competitive-intelligence/Taskfile.yaml at main · nanohype/competitive-intelligence · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
version: '3'

vars:
  IMAGE: '{{.IMAGE | default "competitive-intelligence:dev"}}'

tasks:
  default:
    desc: Show available tasks
    cmds:
      - task --list

  # === Composite ===

  ci:
    desc: 'Full local CI: install, build, lint, typecheck, format:check, editorconfig, test, platform CRs, helm lint/template, docker build'
    cmds:
      - task: install
      - task: build
      - task: lint
      - task: typecheck
      - task: format:check
      - task: editorconfig
      - task: test
      - task: platform:validate
      - task: helm:lint
      - task: helm:template
      - task: docker:build

  # === Install ===

  install:
    desc: Install app deps
    cmds:
      # `npm install` not `npm ci`: the macOS-generated lockfile omits the
      # Linux platform-specific optional deps (vitest/rolldown); npm install
      # resolves them on whatever host runs this, pinned by the lockfile.
      - npm install --prefer-offline --no-audit --no-fund

  # === TypeScript ===

  build:
    desc: Compile the app (tsc → dist/)
    cmds:
      - npm run build

  lint:
    desc: Lint the app (Biome)
    cmds:
      - npm run lint

  typecheck:
    desc: tsc --noEmit
    cmds:
      - npm run typecheck

  format:check:
    desc: Check formatting (Biome)
    cmds:
      - npm run format:check

  editorconfig:
    desc: Check every tracked file against .editorconfig (charset, LF, final newline, trailing whitespace)
    cmds:
      - npm run editorconfig

  test:
    desc: Run the test suite with coverage thresholds
    cmds:
      - npm run test:coverage

  # === Platform CRs ===

  platform:validate:
    desc: Validate platform.yaml against the vendored operator CRD schemas, then self-test the gate
    cmds:
      # The first run is the gate. The second breaks the inputs in memory —
      # including handing the digest check a tampered schema — and fails unless
      # every break is rejected, so "the gate rejects" stays a tested property.
      - node scripts/validate-platform-manifests.mjs
      - node scripts/validate-platform-manifests.mjs --self-test

  schemas:sync:
    desc: Re-vendor the operator CRD schemas + digests from the ref pinned in schemas/crd/source.json
    cmds:
      - node scripts/sync-crd-schemas.mjs

  schemas:check:
    desc: Assert the vendored CRD schemas are byte-identical to the pinned upstream ref
    cmds:
      - node scripts/sync-crd-schemas.mjs --check

  schemas:freshness:
    desc: Report whether the pinned operator ref has fallen behind upstream (never a merge gate)
    cmds:
      - node scripts/sync-crd-schemas.mjs --freshness

  # === Helm ===

  helm:lint:
    desc: Lint the chart
    cmds:
      - helm lint chart

  helm:template:
    desc: Render the chart against every env, with the optional templates off and on
    cmds:
      - helm template chart -f chart/values.yaml -f chart/values-development.yaml > /dev/null
      - helm template chart -f chart/values.yaml -f chart/values-staging.yaml > /dev/null
      - helm template chart -f chart/values.yaml -f chart/values-production.yaml > /dev/null
      - |
        TOGGLES="prometheusRule grafanaDashboard externalSecret networkPolicy serviceMonitor"
        OFF=""; ON=""
        for t in $TOGGLES; do OFF="$OFF --set $t.enabled=false"; ON="$ON --set $t.enabled=true"; done
        for env in development staging production; do
          helm template chart -f chart/values.yaml -f "chart/values-$env.yaml" $OFF > /dev/null
          helm template chart -f chart/values.yaml -f "chart/values-$env.yaml" $ON > /dev/null
        done

  # === Docker ===

  docker:build:
    desc: 'Build the container image (no push)'
    cmds:
      - docker build -t {{.IMAGE}} .

  # === Security ===

  security:scan:
    desc: 'Run security scanners (gitleaks + trivy config) if available locally'
    cmds:
      - |
        if command -v gitleaks >/dev/null 2>&1; then
          gitleaks git --config .gitleaks.toml --redact --no-banner .
        else
          echo "gitleaks not installed — install via 'brew install gitleaks' to run locally"
        fi
      - |
        if command -v trivy >/dev/null 2>&1; then
          trivy config . --severity HIGH,CRITICAL --skip-dirs chart --exit-code 1
        else
          echo "trivy not installed — install via 'brew install trivy' to run locally"
        fi