Taskfile.scripts.yml

version: '3'

silent: true

tasks:
  help:
    desc: Detailed help
    cmds:
      - |
        echo "Tasks:"
        task --list

  lint:actionlint:
    desc: Lint GitHub Actions workflows with actionlint
    cmds:
      - |
        echo "▶️ Running actionlint..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work rhysd/actionlint:latest -color
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ actionlint passed"
        else
          echo "❌ actionlint failed"
          exit $rc
        fi

  lint:hadolint:
    desc: Lint Dockerfile with hadolint
    cmds:
      - |
        echo "▶️ Running hadolint..."
        if [ ! -f Dockerfile ]; then
          echo "ℹ️ No Dockerfile found, skipping hadolint"
          exit 0
        fi
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work hadolint/hadolint:latest-debian < Dockerfile
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ hadolint passed"
        else
          echo "❌ hadolint failed"
          exit $rc
        fi

  lint:shellcheck:
    desc: Lint shell scripts with shellcheck
    shell: bash
    cmds:
      - |
        echo "▶️ Running shellcheck..."
        mapfile -t files < <(git ls-files '*.sh')
        existing_files=()
        for f in "${files[@]}"; do
          if [ -f "$f" ]; then
            existing_files+=("$f")
          fi
        done
        if [ "${#existing_files[@]}" -eq 0 ]; then
          echo "ℹ️ No shell scripts found, skipping shellcheck"
          exit 0
        fi
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work koalaman/shellcheck:stable -x -S style -- "${existing_files[@]}"
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ shellcheck passed"
        else
          echo "❌ shellcheck failed"
          exit $rc
        fi

  lint:yamllint:
    desc: Lint YAML files with yamllint
    cmds:
      - |
        echo "▶️ Running yamllint..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work cytopia/yamllint -c .yamllint.yml .
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ yamllint passed"
        else
          echo "❌ yamllint failed"
          exit $rc
        fi

  lint:pylint:
    desc: Lint Python files with pylint
    shell: bash
    cmds:
      - |
        set -eu
        echo "▶️ Running pylint..."
        tmp_files="$(mktemp)"
        trap 'rm -f "$tmp_files"' EXIT
        git ls-files -z '*.py' > "$tmp_files"
        if [ ! -s "$tmp_files" ]; then
          echo "ℹ️ No Python files found, skipping pylint"
          exit 0
        fi
        if ! python3 -m pylint --version >/dev/null 2>&1; then
          echo "ℹ️ pylint not found, installing locally..."
          python3 -m pip install --user --quiet pylint==3.3.4
        fi
        xargs -0 python3 -m pylint --rcfile .pylintrc < "$tmp_files"
        echo "✅ pylint passed"

  e2e:list-workflows:
    desc: List E2E workflow files
    shell: bash
    cmds:
      - |
        set -eu
        shopt -s nullglob
        files=(.github/workflows/e2e-*.yml)
        if [ "${#files[@]}" -eq 0 ]; then
          echo "No E2E workflows found"
          exit 0
        fi
        printf '%s\n' "${files[@]}" | sort

  e2e:run:
    desc: Run selected E2E workflow via gh
    shell: bash
    cmds:
      - |
        set -eu
        workflow="${WORKFLOW:-}"
        workflow_ref="${WORKFLOW_REF:-{{.GIT_BRANCH}}}"
        if [ -z "$workflow" ]; then
          echo "ERROR: set WORKFLOW, e.g. WORKFLOW=e2e-action-pull-request.yml"
          exit 1
        fi
        mode="${MODE:-ref}"
        image_tag="${IMAGE_TAG:-}"
        gh workflow run "$workflow" --repo "{{.GH_REPO}}" --ref "$workflow_ref" -f mode="$mode" -f image_tag="$image_tag"
        echo "Triggered workflow '$workflow' in {{.GH_REPO}} on ref '$workflow_ref'"

  e2e:run:all:
    desc: Trigger all E2E action workflows sequentially
    shell: bash
    cmds:
      - |
        set -eu
        workflow_ref="${WORKFLOW_REF:-{{.GIT_BRANCH}}}"
        shopt -s nullglob
        files=(.github/workflows/e2e-action-*.yml)
        if [ "${#files[@]}" -eq 0 ]; then
          echo "No E2E action workflows found"
          exit 0
        fi
        mapfile -t workflows < <(printf '%s\n' "${files[@]}" | xargs -n1 basename | sort)
        mode="${MODE:-ref}"
        image_tag="${IMAGE_TAG:-}"
        for workflow in "${workflows[@]}"; do
          echo "Triggering ${workflow} in {{.GH_REPO}} on ref ${workflow_ref}"
          gh workflow run "$workflow" --repo "{{.GH_REPO}}" --ref "$workflow_ref" -f mode="$mode" -f image_tag="$image_tag"
          sleep 1
        done
        echo "Triggered ${#workflows[@]} workflow(s) on ref '${workflow_ref}'."

  e2e:view-latest:
    desc: Show latest run for selected E2E workflow
    shell: bash
    cmds:
      - |
        set -eu
        workflow="${WORKFLOW:-}"
        if [ -z "$workflow" ]; then
          echo "ERROR: set WORKFLOW, e.g. WORKFLOW=e2e-action-pull-request.yml"
          exit 1
        fi
        gh run list --repo "{{.GH_REPO}}" --workflow "$workflow" --limit 1

  e2e:watch:
    desc: Watch a workflow run by RUN_ID
    shell: bash
    cmds:
      - |
        set -eu
        run_id="${RUN_ID:-}"
        if [ -z "$run_id" ]; then
          echo "ERROR: set RUN_ID"
          exit 1
        fi
        gh run watch "$run_id" --repo "{{.GH_REPO}}"

  test:coverage:report:
    desc: Report action input coverage from local tests and E2E workflows
    shell: bash
    cmds:
      - |
        set -eu
        workspace_root="${WORKSPACE_ROOT:-$(dirname "$PWD")}"
        python3 scripts/check_action_input_coverage.py \
          --workspace-root "$workspace_root" \
          --repo-root "$PWD" \
          --baseline-file "$PWD/tests/coverage-baseline.json"

  test:coverage:gate:
    desc: Fail on new uncovered action inputs not in baseline
    shell: bash
    cmds:
      - |
        set -eu
        workspace_root="${WORKSPACE_ROOT:-$(dirname "$PWD")}"
        python3 scripts/check_action_input_coverage.py \
          --workspace-root "$workspace_root" \
          --repo-root "$PWD" \
          --baseline-file "$PWD/tests/coverage-baseline.json" \
          --strict

  dependency:update:
    desc: 'No-op: no dedicated dependency updater configured for this profile'
    cmds:
      - |
        echo "INFO: No dedicated dependency updater configured for this repository profile."
        echo "INFO: Dependabot handles GitHub Actions and package metadata updates."
        echo "INFO: Keep this task as a safe no-op until a repo-specific dependency updater is defined."

  git:get-pr-template:
    desc: Get pull request template
    cmds:
      - mkdir -p .tmp
      - curl -LsS https://raw.githubusercontent.com/devops-infra/.github/master/PULL_REQUEST_TEMPLATE.md -o .tmp/PULL_REQUEST_TEMPLATE.md

  git:set-config:
    desc: Set git user config
    cmds:
      - git config user.name "github-actions[bot]"
      - git config user.email "github-actions[bot]@users.noreply.github.com"

  version:get:
    desc: Get current version
    cmds:
      - echo "{{.VERSION}}"

  version:set:
    desc: Validate version
    cmds:
      - |
        if [ -z "{{.VERSION}}" ]; then
          echo "❌ ERROR: VERSION is empty"
          exit 1
        fi
        if ! echo "{{.VERSION}}" | grep -Eq '^v?[0-9]+\.[0-9]+\.[0-9]+$'; then
          echo "❌ ERROR: VERSION '{{.VERSION}}' is not a valid semantic version (expected vX.Y.Z or X.Y.Z)"
          exit 1
        fi

  version:update:patch:
    desc: Increment patch version (e.g., 1.2.3 -> 1.2.4)
    cmds:
      - task version:set VERSION=v{{.MAJOR}}.{{.MINOR}}.{{.NEXT_PATCH}}

  version:update:minor:
    desc: Increment minor version (e.g., 1.2.3 -> 1.3.0)
    cmds:
      - task version:set VERSION=v{{.MAJOR}}.{{.NEXT_MINOR}}.0

  version:update:major:
    desc: Increment major version (e.g., 1.2.3 -> 2.0.0)
    cmds:
      - task version:set VERSION=v{{.NEXT_MAJOR}}.0.0

  version:resolve-next:
    desc: Resolve next version from bump type and profile
    cmds:
      - |
        set -eu
        bump_type="${BUMP_TYPE:-patch}"
        input_version="${INPUT_VERSION:-}"

        normalize_version() {
          candidate="${1#v}"
          if ! printf "%s" "${candidate}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            return 1
          fi
          printf "v%s" "${candidate}"
        }

        current="$(task version:get 2>/dev/null || true)"

        case "$bump_type" in
          set)
            [ -n "$input_version" ] || { echo "Missing version for type=set"; exit 1; }
            next="$(normalize_version "$input_version")" || {
              echo "Invalid explicit version: $input_version. Expected vX.Y.Z or X.Y.Z"
              exit 1
            }
            ;;
          patch|minor|major)
            [ -n "$current" ] || { echo "Current version not found or invalid. Expected vX.Y.Z"; exit 1; }
            current="$(normalize_version "$current")" || { echo "Current version not found or invalid. Expected vX.Y.Z"; exit 1; }
            no_v="${current#v}"
            major="$(printf "%s" "$no_v" | awk -F. '{print $1}')"
            minor="$(printf "%s" "$no_v" | awk -F. '{print $2}')"
            patch="$(printf "%s" "$no_v" | awk -F. '{print $3}')"
            case "$bump_type" in
              patch) next="v${major}.${minor}.$((patch + 1))" ;;
              minor) next="v${major}.$((minor + 1)).0" ;;
              major) next="v$((major + 1)).0.0" ;;
            esac
            ;;
          *)
            echo "Unknown type: $bump_type"
            exit 1
            ;;
        esac

        printf "%s" "$next"

  version:tag-release:
    desc: Create set of git tags
    cmds:
      - |
        set -eu
        if (set -o | grep -q pipefail) 2>/dev/null; then set -o pipefail; fi

        REMOTE='origin'
        FULL='{{.VERSION_FULL}}'
        MINOR='{{.VERSION_MINOR}}'
        MAJOR='{{.VERSION_MAJOR}}'

        # Validate vX.Y.Z
        if ! printf "%s" "$FULL" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
          echo "❌ ERROR: VERSION '$FULL' must match vX.Y.Z" >&2
          exit 1
        fi

        tag_sha() { git rev-parse "refs/tags/$1" 2>/dev/null || true; }
        remote_tag_sha() { git ls-remote --tags "$REMOTE" "refs/tags/$1" 2>/dev/null | awk '{print $1}' || true; }

        echo "ℹ️ INFO: Tags - Full: $FULL | Minor: $MINOR | Major: $MAJOR"

        # Full tag: must NOT exist on remote; fail fast if it does
        full_remote_sha="$(remote_tag_sha "$FULL")"
        if [ -n "$full_remote_sha" ]; then
          echo "❌ ERROR: Full tag '$FULL' already exists on remote; aborting" >&2
          exit 1
        fi

        # Create full tag locally (if missing) and push
        if git rev-parse --quiet --verify "refs/tags/$FULL" >/dev/null 2>&1; then
          echo "ℹ️ INFO: Full tag '$FULL' exists locally but not on remote; pushing"
        else
          echo "ℹ️ INFO: Creating full tag '$FULL'"
          git tag --annotate "$FULL" --message "$FULL"
        fi
        git push "$REMOTE" "refs/tags/$FULL"
        echo "✅ OK: Pushed full tag '$FULL'"

        # Minor tag: create or update
        git tag --force --annotate "$MINOR" --message "$FULL"
        minor_local_sha="$(tag_sha "$MINOR")"
        minor_remote_sha="$(remote_tag_sha "$MINOR")"
        if [ -z "$minor_remote_sha" ]; then
          git push "$REMOTE" "refs/tags/$MINOR"
          echo "✅ OK: Created and pushed minor tag '$MINOR' -> $minor_local_sha"
        else
          if [ "$minor_local_sha" != "$minor_remote_sha" ]; then
            echo "⚠️ WARN: Updating remote minor tag '$MINOR' to $minor_local_sha (was $minor_remote_sha)"
            git push --force "$REMOTE" "refs/tags/$MINOR"
          else
            echo "ℹ️ INFO: Minor tag '$MINOR' already up-to-date"
          fi
        fi

        # Major tag: create or update
        git tag --force --annotate "$MAJOR" --message "$FULL"
        major_local_sha="$(tag_sha "$MAJOR")"
        major_remote_sha="$(remote_tag_sha "$MAJOR")"
        if [ -z "$major_remote_sha" ]; then
          git push "$REMOTE" "refs/tags/$MAJOR"
          echo "✅ OK: Created and pushed major tag '$MAJOR' -> $major_local_sha"
        else
          if [ "$major_local_sha" != "$major_remote_sha" ]; then
            echo "⚠️ WARN: Updating remote major tag '$MAJOR' to $major_local_sha (was $major_remote_sha)"
            git push --force "$REMOTE" "refs/tags/$MAJOR"
          else
            echo "ℹ️ INFO: Major tag '$MAJOR' already up-to-date"
          fi
        fi