Build code with make, npm, pip, Maven and Go

• Used for: a task runner around docker, go, npm or terraform; the same steps locally and in CI.

$make help
$make build TAG=v1.4.0
$make -n deploy
$make -C services/api test

Good practice:

• Mark task targets .PHONY; recipe lines start with a Tab.
• Keep long logic in scripts; the Makefile only calls them.
• CI runs the same targets as developers (make lint test).

• Used for: frontends and Node.js services; npm ci in Dockerfiles and pipelines.

$npm ci
$npm test
$npm run build
$npm audit --audit-level=high

Good practice:

• Commit package-lock.json; use npm ci, not npm install, in CI.
• --omit=dev in production images; cache ~/.npm in CI.

• Used for: Python services, scripts, and tools like Ansible.

$python3 -m venv .venv && source .venv/bin/activate
$pip install -r requirements.txt
$pip freeze > requirements.txt
$pip install --no-cache-dir -r requirements.txt

Good practice:

• Never sudo pip install on the system Python.
• Pin versions (==) or use a lock file with hashes.

• Used for: company Java services in Jenkins and GitLab pipelines.

$mvn -B clean verify
$mvn -B -DskipTests package
$mvn -B -s ci-settings.xml deploy
$mvn dependency:tree

Good practice:

• -B -ntp for short CI logs; cache ~/.m2/repository.
• Credentials in settings.xml from CI secrets, never in pom.xml.

• Used for: CLIs, exporters, Kubernetes operators; reading the code of Docker, Kubernetes and Terraform.

$go mod tidy
$go test -race ./...
$CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o bin/app .
$GOOS=linux GOARCH=arm64 go build -o bin/app-arm64 .

Good practice:

• Commit go.mod and go.sum; run go vet and govulncheck in CI.
• Build static binaries and use a distroless or scratch base image.

1. Pin the tool versions (Node 22, Go 1.23, Java 21) in the Dockerfile or CI file.
2. Use the lock file of the language (package-lock.json, go.sum, requirements.txt with ==).
3. Build in a multi-stage Dockerfile: big build image, small run image.
4. Cache the package folders in CI (~/.npm, ~/.m2, ~/go/pkg/mod).
5. Push the result to an artifact or image registry, never rebuild the same version twice.