Taskfile.scripts.yml

version: '3'

silent: true

tasks:
  help:
    desc: Detailed help
    cmds:
      - |
        echo "Tasks:"
        task --list

  lint:actionlint:
    desc: Lint GitHub Actions workflows with actionlint
    cmds:
      - |
        echo "▶️ Running actionlint..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work rhysd/actionlint:latest -color
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ actionlint passed"
        else
          echo "❌ actionlint failed"
          exit $rc
        fi

  lint:hadolint:
    desc: Lint Dockerfile with hadolint
    cmds:
      - |
        echo "▶️ Running hadolint..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work hadolint/hadolint:latest-debian < Dockerfile
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ hadolint passed"
        else
          echo "❌ hadolint failed"
          exit $rc
        fi

  lint:shellcheck:
    desc: Lint shell scripts with shellcheck
    cmds:
      - |
        echo "▶️ Running shellcheck..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work koalaman/shellcheck:stable -x -S style entrypoint.sh
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ shellcheck passed"
        else
          echo "❌ shellcheck failed"
          exit $rc
        fi

  lint:yamllint:
    desc: Lint YAML files with yamllint
    cmds:
      - |
        echo "▶️ Running yamllint..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work cytopia/yamllint -c .yamllint.yml .
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ yamllint passed"
        else
          echo "❌ yamllint failed"
          exit $rc
        fi

  dependency:update:
    desc: Update managed dependency pins for this profile
    cmds:
      - task: alpine:update
      - task: packages:update

  version:get:
    desc: Get current version
    cmds:
      - echo "{{.VERSION}}"

  version:set:
    desc: Update version in README.md and action.yml
    cmds:
      - |
        if [ -z "{{.VERSION}}" ]; then
          echo "❌ ERROR: VERSION is empty"
          exit 1
        fi
        if ! echo "{{.VERSION}}" | grep -Eq '^v?[0-9]+\.[0-9]+\.[0-9]+$'; then
          echo "❌ ERROR: VERSION '{{.VERSION}}' is not a valid semantic version (expected vX.Y.Z or X.Y.Z)"
          exit 1
        fi
      - echo Updating full version from {{.VERSION_FROM_ACTION_YML}} to {{.VERSION}}
      - echo Updating minor version from {{.MINOR_FROM_ACTION_YML}} to {{.VERSION_MINOR}}
      - echo Updating major version from {{.MAJOR_FROM_ACTION_YML}} to {{.VERSION_MAJOR}}
      - "{{.SED}} -E -i 's#({{.DOCKER_NAME}}:)v[0-9]+\\.[0-9]+\\.[0-9]+#\\1{{.VERSION}}#g' action.yml"
      - "{{.SED}} -E -i 's#({{.DOCKER_NAME}}@)v[0-9]+\\.[0-9]+\\.[0-9]+([^0-9.]|$)#\\1{{.VERSION}}\\2#g' README.md"
      - "{{.SED}} -E -i 's#({{.GITHUB_NAME}}@)v[0-9]+\\.[0-9]+\\.[0-9]+([^0-9.]|$)#\\1{{.VERSION}}\\2#g' README.md"
      - "{{.SED}} -E -i 's#({{.DOCKER_NAME}}@)v[0-9]+\\.[0-9]+([^0-9.]|$)#\\1{{.VERSION_MINOR}}\\2#g' README.md"
      - "{{.SED}} -E -i 's#({{.GITHUB_NAME}}@)v[0-9]+\\.[0-9]+([^0-9.]|$)#\\1{{.VERSION_MINOR}}\\2#g' README.md"
      - "{{.SED}} -E -i 's#({{.DOCKER_NAME}}@)v[0-9]+([^0-9.]|$)#\\1{{.VERSION_MAJOR}}\\2#g' README.md"
      - "{{.SED}} -E -i 's#({{.GITHUB_NAME}}@)v[0-9]+([^0-9.]|$)#\\1{{.VERSION_MAJOR}}\\2#g' README.md"

  version:resolve-next:
    desc: Resolve next version from bump type and profile
    cmds:
      - |
        set -eu
        bump_type="${BUMP_TYPE:-patch}"
        input_version="${INPUT_VERSION:-}"

        normalize_version() {
          candidate="${1#v}"
          if ! printf "%s" "${candidate}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            return 1
          fi
          printf "v%s" "${candidate}"
        }

        current="$(task version:get 2>/dev/null || true)"

        case "$bump_type" in
          set)
            [ -n "$input_version" ] || { echo "Missing version for type=set"; exit 1; }
            next="$(normalize_version "$input_version")" || {
              echo "Invalid explicit version: $input_version. Expected vX.Y.Z or X.Y.Z"
              exit 1
            }
            ;;
          patch|minor|major)
            [ -n "$current" ] || { echo "Current version not found or invalid. Expected vX.Y.Z"; exit 1; }
            current="$(normalize_version "$current")" || { echo "Current version not found or invalid. Expected vX.Y.Z"; exit 1; }
            no_v="${current#v}"
            major="$(printf "%s" "$no_v" | awk -F. '{print $1}')"
            minor="$(printf "%s" "$no_v" | awk -F. '{print $2}')"
            patch="$(printf "%s" "$no_v" | awk -F. '{print $3}')"
            case "$bump_type" in
              patch) next="v${major}.${minor}.$((patch + 1))" ;;
              minor) next="v${major}.$((minor + 1)).0" ;;
              major) next="v$((major + 1)).0.0" ;;
            esac
            ;;
          *)
            echo "Unknown type: $bump_type"
            exit 1
            ;;
        esac

        printf "%s" "$next"

  version:tag-release:
    desc: Create set of git tags
    cmds:
      - |
        set -eu
        if (set -o | grep -q pipefail) 2>/dev/null; then set -o pipefail; fi

        REMOTE='origin'
        FULL='{{.VERSION_FULL}}'
        MINOR='{{.VERSION_MINOR}}'
        MAJOR='{{.VERSION_MAJOR}}'

        # Validate vX.Y.Z
        if ! printf "%s" "$FULL" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
          echo "❌ ERROR: VERSION '$FULL' must match vX.Y.Z" >&2
          exit 1
        fi

        tag_sha() { git rev-parse "refs/tags/$1" 2>/dev/null || true; }
        remote_tag_sha() { git ls-remote --tags "$REMOTE" "refs/tags/$1" 2>/dev/null | awk '{print $1}' || true; }

        echo "ℹ️ INFO: Tags - Full: $FULL | Minor: $MINOR | Major: $MAJOR"

        # Full tag: must NOT exist on remote; fail fast if it does
        full_remote_sha="$(remote_tag_sha "$FULL")"
        if [ -n "$full_remote_sha" ]; then
          echo "❌ ERROR: Full tag '$FULL' already exists on remote; aborting" >&2
          exit 1
        fi

        # Create full tag locally (if missing) and push
        if git rev-parse --quiet --verify "refs/tags/$FULL" >/dev/null 2>&1; then
          echo "ℹ️ INFO: Full tag '$FULL' exists locally but not on remote; pushing"
        else
          echo "ℹ️ INFO: Creating full tag '$FULL'"
          git tag --annotate "$FULL" --message "$FULL"
        fi
        git push "$REMOTE" "refs/tags/$FULL"
        echo "✅ OK: Pushed full tag '$FULL'"

        # Minor tag: create or update
        git tag --force --annotate "$MINOR" --message "$FULL"
        minor_local_sha="$(tag_sha "$MINOR")"
        minor_remote_sha="$(remote_tag_sha "$MINOR")"
        if [ -z "$minor_remote_sha" ]; then
          git push "$REMOTE" "refs/tags/$MINOR"
          echo "✅ OK: Created and pushed minor tag '$MINOR' -> $minor_local_sha"
        else
          if [ "$minor_local_sha" != "$minor_remote_sha" ]; then
            echo "⚠️ WARN: Updating remote minor tag '$MINOR' to $minor_local_sha (was $minor_remote_sha)"
            git push --force "$REMOTE" "refs/tags/$MINOR"
          else
            echo "ℹ️ INFO: Minor tag '$MINOR' already up-to-date"
          fi
        fi

        # Major tag: create or update
        git tag --force --annotate "$MAJOR" --message "$FULL"
        major_local_sha="$(tag_sha "$MAJOR")"
        major_remote_sha="$(remote_tag_sha "$MAJOR")"
        if [ -z "$major_remote_sha" ]; then
          git push "$REMOTE" "refs/tags/$MAJOR"
          echo "✅ OK: Created and pushed major tag '$MAJOR' -> $major_local_sha"
        else
          if [ "$major_local_sha" != "$major_remote_sha" ]; then
            echo "⚠️ WARN: Updating remote major tag '$MAJOR' to $major_local_sha (was $major_remote_sha)"
            git push --force "$REMOTE" "refs/tags/$MAJOR"
          else
            echo "ℹ️ INFO: Major tag '$MAJOR' already up-to-date"
          fi
        fi

  git:get-pr-template:
    desc: Get pull request template
    cmds:
      - mkdir -p .tmp
      - curl -LsS https://raw.githubusercontent.com/devops-infra/.github/refs/tags/v1/PULL_REQUEST_TEMPLATE.md -o .tmp/PULL_REQUEST_TEMPLATE.md

  git:set-config:
    desc: Set git user config
    cmds:
      - git config user.name "github-actions[bot]"
      - git config user.email "github-actions[bot]@users.noreply.github.com"

  alpine:update:
    desc: Update Alpine base image references and VERSION_ID test expectations
    cmds:
      - |
        set -eu
        if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
          echo "INFO: Not in a git repository; nothing to update"
          exit 0
        fi

        mkdir -p .tmp
        tracked_files=".tmp/alpine-update-files.txt"
        relevant_files=".tmp/alpine-update-relevant.txt"
        git ls-files > "$tracked_files"
        grep -E '(^|/)(Dockerfile[^/]*|[^/]+\.sh|\.github/workflows/.*\.ya?ml|tests/.*\.ya?ml)$' "$tracked_files" > "$relevant_files" || true

        if [ ! -s "$relevant_files" ]; then
          echo "INFO: No tracked Alpine-related source files found; nothing to update"
          exit 0
        fi

        latest_feed="$(curl -fsSL https://dl-cdn.alpinelinux.org/alpine/latest-stable/releases/x86_64/latest-releases.yaml)"
        latest_alpine="$(printf '%s\n' "$latest_feed" | awk '/^  version:/ {print $2}' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -1)"
        if [ -z "$latest_alpine" ]; then
          echo "ERROR: Could not resolve latest Alpine release"
          exit 1
        fi
        escaped_alpine="$(printf '%s' "$latest_alpine" | sed 's/\./\\\\./g')"

        found_refs=0
        while IFS= read -r file; do
          [ -n "$file" ] || continue
          if grep -Eq 'alpine:[0-9]+\.[0-9]+\.[0-9]+|expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+(\\?\.[0-9]+){2}\]' "$file"; then
            found_refs=1
            break
          fi
        done < "$relevant_files"

        if [ "$found_refs" -eq 0 ]; then
          echo "INFO: No Alpine version references found in tracked source files; nothing to update"
          exit 0
        fi

        updated=0
        while IFS= read -r file; do
          [ -n "$file" ] || continue
          before_file=".tmp/alpine-update-before"
          cp "$file" "$before_file"
          perl -0pi -e 's/alpine:\d+\.\d+\.\d+/alpine:'"$latest_alpine"'/g' "$file"
          if printf '%s\n' "$file" | grep -Eq '^tests/.*\.ya?ml$'; then
            perl -0pi -e 's/expectedOutput:\s*\[VERSION_ID=\d+(?:\\?\.\d+){2}\]/expectedOutput: [VERSION_ID='"$escaped_alpine"']/g' "$file"
          fi
          if ! cmp -s "$file" "$before_file"; then
            echo "UPDATE: Alpine references in $file -> $latest_alpine"
            updated=1
          fi
        done < "$relevant_files"
        rm -f .tmp/alpine-update-before

        if xargs grep -En 'expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+\.[0-9]+\.[0-9]+\]' < "$relevant_files" >/dev/null 2>&1; then
          echo "ERROR: Found unescaped VERSION_ID expectations after update"
          xargs grep -En 'expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+\.[0-9]+\.[0-9]+\]' < "$relevant_files" || true
          exit 1
        fi

        if xargs grep -En 'alpine:[0-9]+\\\.[0-9]+\\\.[0-9]+' < "$relevant_files" >/dev/null 2>&1; then
          echo "ERROR: Found escaped Alpine image tags after update"
          xargs grep -En 'alpine:[0-9]+\\\.[0-9]+\\\.[0-9]+' < "$relevant_files" || true
          exit 1
        fi

        if [ "$updated" -eq 0 ]; then
          echo "INFO: Alpine references already up to date"
        fi

  packages:update:
    desc: Update Alpine package pins in alpine-packages.txt
    cmds:
      - |
        set -eu
        if [ ! -f Dockerfile ]; then
          echo "INFO: Dockerfile not found; nothing to update"
          exit 0
        fi
        if [ ! -f alpine-packages.txt ]; then
          echo "INFO: alpine-packages.txt not found; nothing to update"
          exit 0
        fi

        base_image="$(sed -nE 's/^FROM[[:space:]]+([^[:space:]]+).*/\1/p' Dockerfile | head -1)"
        if [ -z "$base_image" ]; then
          echo "INFO: Could not resolve base image; nothing to update"
          exit 0
        fi

        case "$base_image" in
          alpine:*|alpine)
            :
            ;;
          *)
            echo "INFO: Base image is '$base_image', not Alpine; nothing to update"
            exit 0
            ;;
        esac

        alpine_line="${base_image#alpine:}"
        if [ "$alpine_line" = "$base_image" ] || [ -z "$alpine_line" ]; then
          echo "INFO: Could not parse Alpine version from '$base_image'; nothing to update"
          exit 0
        fi
        alpine_minor="$(printf '%s' "$alpine_line" | awk -F. '{print $1 "." $2}')"
        if ! printf '%s' "$alpine_minor" | grep -Eq '^[0-9]+\.[0-9]+$'; then
          echo "INFO: Unsupported Alpine version '$alpine_line'; nothing to update"
          exit 0
        fi
        alpine_repo="v${alpine_minor}"
        arch="x86_64"

        normalize_minor() {
          version="$1"
          printf '%s' "$version" | sed -E 's/^([0-9]+\.[0-9]+).*/\1/'
        }

        fetch_index() {
          repo="$1"
          out="$2"
          url="https://dl-cdn.alpinelinux.org/alpine/${alpine_repo}/${repo}/${arch}/APKINDEX.tar.gz"
          curl --fail --silent --show-error "$url" | tar -O -zx APKINDEX > "$out"
        }

        lookup_latest() {
          pkg="$1"
          for index in "$index_main" "$index_community"; do
            found="$(awk -v pkg="$pkg" '
              BEGIN { RS=""; FS="\n" }
              {
                p=""; v=""
                for (i=1; i<=NF; i++) {
                  if ($i ~ /^P:/) p=substr($i,3)
                  if ($i ~ /^V:/) v=substr($i,3)
                }
                if (p==pkg) { print v; exit }
              }
            ' "$index")"
            if [ -n "$found" ]; then
              printf '%s' "$found"
              return 0
            fi
          done
          return 1
        }

        mkdir -p .tmp
        index_main=".tmp/apkindex-main-${alpine_repo}-${arch}.txt"
        index_community=".tmp/apkindex-community-${alpine_repo}-${arch}.txt"
        fetch_index main "$index_main"
        fetch_index community "$index_community"

        tmp_out=".tmp/alpine-packages.updated.txt"
        : > "$tmp_out"
        updated=0
        processed=0
        while IFS= read -r line || [ -n "$line" ]; do
          if [ -z "$line" ] || printf '%s' "$line" | grep -Eq '^[[:space:]]*#'; then
            echo "$line" >> "$tmp_out"
            continue
          fi
          if ! printf '%s' "$line" | grep -Eq '^[a-zA-Z0-9+_.-]+((=~|~=)[0-9]+\.[0-9]+)?$'; then
            echo "$line" >> "$tmp_out"
            continue
          fi

          pkg="$(printf '%s' "$line" | sed -E 's/^([a-zA-Z0-9+_.-]+).*/\1/')"
          current_minor=""
          if printf '%s' "$line" | grep -Eq '^[a-zA-Z0-9+_.-]+(=~|~=)[0-9]+\.[0-9]+$'; then
            current_minor="$(printf '%s' "$line" | sed -E 's/^[a-zA-Z0-9+_.-]+(=~|~=)([0-9]+\.[0-9]+).*$/\2/')"
          fi

          latest_full="$(lookup_latest "$pkg" || true)"
          if [ -z "$latest_full" ]; then
            echo "WARN: Could not resolve latest version for $pkg; keeping $line"
            echo "$line" >> "$tmp_out"
            continue
          fi

          latest_minor="$(normalize_minor "$latest_full")"
          processed=1

          if [ -z "$current_minor" ]; then
            echo "PIN: $pkg -> $latest_minor"
            echo "$pkg~=$latest_minor" >> "$tmp_out"
            updated=1
            continue
          fi

          if [ "$latest_minor" = "$current_minor" ]; then
            echo "OK: $pkg already up to date at $current_minor"
            echo "$pkg~=$current_minor" >> "$tmp_out"
            continue
          fi
          echo "UPDATE: $pkg $current_minor -> $latest_minor"
          echo "$pkg~=$latest_minor" >> "$tmp_out"
          updated=1
        done < alpine-packages.txt

        if [ "$processed" -eq 0 ]; then
          echo "INFO: No Alpine package entries found in alpine-packages.txt"
        fi

        if ! cmp -s alpine-packages.txt "$tmp_out"; then
          mv "$tmp_out" alpine-packages.txt
        else
          rm -f "$tmp_out"
        fi

        if [ "$updated" -eq 0 ]; then
          echo "INFO: No Alpine package updates were required"
        fi