Taskfile.scripts.yml

version: '3'

silent: true

tasks:
  help:
    desc: Detailed help
    cmds:
      - |
        echo "Tasks:"
        task --list
        echo DOCKER_BUILDKIT={{.DOCKER_BUILDKIT}} TERM={{.TERM}}

  lint:actionlint:
    desc: Lint GitHub Actions workflows with actionlint
    cmds:
      - |
        echo "▶️ Running actionlint..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work rhysd/actionlint:latest -color
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ actionlint passed"
        else
          echo "❌ actionlint failed"
          exit $rc
        fi

  lint:hadolint:
    desc: Lint Dockerfile with hadolint
    cmds:
      - |
        echo "▶️ Running hadolint..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work hadolint/hadolint:latest-debian < Dockerfile
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ hadolint passed"
        else
          echo "❌ hadolint failed"
          exit $rc
        fi

  lint:shellcheck:
    desc: Lint shell scripts with shellcheck
    cmds:
      - |
        echo "▶️ Running shellcheck..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work koalaman/shellcheck:stable -x -S style entrypoint.sh
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ shellcheck passed"
        else
          echo "❌ shellcheck failed"
          exit $rc
        fi

  lint:yamllint:
    desc: Lint YAML files with yamllint
    cmds:
      - |
        echo "▶️ Running yamllint..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work cytopia/yamllint -c .yamllint.yml .
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ yamllint passed"
        else
          echo "❌ yamllint failed"
          exit $rc
        fi

  git:get-pr-template:
    desc: Get pull request template
    cmds:
      - mkdir -p .tmp
      - curl -LsS https://raw.githubusercontent.com/devops-infra/.github/refs/tags/v1/PULL_REQUEST_TEMPLATE.md -o .tmp/PULL_REQUEST_TEMPLATE.md

  git:set-config:
    desc: Set git user config
    cmds:
      - git config user.name "github-actions[bot]"
      - git config user.email "github-actions[bot]@users.noreply.github.com"

  packages:update:
    desc: Update Alpine package pins in alpine-packages.txt
    cmds:
      - |
        set -eu
        if [ ! -f Dockerfile ]; then
          echo "INFO: Dockerfile not found; nothing to update"
          exit 0
        fi
        if [ ! -f alpine-packages.txt ]; then
          echo "INFO: alpine-packages.txt not found; nothing to update"
          exit 0
        fi

        base_image="$(sed -nE 's/^FROM[[:space:]]+([^[:space:]]+).*/\1/p' Dockerfile | head -1)"
        if [ -z "$base_image" ]; then
          echo "INFO: Could not resolve base image; nothing to update"
          exit 0
        fi

        case "$base_image" in
          alpine:*|alpine)
            :
            ;;
          *)
            echo "INFO: Base image is '$base_image', not Alpine; nothing to update"
            exit 0
            ;;
        esac

        alpine_line="${base_image#alpine:}"
        if [ "$alpine_line" = "$base_image" ] || [ -z "$alpine_line" ]; then
          echo "INFO: Could not parse Alpine version from '$base_image'; nothing to update"
          exit 0
        fi
        alpine_minor="$(printf '%s' "$alpine_line" | awk -F. '{print $1 "." $2}')"
        if ! printf '%s' "$alpine_minor" | grep -Eq '^[0-9]+\.[0-9]+$'; then
          echo "INFO: Unsupported Alpine version '$alpine_line'; nothing to update"
          exit 0
        fi
        alpine_repo="v${alpine_minor}"
        arch="x86_64"

        normalize_minor() {
          version="$1"
          printf '%s' "$version" | sed -E 's/^([0-9]+\.[0-9]+).*/\1/'
        }

        fetch_index() {
          repo="$1"
          out="$2"
          url="https://dl-cdn.alpinelinux.org/alpine/${alpine_repo}/${repo}/${arch}/APKINDEX.tar.gz"
          curl --fail --silent --show-error "$url" | tar -O -zx APKINDEX > "$out"
        }

        lookup_latest() {
          pkg="$1"
          for index in "$index_main" "$index_community"; do
            found="$(awk -v pkg="$pkg" '
              BEGIN { RS=""; FS="\n" }
              {
                p=""; v=""
                for (i=1; i<=NF; i++) {
                  if ($i ~ /^P:/) p=substr($i,3)
                  if ($i ~ /^V:/) v=substr($i,3)
                }
                if (p==pkg) { print v; exit }
              }
            ' "$index")"
            if [ -n "$found" ]; then
              printf '%s' "$found"
              return 0
            fi
          done
          return 1
        }

        mkdir -p .tmp
        index_main=".tmp/apkindex-main-${alpine_repo}-${arch}.txt"
        index_community=".tmp/apkindex-community-${alpine_repo}-${arch}.txt"
        fetch_index main "$index_main"
        fetch_index community "$index_community"

        if ! grep -Eq '^[a-zA-Z0-9+_.-]+(=~|~=)[0-9]+\.[0-9]+$' alpine-packages.txt; then
          echo "INFO: No pinned Alpine packages (~=X.Y) found in alpine-packages.txt"
          exit 0
        fi

        tmp_out=".tmp/alpine-packages.updated.txt"
        : > "$tmp_out"
        updated=0
        while IFS= read -r line || [ -n "$line" ]; do
          if [ -z "$line" ] || printf '%s' "$line" | grep -Eq '^[[:space:]]*#'; then
            echo "$line" >> "$tmp_out"
            continue
          fi
          if ! printf '%s' "$line" | grep -Eq '^[a-zA-Z0-9+_.-]+(=~|~=)[0-9]+\.[0-9]+$'; then
            echo "$line" >> "$tmp_out"
            continue
          fi

          pkg="$(printf '%s' "$line" | sed -E 's/^([a-zA-Z0-9+_.-]+)(=~|~=).*/\1/')"
          current_minor="$(printf '%s' "$line" | sed -E 's/^[a-zA-Z0-9+_.-]+(=~|~=)([0-9]+\.[0-9]+).*$/\2/')"
          latest_full="$(lookup_latest "$pkg" || true)"
          if [ -z "$latest_full" ]; then
            echo "WARN: Could not resolve latest version for $pkg; keeping $line"
            echo "$line" >> "$tmp_out"
            continue
          fi

          latest_minor="$(normalize_minor "$latest_full")"
          if [ "$latest_minor" = "$current_minor" ]; then
            echo "OK: $pkg already up to date at $current_minor"
            echo "$pkg~=$current_minor" >> "$tmp_out"
            continue
          fi
          echo "UPDATE: $pkg $current_minor -> $latest_minor"
          echo "$pkg~=$latest_minor" >> "$tmp_out"
          updated=1
        done < alpine-packages.txt

        if ! cmp -s alpine-packages.txt "$tmp_out"; then
          mv "$tmp_out" alpine-packages.txt
        else
          rm -f "$tmp_out"
        fi

        if [ "$updated" -eq 0 ]; then
          echo "INFO: No Alpine package updates were required"
        fi

  version:get:
    desc: Get current version
    cmds:
      - echo "{{.VERSION}}"

  version:set:
    desc: Validate version
    cmds:
      - |
        if [ -z "{{.VERSION}}" ]; then
          echo "❌ ERROR: VERSION is empty"
          exit 1
        fi
        if ! echo "{{.VERSION}}" | grep -Eq '^v?[0-9]+\.[0-9]+\.[0-9]+$'; then
          echo "❌ ERROR: VERSION '{{.VERSION}}' is not a valid semantic version (expected vX.Y.Z or X.Y.Z)"
          exit 1
        fi

  version:update:patch:
    desc: Increment patch version (e.g., 1.2.3 -> 1.2.4)
    cmds:
      - task version:set VERSION=v{{.MAJOR}}.{{.MINOR}}.{{.NEXT_PATCH}}

  version:update:minor:
    desc: Increment minor version (e.g., 1.2.3 -> 1.3.0)
    cmds:
      - task version:set VERSION=v{{.MAJOR}}.{{.NEXT_MINOR}}.0

  version:update:major:
    desc: Increment major version (e.g., 1.2.3 -> 2.0.0)
    cmds:
      - task version:set VERSION=v{{.NEXT_MAJOR}}.0.0

  version:tag-release:
    desc: Create set of git tags
    cmds:
      - |
        set -eu
        if (set -o | grep -q pipefail) 2>/dev/null; then set -o pipefail; fi

        REMOTE='origin'
        FULL='{{.VERSION_FULL}}'
        MINOR='{{.VERSION_MINOR}}'
        MAJOR='{{.VERSION_MAJOR}}'

        # Validate vX.Y.Z
        if ! printf "%s" "$FULL" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
          echo "❌ ERROR: VERSION '$FULL' must match vX.Y.Z" >&2
          exit 1
        fi

        tag_sha() { git rev-parse "refs/tags/$1" 2>/dev/null || true; }
        remote_tag_sha() { git ls-remote --tags "$REMOTE" "refs/tags/$1" 2>/dev/null | awk '{print $1}' || true; }

        echo "ℹ️ INFO: Tags - Full: $FULL | Minor: $MINOR | Major: $MAJOR"

        # Full tag: must NOT exist on remote; fail fast if it does
        full_remote_sha="$(remote_tag_sha "$FULL")"
        if [ -n "$full_remote_sha" ]; then
          echo "❌ ERROR: Full tag '$FULL' already exists on remote; aborting" >&2
          exit 1
        fi

        # Create full tag locally (if missing) and push
        if git rev-parse --quiet --verify "refs/tags/$FULL" >/dev/null 2>&1; then
          echo "ℹ️ INFO: Full tag '$FULL' exists locally but not on remote; pushing"
        else
          echo "ℹ️ INFO: Creating full tag '$FULL'"
          git tag --annotate "$FULL" --message "$FULL"
        fi
        git push "$REMOTE" "refs/tags/$FULL"
        echo "✅ OK: Pushed full tag '$FULL'"

        # Minor tag: create or update
        git tag --force --annotate "$MINOR" --message "$FULL"
        minor_local_sha="$(tag_sha "$MINOR")"
        minor_remote_sha="$(remote_tag_sha "$MINOR")"
        if [ -z "$minor_remote_sha" ]; then
          git push "$REMOTE" "refs/tags/$MINOR"
          echo "✅ OK: Created and pushed minor tag '$MINOR' -> $minor_local_sha"
        else
          if [ "$minor_local_sha" != "$minor_remote_sha" ]; then
            echo "⚠️ WARN: Updating remote minor tag '$MINOR' to $minor_local_sha (was $minor_remote_sha)"
            git push --force "$REMOTE" "refs/tags/$MINOR"
          else
            echo "ℹ️ INFO: Minor tag '$MINOR' already up-to-date"
          fi
        fi

        # Major tag: create or update
        git tag --force --annotate "$MAJOR" --message "$FULL"
        major_local_sha="$(tag_sha "$MAJOR")"
        major_remote_sha="$(remote_tag_sha "$MAJOR")"
        if [ -z "$major_remote_sha" ]; then
          git push "$REMOTE" "refs/tags/$MAJOR"
          echo "✅ OK: Created and pushed major tag '$MAJOR' -> $major_local_sha"
        else
          if [ "$major_local_sha" != "$major_remote_sha" ]; then
            echo "⚠️ WARN: Updating remote major tag '$MAJOR' to $major_local_sha (was $major_remote_sha)"
            git push --force "$REMOTE" "refs/tags/$MAJOR"
          else
            echo "ℹ️ INFO: Major tag '$MAJOR' already up-to-date"
          fi
        fi