Taskfile.yaml

version: '3'

vars:
  IMAGE: '{{.IMAGE | default "competitive-intelligence:dev"}}'

tasks:
  default:
    desc: Show available tasks
    cmds:
      - task --list

  # === Composite ===

  ci:
    desc: 'Full local CI: every gate that needs only this checkout (the editorconfig gate runs in CI, from the shared action)'
    cmds:
      - task: install
      - task: build
      - task: lint
      - task: typecheck
      - task: format:check
      - task: test
      - task: platform:validate
      - task: schemas:selftest
      - task: helm:lint
      - task: helm:template
      - task: docker:build

  # === Install ===

  install:
    desc: Install app deps
    cmds:
      # `npm install` not `npm ci`: the macOS-generated lockfile omits the
      # Linux platform-specific optional deps (vitest/rolldown); npm install
      # resolves them on whatever host runs this, pinned by the lockfile.
      - npm install --prefer-offline --no-audit --no-fund

  # === TypeScript ===

  build:
    desc: Compile the app (tsc → dist/)
    cmds:
      - npm run build

  lint:
    desc: Lint the app (Biome)
    cmds:
      - npm run lint

  typecheck:
    desc: tsc --noEmit
    cmds:
      - npm run typecheck

  format:check:
    desc: Check formatting (Biome)
    cmds:
      - npm run format:check

  test:
    desc: Run the test suite with coverage thresholds
    cmds:
      - npm run test:coverage

  # === Platform CRs ===

  platform:validate:
    desc: Validate platform.yaml against the vendored operator CRD schemas, then self-test the gate
    cmds:
      # The first run is the gate. The second breaks the inputs in memory —
      # including handing the digest check a tampered schema — and fails unless
      # every break is rejected, so "the gate rejects" stays a tested property.
      - node scripts/validate-platform-manifests.mjs
      - node scripts/validate-platform-manifests.mjs --self-test

  schemas:sync:
    desc: 'Re-vendor the operator CRD schemas + digests (usage: task schemas:sync -- --ref=<sha>|--ref=latest)'
    cmds:
      - node scripts/sync-crd-schemas.mjs {{.CLI_ARGS}}

  schemas:check:
    desc: Assert the vendored CRD schemas are byte-identical to the pinned upstream ref
    cmds:
      - node scripts/sync-crd-schemas.mjs --check

  schemas:freshness:
    desc: Report whether the pinned operator ref has fallen behind upstream (never a merge gate)
    cmds:
      - node scripts/sync-crd-schemas.mjs --freshness

  schemas:selftest:
    desc: Prove the freshness report names a command that resolves upstream, and that it works
    cmds:
      # Builds a real upstream repository whose history it knows, runs the
      # report against it, and asserts on the bytes: no commit id it resolved,
      # a remediation naming `--ref=latest`, and that command landing the pin on
      # the newest commit that touched the schemas.
      - node scripts/sync-crd-schemas.mjs --self-test

  # === Helm ===

  helm:lint:
    desc: Lint the chart
    cmds:
      - helm lint chart

  helm:template:
    desc: Render the chart against every env, with the optional templates off and on
    cmds:
      - helm template chart -f chart/values.yaml -f chart/values-development.yaml > /dev/null
      - helm template chart -f chart/values.yaml -f chart/values-staging.yaml > /dev/null
      - helm template chart -f chart/values.yaml -f chart/values-production.yaml > /dev/null
      - |
        TOGGLES="prometheusRule grafanaDashboard externalSecret networkPolicy serviceMonitor"
        OFF=""; ON=""
        for t in $TOGGLES; do OFF="$OFF --set $t.enabled=false"; ON="$ON --set $t.enabled=true"; done
        for env in development staging production; do
          helm template chart -f chart/values.yaml -f "chart/values-$env.yaml" $OFF > /dev/null
          helm template chart -f chart/values.yaml -f "chart/values-$env.yaml" $ON > /dev/null
        done

  # === Docker ===

  docker:build:
    desc: 'Build the container image (no push)'
    cmds:
      - docker build -t {{.IMAGE}} .

  # === Security ===

  security:scan:
    desc: 'Run security scanners (gitleaks + trivy config) if available locally'
    cmds:
      - |
        if command -v gitleaks >/dev/null 2>&1; then
          gitleaks git --config .gitleaks.toml --redact --no-banner .
        else
          echo "gitleaks not installed — install via 'brew install gitleaks' to run locally"
        fi
      - |
        if command -v trivy >/dev/null 2>&1; then
          trivy config . --severity HIGH,CRITICAL --skip-dirs chart --exit-code 1
        else
          echo "trivy not installed — install via 'brew install trivy' to run locally"
        fi