feat: run checks in docker

AGENTS.md

@@ -51,22 +51,15 @@ Maintain a deliberately small, self-hosted rota application for a non-profit bar
 
 ## Validation before handoff
 
-Run:
+All checks run inside Docker, never on the host:
 
 ```bash
-python -m compileall -q app
-pytest -q
+make check
 ```
 
-Prefer the containerized suite when the host Python environment is uncertain:
+That is `python -m compileall -q app && pytest -ra` in the `checks` service of `docker-compose.dev.yml`, which bind-mounts `app/`, `tests/` and `pyproject.toml` so it always validates the working tree. Do not run `pytest`, `uvicorn` or `python -m app.cli` against the host interpreter.
 
-```bash
-make test-docker
-# or
-docker compose -f docker-compose.dev.yml --profile test run --rm tests
-```
-
-The `dev` target of the `Dockerfile` installs `requirements-dev.txt` on top of the app image; the `tests` service in `docker-compose.dev.yml` runs `pytest` with throwaway settings (`SECRET_KEY`, `DATABASE_URL`, `INITIAL_ADMIN_PASSWORD`). It bind-mounts `app/`, `tests/` and `pyproject.toml` so the suite always runs the working tree, keeps `data/` inside the container, and does not read `.env`, so it is safe on a fresh clone.
+The `dev` target of the `Dockerfile` installs `requirements-dev.txt` on top of the app image; the `checks` service supplies throwaway settings (`SECRET_KEY`, `DATABASE_URL`, `INITIAL_ADMIN_PASSWORD`), keeps `data/` inside the container, and does not read `.env`, so it is safe on a fresh clone.
 
 `docker-compose.yml` is the service stack only. Anything development-related (auto-reload, bind mounts, test runner) belongs in `docker-compose.dev.yml`.
 

Makefile

@@ -1,7 +1,7 @@
 COMPOSE ?= docker compose
 COMPOSE_DEV = $(COMPOSE) -f docker-compose.dev.yml
 
-.PHONY: dev dev-up dev-down dev-logs test test-docker init-db seed-demo reminders
+.PHONY: dev dev-up dev-down dev-logs check test-docker init-db seed-demo reminders
 
 dev:
 	uvicorn app.main:app --reload
@@ -16,12 +16,12 @@ dev-down:
 dev-logs:
 	$(COMPOSE_DEV) logs -f app
 
-test:
-	pytest -q
+# Compile check plus the test suite, inside Docker.
+check:
+	$(COMPOSE_DEV) --profile check run --rm --build checks
 
-# Runs the suite inside Docker, independent of the host Python environment.
 test-docker:
-	$(COMPOSE_DEV) --profile test run --rm tests
+	$(MAKE) check
 
 init-db:
 	python -m app.cli init-db

README.md

@@ -75,18 +75,16 @@ Example cron entry at 09:00 every day:
 
 ## Tests
 
-```bash
-pytest -q
-```
-
-Or in a container, so the host Python environment does not matter:
+Checks run in a container, so the host Python environment does not matter:
 
 ```bash
-make test-docker
+make check
 # or
-docker compose -f docker-compose.dev.yml --profile test run --rm tests
+docker compose -f docker-compose.dev.yml --profile check run --rm checks
 ```
 
+`make check` runs `python -m compileall -q app && pytest -ra` against the working tree.
+
 ## Project documentation
 
 - `AGENTS.md` — instructions and guardrails for coding agents/LLMs.

docker-compose.dev.yml

@@ -1,6 +1,6 @@
 # Development stack: code is bind-mounted, reload is on, no restart policy.
 # Run standalone:  docker compose -f docker-compose.dev.yml up --build
-# Tests:            docker compose -f docker-compose.dev.yml run --rm tests
+# Checks:           make check
 services:
   app:
     build:
@@ -18,12 +18,12 @@ services:
       - ${DATA_DIR:-./data}:/app/data
     command: ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload"]
 
-  tests:
+  checks:
     build:
       context: .
       target: dev
     profiles:
-      - test
+      - check
     environment:
       SECRET_KEY: test-only-secret-key
       DATABASE_URL: sqlite:///./data/test.db
@@ -33,4 +33,4 @@ services:
       - ./app:/app/app
       - ./tests:/app/tests
       - ./pyproject.toml:/app/pyproject.toml:ro
-    command: ["pytest", "-ra"]
+    command: ["sh", "-c", "python -m compileall -q app && pytest -ra"]