild:
+	@script/cibuild
+
+precommit:
+	@script/precommit
+
 hooks:
 	@script/install-precommit
 

README.md

@@ -80,6 +80,17 @@ provide:
 - `script/install-precommit` — install the git pre-commit hook that runs
   `script/check`
 
+Each of those has a Makefile shim of the same name — `make bootstrap`,
+`make setup`, `make test`, `make lint`, `make fmt`, `make fmt-check`,
+`make check`, `make docker`, `make cibuild` — with one exception:
+`script/install-precommit` is `make hooks`. `script/precommit`, which is what
+the installed hook runs, is `make precommit`. Prefer the make targets; the
+`Makefile` is the authoritative list of what this repo can do.
+
+`make cibuild` is the slow one. It runs two container builds rather than
+anything on the host, so budget minutes, not the seconds a `make`-shaped command
+usually implies. That is the cost of the CI build, not a sign of a problem.
+
 Every lint run for this repo happens inside a container, and only the lint does.
 `script/lint` has no host path and no "already inside a container?" branch, so
 what a developer runs and what CI runs are the same build. `script/fmt` and

TODO.md

@@ -23,19 +23,43 @@ its response security headers are declared in the repo instead of being whatever
 the edge defaults to — unverified in production until the next deploy. The lint
 now runs inside a container and nowhere else: `script/lint` is a build of
 `Dockerfile.lint`, with no host path to fall back to. Formatting is not a lint
-and stays on the host.
+and stays on the host. Every entrypoint the README documents now has a
+`Makefile` target, so the org-wide "use make targets, never the underlying tool"
+rule is satisfiable for the CI build as well as for the everyday checks.
 
 # Next Step
 
-Add the missing `cibuild` and `precommit` shims to the `Makefile`, so that every
+Make the prettier scope's exclusion of dot-directories explicit instead of
-documented entrypoint has a make target and the documented "always use make
+leaning on `.gitignore` (https://git.eeqj.de/sneak/lora.vegas/issues/33).
-targets" rule is actually satisfiable
-(https://git.eeqj.de/sneak/lora.vegas/issues/34). Done when `make cibuild` and
-`make precommit` exist, are declared `.PHONY`, and the README Entrypoints
-section matches.
 
 # Completed Steps
 
+- 2026-08-10: added the `cibuild` and `precommit` targets to the `Makefile`
+  (https://git.eeqj.de/sneak/lora.vegas/issues/34). Both scripts already
+  existed, were already documented, and are the two entrypoints a contributor is
+  most likely to be told to run — the CI build and what the pre-commit hook runs
+  — yet neither had a make target, so the standing rule to use make targets
+  rather than the underlying tool could not be followed for either. It bit
+  reviewers twice, most recently on
+  https://git.eeqj.de/sneak/lora.vegas/pulls/32, and it bit hardest for the
+  build: since https://git.eeqj.de/sneak/lora.vegas/issues/30 a bare
+  `docker build .` fails closed on the `CHECK_EPOCH` guard, so `script/cibuild`
+  is one of only three supported ways to build an image and was the only one
+  without a target. The two targets are thin shims in the existing style and
+  change nothing about what the scripts do. `.PHONY` was already complete and
+  now lists both. `README.md`'s Entrypoints section gained the script-to-target
+  mapping, including the two names that do not match —
+  `script/install-precommit` is `make hooks`, and `script/precommit` is
+  `make precommit` — plus a warning that `make cibuild` costs minutes because it
+  is two container builds, so nobody types it expecting a `make`-shaped runtime.
+  Verified that `make cibuild` earns its green rather than replaying a warm
+  cache: one invocation ran both builds for real in sequence, each with its own
+  distinct `CHECK_EPOCH`, with `RUN script/bootstrap` `CACHED` above and no
+  check layer cached below it — the `Dockerfile.lint` build echoed its epoch and
+  printed hugo's own build table, then the main image build echoed a different
+  epoch, ran `script/test` for the production build and `script/fmt-check` for
+  the formatting check. `make precommit` passes on a clean tree, and
+  `make check` passes
 - 2026-08-10: moved the lint into Docker
   (https://git.eeqj.de/sneak/lora.vegas/issues/38). A new root `Dockerfile.lint`
   runs `hugo --minify --printPathWarnings` as a build step, so a successful
@@ -283,8 +307,6 @@ section matches.
 Startable work first. Everything under "Blocked" waits on somebody or something
 outside this repo, so nothing there may be picked up as the Next Step.
 
-- Make the prettier scope's exclusion of dot-directories explicit instead of
-  leaning on `.gitignore` (https://git.eeqj.de/sneak/lora.vegas/issues/33)
 - Fix the README's SSH-only clone URL, and add the two entrypoints the
   Entrypoints section omits, `script/precommit` and `script/projectname`
   (https://git.eeqj.de/sneak/lora.vegas/issues/36)