Taskfile.yml

version: "3"

vars:
  BIN_DIR: bin
  GIT_CLIFF_VERSION: v2.13.1
  GIT_CLIFF_BIN: "{{.BIN_DIR}}/git-cliff"
  CLIFF_CONFIG: cliff.toml

tasks:
  default:
    cmds: [task --list]
    silent: true

  fmt:
    desc: Format Go code
    cmds:
      - gofmt -w ./cmd ./internal 2>/dev/null || gofmt -w ./cmd

  vet:
    desc: Static analysis
    cmds:
      - go vet ./...

  lint:
    desc: golangci-lint (requires golangci-lint installed)
    cmds:
      - golangci-lint run ./...

  test:
    desc: Unit tests with race detector
    cmds:
      - go test -race ./...

  coverage:
    # D-010 coverage gate. COVERAGE_MIN below is the SINGLE SOURCE of the floor:
    # .github/workflows/verify.yaml runs this very task rather than re-implementing
    # the threshold, so the local and CI halves cannot skew (D-128). Raise the floor
    # by editing COVERAGE_MIN only — no other GATE may carry its own copy of the
    # number (GUIDELINES.md quotes it as prose and names this var as the source).
    # NOTE: the comparison is against the ONE-DECIMAL total `go tool cover -func`
    # prints, so a floor of 91 really admits anything rounding to 91.0, i.e. ~90.95%.
    desc: "Coverage gate on internal/ (D-010; floor = COVERAGE_MIN, raised to 91 by D-128) — arms itself once internal/ has code"
    vars:
      COVERAGE_MIN: 91
    cmds:
      - |
        if ! ls internal/*/*.go >/dev/null 2>&1; then
          echo "no internal packages yet — gate armed, not applicable"; exit 0
        fi
        go test -coverprofile=cov.out ./internal/...
        pct=$(go tool cover -func=cov.out | awk '/^total:/ {gsub("%","",$3); print $3}')
        echo "coverage: ${pct}% (required: {{.COVERAGE_MIN}}%)"
        awk -v p="$pct" -v min="{{.COVERAGE_MIN}}" 'BEGIN { exit (p+0 >= min+0 ? 0 : 1) }' || { echo "FAIL: coverage below {{.COVERAGE_MIN}}% (D-010, floor raised by D-128)"; exit 1; }

  build:
    desc: Build the CLI
    cmds:
      - CGO_ENABLED=0 go build -ldflags "-X main.version=${ASSENT_VERSION:-0.0.0-dev}" -o bin/assent ./cmd/assent

  dogfood-examples:
    desc: "Dogfood gate (EX-S08): every examples/packs/<name> with .assent/tests gates itself green under the real `assent test` (+ --coverage) CLI — discovered, not hardcoded"
    deps: [build]
    cmds:
      - bash hack/dogfood-examples.sh

  dogfood-comparison:
    desc: "Dogfood gate (PCS-S08): comparison corpus validates and runs green under assent compare --suite"
    cmds:
      - go test ./examples/comparison/...

  check:
    desc: "Gate: fmt + vet + lint + test + build (must pass before every commit)"
    cmds:
      - task: fmt
      - task: vet
      - task: lint
      - task: test
      - task: coverage
      - task: build
      # EX-S08: dogfood the shipped example packs through the real `assent test`
      # CLI, sequential and AFTER build (D-124 lesson: a deps: race with fmt
      # caused a prior bug — this stage runs the built binary, so it belongs
      # after build like docs-gates runs after the tree is otherwise settled).
      - task: dogfood-examples
      - task: dogfood-comparison
      - task: compare-exitgate-test
      # AUD-S02 (REQ-AUD-S02-02): CHANGELOG.md drift gate. It is the LOCAL half of the
      # wiring — CI runs it only off pull_request (D-125). That guard's original reason
      # died with D-136 (the merge ref's synthetic merge subject is now skipped) and its
      # proposed successor measured false; whether the PR placement is viable is now
      # OQ-30, so the guard stands unexplained rather than re-justified.
      # Consequence, stated plainly: a commit that changes history without regenerating
      # CHANGELOG.md makes the NEXT `task check` red until `task changelog-write` is
      # committed.
      - task: changelog-verify
      # AUD-S02: the drift gate's own guard, and the ONLY thing that reds when the
      # `- task: changelog-verify` line above is deleted. Runs after changelog-verify
      # because it probes the real CHANGELOG.md (append + trap restore) — a restore
      # failure must not red the simpler gate for the wrong reason.
      - task: release-changelog-gate-test
      # AUD-S03: the release gate's own guard. Its only other CI caller is release-exitgate,
      # which is skipped on pull_request — without this a regression merges green and only
      # reds main afterwards. Fast and offline (stubbed `gh`); needs jq.
      - task: release-verify-tag-gate-test
      # D-124: the AUD-S06 docs truth-lag gates shipped green and invoked by nothing,
      # which is the same manual-gate defect they exist to close. Sequential (not a
      # `deps:` entry) — go-task runs deps in parallel and readme_smoke_test.sh builds
      # a binary while `fmt` rewrites the tree.
      - task: docs-gates
      # AUD-S07 / D-123: `task lint` proves only the CLEAN depguard polarity. Without
      # this, deleting `- depguard` from .golangci.yml passes every wired gate.
      - task: lint-depguard-test
      # AUD-S09/S14: workflow supply-chain pins (SEC-04 Task pin, SEC-01 ajv
      # lockfile, SEC-03 persist-credentials). Nothing else in `task check` reads
      # .github/workflows/**, so without this line an unpinned workflow is caught
      # only by CI — and only for as long as the CI step itself survives.
      - task: lint-workflow-pins-test
      # EX-S08 (REQ-EX-S08-03): the dogfood-examples gate's own guard. Without
      # this, deleting `- task: dogfood-examples` from check: above passes
      # every wired gate — the same manual-gate defect D-124 closed elsewhere.
      - task: dogfood-wiring-test
      # Operator 2026-08-13: Dependabot is the updater; a reintroduced
      # renovate.json would otherwise merge green.
      - task: ci-audit-test

  ci-audit-test:
    desc: "E9-S04 + Dependabot-only: single CodeQL workflow; no Renovate config"
    cmds:
      - bash hack/release/ci_audit_test.sh

  dogfood-wiring-test:
    desc: "EX-S08 gate: task check runs dogfood-examples after build, and Taskfile.yml/verify.yaml both delegate to hack/dogfood-examples.sh (REQ-EX-S08-02/03)"
    cmds:
      - bash hack/examples/dogfood_wiring_test.sh

  lint-workflow-pins-test:
    desc: "AUD-S09/S14 gate: workflow supply-chain pins are present and the checks can fail (REQ-AUD-S09-01, REQ-AUD-S14-01/02)"
    cmds:
      - bash hack/lint/workflow_pins_test.sh

  lint-depguard-test:
    desc: "AUD-S07 gate: adversarial proof the D-123 depguard boundary rules fire (REQ-AUD-S07-01)"
    cmds:
      - bash hack/lint/depguard_test.sh

  docs-gates:
    desc: "D-124 docs truth-lag gates: README quick-start executes (REQ-AUD-S06-01) + 18 doc pins (REQ-AUD-S06-02)"
    cmds:
      - bash hack/docs/readme_smoke_test.sh
      - bash hack/docs/truthlag_pins_test.sh
      - bash hack/docs/example_format_inventory_test.sh

  compare-exitgate-test:
    desc: "PCS-S09 exit gate: full suite + E6 seed dir + schema drift guard (REQ-PCS-S09-01..03)"
    deps: [build]
    cmds:
      - bash hack/compare/exitgate_test.sh

  determinism:
    desc: "Determinism gate (E7-S04): double-run engine + conformance goldens (-count=2); mirrors verify.yaml"
    cmds:
      - |
        set -e
        go test -count=2 ./internal/core/aggregate/... -run 'TestDeterminismDoubleRun|TestD016ReproductionDoubleRunStable'
        go test -count=2 ./internal/core/decision/... -run TestReportDoubleRunStable
        go test -count=2 ./internal/forge/conformance/... -run 'TestConformanceTargetAdvancedRejected|TestConformanceRerunIdempotence|TestConformanceDuplicateRepair'
        go test -count=2 ./internal/forge/... -run TestMergeFailsClosedDoubleRun
        go test -count=2 ./internal/render/... -run 'TestRenderGoldens|TestRenderSummaryGolden'

  e2e-vet:
    desc: "Compile+vet all e2e-tagged packages (mirrors verify's go vet -tags e2e ./...)"
    cmds:
      - go vet -tags e2e ./...

  e2e-seed:
    desc: "Seed a sample GitLab project from examples/repos/ (see hack/e2e/seed-sample-repo.sh)"
    cmds:
      - ./hack/e2e/seed-sample-repo.sh {{.CLI_ARGS}}

  e2e:
    desc: E2E tests against a real GitLab (build tag e2e) — see test/e2e/README.md
    cmds:
      - go test -tags e2e ./test/e2e/...

  docs:
    desc: Serve the docs site locally
    deps: [docs-install]
    cmds:
      - .venv-docs/bin/mkdocs serve

  docs-build:
    desc: Build the MkDocs site with strict validation
    deps: [docs-install]
    cmds:
      - .venv-docs/bin/mkdocs build --strict

  docs-install:
    desc: Install the locked documentation toolchain
    sources:
      - docs/requirements-docs.txt
    generates:
      - .venv-docs/bin/mkdocs
    cmds:
      - uv venv --python 3.12 .venv-docs
      - uv pip install --python .venv-docs/bin/python --require-hashes -r docs/requirements-docs.txt

  docs-lock:
    desc: Regenerate the hashed documentation dependency lock
    cmds:
      - uv pip compile --generate-hashes --output-file docs/requirements-docs.txt docs/requirements-docs.in

  release-snapshot:
    desc: "Local goreleaser snapshot (E9-S02): cross-platform archives + checksums under dist/"
    vars:
      GORELEASER_VERSION: v2.9.0
    cmds:
      - |
        set -euo pipefail
        export PATH="$(go env GOPATH)/bin:${PATH}"
        if ! command -v goreleaser >/dev/null 2>&1 || ! goreleaser --version 2>&1 | grep -q 'version 2'; then
          go install github.com/goreleaser/goreleaser/v2@{{.GORELEASER_VERSION}}
        fi
        goreleaser release --snapshot --clean --skip=publish,sign,sbom,homebrew

  release-supply-chain-test:
    desc: "Verify E9-S06 supply-chain wiring (REQ-E9-S06 autonomous gates)"
    cmds:
      - bash hack/release/supply_chain_test.sh

  release-brew-test:
    desc: "Verify E9-S07b Homebrew wiring (REQ-E9-S07b-01 autonomous gates)"
    cmds:
      - bash hack/release/brew_test.sh

  release-snapshot-test:
    desc: "Verify snapshot output (REQ-E9-S02-01/02/03)"
    cmds:
      - bash hack/release/snapshot_test.sh

  release-verify:
    desc: "Verify dist/ checksums, optional cosign, stamped version (REQ-E9-S12)"
    cmds:
      - bash hack/release/verify-artifacts.sh

  release-verify-test:
    desc: "Verify artifact harness gates (REQ-E9-S12-01..03)"
    cmds:
      - bash hack/release/verify_test.sh

  release-changelog-gate-test:
    desc: "AUD-S02 gate: the CHANGELOG drift gate is wired and fires (REQ-AUD-S02-01/02)"
    cmds:
      - bash hack/release/changelog_gate_test.sh

  release-verify-tag-gate-test:
    desc: "AUD-S03 gate: verify-green-on-tag-SHA polarity table + release.yaml step order (REQ-AUD-S03-01/02)"
    cmds:
      - bash hack/release/verify_tag_gate_test.sh

  audit-exitgate-test:
    desc: "AUD-S18 exit gate: 2026-08-06 audit conditions closed + gates green at the new bar (REQ-AUD-S18-01/02). NOT in `check` — it runs `task check` itself."
    cmds:
      - bash hack/audit/exitgate_test.sh

  release-exitgate-test:
    desc: "E9-S13 autonomous exit gate: snapshot + verify + docs-build + backlog pins (REQ-E9-S13-01..03)"
    cmds:
      - bash hack/release/exitgate_test.sh

  tools:git-cliff:
    desc: Download pinned git-cliff binary ({{.GIT_CLIFF_VERSION}})
    status:
      - test -x {{.GIT_CLIFF_BIN}}
    cmds:
      - bash hack/install-git-cliff.sh {{.GIT_CLIFF_VERSION}} {{.GIT_CLIFF_BIN}}

  changelog:
    desc: Preview unreleased changelog section (stdout, no SHAs)
    deps: [tools:git-cliff]
    cmds:
      - "{{.GIT_CLIFF_BIN}} --config {{.CLIFF_CONFIG}} --unreleased -o -"

  changelog-write:
    desc: Regenerate CHANGELOG.md from git tags and unreleased commits
    deps: [tools:git-cliff]
    cmds:
      - "{{.GIT_CLIFF_BIN}} --config {{.CLIFF_CONFIG}} -o CHANGELOG.md"

  changelog-verify:
    desc: Fail if CHANGELOG.md is stale vs cliff.toml output (REQ-E9-S03-03)
    deps: [tools:git-cliff]
    cmds:
      - bash hack/release/verify-changelog.sh