Taskfile.yml

# SPDX-FileCopyrightText: 2026 OpenSerbia
# SPDX-License-Identifier: MIT
# https://taskfile.dev
version: '3'

vars:
  IMAGE: ghcr.io/openserbia/github-runner
  # Image ref that scan/sbom/smoke operate on. Defaults to the locally-built
  # :latest; CI overrides it per arch leg, e.g.
  # `task scan sbom smoke REF=$IMAGE:latest-arm64`.
  REF: '{{.IMAGE}}:latest'

tasks:
  secrets:
    desc: Scan the working tree and git history for committed credentials
    # Two passes, because they answer different questions: `dir` catches a
    # secret on its way into a commit, `git` catches one that is already in
    # history and was later deleted: removing the line does not remove the
    # blob.
    #
    # No sources/generates: the history pass depends on commits, which change
    # without any tracked file changing, so a cached "up to date" would lie.
    #
    # .gitleaks.toml allowlists .env, vendor/ and the build/cache trees;
    # everything else, untracked files included, is scanned.
    cmds:
      - gitleaks dir . --redact --no-banner --verbose
      - gitleaks git --redact --no-banner --verbose

  build:
    desc: Build the image (:latest)
    cmds:
      - docker build -t {{.IMAGE}}:latest .

  scan:
    desc: Trivy — fail on FIXABLE CRITICAL, report HIGH+CRITICAL
    cmds:
      # --ignore-unfixed: gate only on CRITICALs that HAVE a fix, the
      # actionable ones. Unfixable findings (e.g. in the runner's bundled .NET,
      # which only a new runner release fixes) would keep the build red forever.
      - trivy image --exit-code 1 --severity CRITICAL --ignore-unfixed --ignorefile .trivyignore {{.REF}}
      # Visibility report (non-gating) — fixable HIGH+CRITICAL.
      - trivy image --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore {{.REF}}

  sbom:
    desc: Generate CycloneDX SBOM
    cmds:
      - syft {{.REF}} -o cyclonedx-json=sbom.cdx.json

  smoke:
    desc: Smoke-test the built image (runner binary + toolchain present & sane)
    cmds:
      - ./test/smoke.sh {{.REF}}

  test:go:
    desc: Run the Go entrypoint unit tests
    cmds:
      - go test ./...

  lint:go:
    desc: Run golangci-lint (the strict shared openserbia config)
    cmds:
      - golangci-lint run

  fmt:go:
    desc: Apply gci + gofumpt formatting
    cmds:
      - golangci-lint fmt

  tidy:
    desc: Tidy Go modules
    cmds:
      - go mod tidy

  ci:
    desc: build -> scan -> sbom -> smoke (no push)
    cmds:
      - task: build
      - task: scan
      - task: sbom
      - task: smoke

  default:
    cmds:
      - task -l