Taskfile.yml

# yaml-language-server: $schema=https://taskfile.dev/schema.json
---
version: "3"

set:
  - pipefail

run: once

vars:
  COVERAGE_MIN: "90"
  BIN_DIR: bin
  # renovate: datasource=github-releases depName=orhun/git-cliff
  GIT_CLIFF_VERSION: v2.13.1
  GIT_CLIFF_BIN: "{{.BIN_DIR}}/git-cliff"
  CLIFF_CONFIG: hack/release/cliff.toml
  # renovate: datasource=github-releases depName=fe3dback/go-arch-lint
  GO_ARCH_LINT_VERSION: v1.17.0
  # renovate: datasource=github-releases depName=golangci/golangci-lint
  GOLANGCI_LINT_VERSION: v2.12.2
  # renovate: datasource=github-releases depName=gitleaks/gitleaks
  GITLEAKS_VERSION: "8.30.1"

env:
  CGO_ENABLED: "0"
  COVERAGE_MIN: "{{.COVERAGE_MIN}}"

tasks:
  default:
    desc: Run the full local check gate
    cmds:
      - task: check

  fmt:
    desc: Format Go sources
    cmds:
      - gofmt -w .

  fmt-check:
    desc: Fail if gofmt would change files
    cmds:
      - |
        out="$(gofmt -l .)"
        if [[ -n "$out" ]]; then
          echo "gofmt needed on:" >&2
          echo "$out" >&2
          exit 1
        fi

  vet:
    desc: Run go vet
    cmds:
      - go vet ./...

  lint:
    desc: Run golangci-lint
    cmds:
      - |
        if command -v golangci-lint >/dev/null 2>&1; then
          golangci-lint run ./...
        else
          go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@{{.GOLANGCI_LINT_VERSION}} run ./...
        fi

  arch-lint:
    desc: Enforce internal package dependency graph (go-arch-lint)
    cmds:
      - go run -mod=mod github.com/fe3dback/go-arch-lint@{{.GO_ARCH_LINT_VERSION}} check --arch-file .go-arch-lint.yml

  test:
    desc: Run unit tests
    cmds:
      - go test ./...

  coverage:
    desc: Run tests with whole-module coverage floor (COVERAGE_MIN, default 90)
    cmds:
      - bash hack/coverage.sh

  gitleaks:
    desc: Scan the working tree for secrets
    cmds:
      - |
        if ! command -v gitleaks >/dev/null 2>&1; then
          echo "gitleaks not found on PATH; install from https://github.com/gitleaks/gitleaks/releases ({{.GITLEAKS_VERSION}})" >&2
          exit 1
        fi
        gitleaks detect --source . --config .github/gitleaks.toml --verbose --redact --no-git

  build:
    desc: Build the CLI binary
    cmds:
      - mkdir -p bin
      - go build -ldflags="-X main.version=0.0.0-dev" -o bin/kollect-render ./cmd/kollect-render

  rewe-trace:
    desc: Fail if forbidden internal markers appear in tracked files
    cmds:
      - bash hack/rewe-trace.sh

  pinned-actions:
    desc: Fail if any workflow action is not pinned to a full commit SHA
    cmds:
      - bash hack/pinned-actions.sh

  guards:
    desc: Run the hack/test/*.sh config regression guards
    cmds:
      - |
        fail=0
        for t in hack/test/*.sh; do
          if bash "$t" >/dev/null 2>&1; then
            echo "ok: $t"
          else
            echo "FAIL: $t" >&2
            bash "$t" || true
            fail=1
          fi
        done
        exit "$fail"

  tools:git-cliff:
    desc: Download pinned git-cliff binary ({{.GIT_CLIFF_VERSION}})
    status:
      - test -x {{.GIT_CLIFF_BIN}}
    cmds:
      - bash hack/install-git-cliff.sh {{.GIT_CLIFF_VERSION}} {{.GIT_CLIFF_BIN}}

  changelog:
    desc: Preview unreleased changelog section (stdout)
    deps: [tools:git-cliff]
    cmds:
      - "{{.GIT_CLIFF_BIN}} --config {{.CLIFF_CONFIG}} --unreleased -o -"

  changelog:write:
    desc: Regenerate CHANGELOG.md from git tags and unreleased commits
    deps: [tools:git-cliff]
    cmds:
      - "{{.GIT_CLIFF_BIN}} --config {{.CLIFF_CONFIG}} -o CHANGELOG.md"

  changelog:release:
    desc: Print changelog section for the latest tag (release notes)
    deps: [tools:git-cliff]
    cmds:
      - "{{.GIT_CLIFF_BIN}} --config {{.CLIFF_CONFIG}} --latest -o -"

  changelog:verify:
    desc: Fail if CHANGELOG.md is stale (CI)
    deps: [tools:git-cliff]
    cmds:
      - bash hack/verify-changelog.sh

  check:
    desc: Local gate — fmt, lint, arch, coverage≥90%, gitleaks, build, REWE-trace, pinned-actions, guards
    cmds:
      - task: fmt-check
      - task: vet
      - task: lint
      - task: arch-lint
      - task: coverage
      - task: gitleaks
      - task: build
      - task: rewe-trace
      - task: pinned-actions
      - task: guards

  docs:install:
    desc: Install the locked MkDocs toolchain into .venv-docs
    sources:
      - docs/requirements-docs.txt
    generates:
      - .venv-docs/bin/mkdocs
    cmds:
      - uv venv --python 3.12 .venv-docs
      - uv pip install --python .venv-docs/bin/python --require-hashes -r docs/requirements-docs.txt

  docs:build:
    desc: Build the MkDocs Material site into site/ (strict)
    deps: [docs:install]
    cmds:
      - .venv-docs/bin/mkdocs build --strict

  docs:check:
    desc: Strict docs build — unrecognized links and nav warnings fail
    deps: [docs:build]

  docs:lock:
    desc: Regenerate docs/requirements-docs.txt from docs/requirements-docs.in
    cmds:
      - uv pip compile --generate-hashes --python-version 3.12 --output-file docs/requirements-docs.txt docs/requirements-docs.in