Taskfile.yml

# Copyright 2026 — see LICENSE file for terms.

version: "3"

vars:
  BINARY: aifr
  release_tag_message_prefix: aifr version
  version_embedded_file: internal/version/version.go

env:
  # Allow a version override to come before the command as an env override,
  # OR to come after the command as a var-assignment.
  #
  # We do this at the top-level because `release:commits-and-tag` uses a
  # sub-process to invoke us, to get the version into a shell variable, and we
  # need the CLI assignment to propagate into the environment.
  # Note though that we do need to explicitly unset this for the _second_ invocation.
  VERSION_OVERRIDE: "{{.VERSION_OVERRIDE}}"

tasks:
  default:
    deps: [help]

  help:
    silent: true
    cmds:
      - |
        cat <<'EOHELP'
        There are various commands available, see `task -l` for more details
        EOHELP

  build:
    desc: Build the aifr binary
    sources:
      - "**/*.go"
      - go.mod
      - go.sum
    generates:
      - "{{.BINARY}}"
    vars:
      repo_version:
        sh: git describe --dirty --always --tags 2>/dev/null || echo dev
    env:
      VERSION: "{{.VERSION | default .repo_version}}"
    cmds:
      - |-2
        set -eu
        ns='go.pennock.tech/aifr/internal/version'
        COMMIT="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
        BUILD_DATE="$(git log -1 --format=%cI 2>/dev/null || echo unknown)"
        LDFLAGS="-s -w -X $ns.Version=${VERSION} -X $ns.Commit=${COMMIT} -X $ns.BuildDate=${BUILD_DATE}"
        CGO_ENABLED=0 go build -v -ldflags="${LDFLAGS}" -trimpath -o {{.BINARY}} ./cmd/aifr

  test:
    desc: Run all tests
    cmds:
      - go test -count=1 -race ./...

  test:coverage:
    desc: Run tests with coverage
    cmds:
      - go test -race -coverprofile=coverage.out ./...
      - go tool cover -html=coverage.out -o coverage.html

  fmt:
    desc: Format Go source files
    cmds:
      - go fmt ./...

  tidy:
    desc: Tidy module dependencies
    cmds:
      - go mod tidy

  lint:
    desc: Run static analysis
    cmds:
      - go vet ./...

  clean:
    desc: Remove built artifacts
    cmds:
      - rm -f {{.BINARY}}
      - rm -f coverage.out coverage.html

  check:
    desc: Run all checks (fmt, lint, test)
    cmds:
      - task: fmt
      - task: lint
      - task: test

  release:snapshot:
    desc: Create a snapshot release
    cmds:
      - goreleaser release --snapshot --clean --skip=sign

  ci:check-github:
    desc: Validate GitHub Actions workflows with zizmor
    preconditions:
      - sh: command -v zizmor
        msg: >-
          zizmor is not installed.
          Install via: pip install zizmor  (or: cargo install zizmor)
    cmds:
      - zizmor --format plain .github/workflows/

  ci:pin-actions:
    desc: Pin GitHub Actions to exact commit SHAs using pinact
    preconditions:
      - sh: command -v pinact
        msg: >-
          pinact is not installed.
          Install via: go install github.com/suzuki-shunsuke/pinact/cmd/pinact@latest
    cmds:
      # See explanation below for when we're bumping the versions.
      - pinact run --min-age 4

  ci:pin-bump-actions:
    desc: Bump pins of GitHub Actions
    preconditions:
      - sh: command -v pinact
        msg: >-
          pinact is not installed.
          Install via: go install github.com/suzuki-shunsuke/pinact/cmd/pinact@latest
    cmds:
      # The minimum age is a cool-down defense against supply-chain attacks.
      # We can always manually bump something explicitly if we know we must get a particular fix.
      # Background reading:
      #  * <https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns>
      #  * <https://nesbitt.io/2026/03/04/package-managers-need-to-cool-down.html>
      - pinact run --min-age 4 --update

  next-version:show:
    desc: Show the next version to use
    silent: true
    deps: [_have_cargo_tool:convco]
    env:
      task_exe: "{{.TASK_EXE}}"
      task_name: "{{.TASK}}"
    cmd: |-2
      shopt -s extglob
      if [[ -n "${VERSION_OVERRIDE:-}" ]]; then
        case "$VERSION_OVERRIDE" in
          ( v+([0-9]).+([0-9]).+([0-9])?(-*) ) printf '%s\n'  "$VERSION_OVERRIDE" ;;
          (  +([0-9]).+([0-9]).+([0-9])?(-*) ) printf '%s\n' "v$VERSION_OVERRIDE" ;;
          *) echo >&2 "${task_exe}: ${task_name}: REJECTING dubious VERSION_OVERRIDE=${VERSION_OVERRIDE@Q}"; exit 65 ;;
        esac
        exit 0
      fi
      old="$(convco version --pp)"
      pure="$(convco version --pp --bump)"
      if [[ "$old" != "$pure" ]]; then
        printf '%s\n' "$pure"
        exit 0
      fi
      if convco check "${old}..HEAD" >/dev/null; then
        # all commits were conventional
        current="$(git describe)"
        if [[ "$current" == "$old" ]]; then
          # We are at the release, we bump to -dev
          echo "$(convco version --pp --patch)-dev"
        else
          echo >&2 "${task_exe}: ${task_name}: error: ${old@Q}..${current@Q} has commits and were all conventional but failed to get a version bump"
          exit 1
        fi
      else
        # I have not been behaving
        convco version --pp --patch
      fi

  next-version:write:
    desc: update repo_version.go with the next version
    deps: [_have_cargo_tool:convco]
    env:
      version_file: "{{.version_embedded_file}}"
    cmd: |-2
      nv="$(task next-version:show)"
      sed -i.bak -Ee s'/^(const[[:space:]]+HARDCODED_VERSION[[:space:]]+=[[:space:]]+")[^"]+"/\1'"$nv"'"/' "$version_file"
      rm -f "${version_file}.bak"

  release:preflight:
    desc: Verify we're on main and up-to-date with all remotes
    internal: true
    silent: true
    env:
      task_exe: "{{.TASK_EXE}}"
      task_name: "{{.TASK}}"
    cmd: |-2
      branch="$(git rev-parse --abbrev-ref HEAD)"

      # FUTURE: also allow release/v* branches (see release:commits-and-tag for full design notes)
      if [[ "$branch" != "main" ]]; then
        echo >&2 "${task_exe}: ${task_name}: must be on 'main', currently on ${branch@Q}"
        exit 1
      fi

      if ! git diff --quiet || ! git diff --cached --quiet; then
        echo >&2 "${task_exe}: ${task_name}: working tree or index is dirty — commit or stash first"
        exit 1
      fi

      git fetch --all --quiet

      local_sha="$(git rev-parse HEAD)"
      stale=()
      while IFS= read -r remote; do
        remote_ref="refs/remotes/${remote}/${branch}"
        if ! git rev-parse --verify "$remote_ref" >/dev/null 2>&1; then
          continue
        fi
        remote_sha="$(git rev-parse "$remote_ref")"
        if [[ "$remote_sha" == "$local_sha" ]]; then
          continue
        fi
        # Remote is strictly behind us — that's fine (we have unpushed commits, or are about to)
        if git merge-base --is-ancestor "$remote_sha" "$local_sha"; then
          continue
        fi
        stale+=("${remote}/${branch} (${remote_sha::12})")
      done < <(git remote)

      if [[ ${#stale[@]} -gt 0 ]]; then
        echo >&2 "${task_exe}: ${task_name}: local ${branch} is behind or has diverged from:"
        printf >&2 '  - %s\n' "${stale[@]}"
        echo >&2 "Pull or rebase before releasing."
        exit 1
      fi

  release:commits-and-tag:
    # Deliberately DOES NOT PUSH: a human must review for sanity.
    #
    # CURRENT LIMITATION: assumes release from main.
    # The -dev bump commit is made on the current branch, which is correct for main
    # but wrong for release branches.
    #
    # FUTURE: support release/v* branches.  When on a release branch:
    #   - Do bump + tag only (no -dev bump on the release branch)
    #   - After tagging, print instructions for the merge-to-main step
    #   - The preflight check should also validate the release branch is up-to-date
    #
    # After tagging on a release branch, the tag may need to become an ancestor
    # of main so that git-describe on main produces sane output.  But ONLY if the
    # tag is newer than any tag already reachable from main.  Two cases:
    #
    # (a) Main already has a newer tag (e.g., main is at v2.3.0-dev, release
    #     branch just tagged v1.0.1):  No merge needed.  git-describe on main
    #     already uses the newer tag.  Just sanity-check that main is ahead.
    #
    # (b) The release tag is newer than main's latest tag (e.g., initial release
    #     from a branch just cut from main):  Use a single synthetic merge commit
    #     that records the tag as an ancestor AND bumps main to -dev:
    #       tag="$(git describe)"
    #       next_ver="$(convco version --patch)-dev"
    #       git checkout main
    #       git fetch origin main
    #       git merge --ff-only origin/main  # abort if main has diverged
    #       git diff --quiet && git diff --cached --quiet \
    #         || { echo >&2 "main is dirty"; exit 1; }
    #       VERSION_OVERRIDE="$next_ver" task next-version:write
    #       git add internal/version/version.go
    #       main_tree="$(git write-tree)"
    #       c="$(git commit-tree "$main_tree" -p HEAD -p "$tag" \
    #            -m "merge: record $tag as ancestor & bump to $next_ver")"
    #       git merge --ff-only "$c"
    #     The merge commit's tree contains main's content with the -dev bump,
    #     while its parents link both main and the tag.  One commit, no conflicts,
    #     no misleading diffs.  Uses git plumbing — needs good comments.
    #
    # Defer implementation until we have experience with at least one release branch.
    #
    desc: commit a version bump, tag, commit version bump
    deps: [_have_cargo_tool:convco, release:preflight]
    env:
      release_version:
        sh: task next-version:show
      message_prefix: "{{.release_tag_message_prefix}}"
      version_file: "{{.version_embedded_file}}"
    cmds:
      - '[[ -n "${message_prefix:-}" ]] || { echo >&2 "missing message_prefix, Taskfile problem"; exit 70; }'
      - task: next-version:write
      - 'git commit -o "$version_file" -m "chore: bump hard-coded version to ${release_version}"'
      - 'git tag -s -m "${message_prefix} ${release_version#v}" -e "$release_version"'
      - task: next-version:write
        vars:
          VERSION_OVERRIDE: ""
      - 'git commit -o "$version_file" -m "chore: bump hard-coded version to $(env VERSION_OVERRIDE="" task next-version:show)"'

  _have_cargo_tool:*:  # shim for when the binary name == crate name
    internal: true
    silent: true
    cmds:
      - task: "_have_cargo_tool_crate:{{index .MATCH 0}}:{{index .MATCH 0}}"

  _have_cargo_tool_crate:*:*:  # wildcards are: binary name, then crate
    internal: true
    silent: true
    # if: block seems to not succeed when there's a templated index in there
    env:
      task_exe: "{{.TASK_EXE}}"
      want_bin: "{{index .MATCH 0}}"
      crate: "{{index .MATCH 1}}"
    cmd: |-2
      if command -v "$want_bin" >/dev/null 2>&1; then
        exit 0  # we have it
      fi
      echo >&2 "${task_exe}: missing tool '${want_bin}', consider:  cargo install --locked ${crate@Q}"
      exit 69 # EX_UNAVAILABLE