Taskfile.yml

version: '3'

# The site: Astro Starlight under src/, and two Go tools under tools/ - refgen writes the
# reference pages from the sources they describe, linkcheck fails on a link the build did not
# produce. SPIN, TERRAFORM and BRAND are checkouts of spin-stack/spin, spin-stack/spin-terraform-aws
# and spin-stack/brand: by default the ones task sources fetches into .sources/, at the commits
# versions.yaml pins. SHOTS is where it unpacks the dashboard's screenshots, which spin's
# release carries as site-shots.tar.gz.

vars:
  SPIN: '{{.SPIN | default ".sources/spin"}}'
  TERRAFORM: '{{.TERRAFORM | default ".sources/spin-terraform-aws"}}'
  BRAND: '{{.BRAND | default ".sources/brand"}}'
  SHOTS: '{{.SHOTS | default ".sources/spin-site-shots"}}'
  BASE_PATH: '{{.BASE_PATH | default "/website"}}'

tasks:
  install:
    desc: Install the site's dependencies from the lockfile, through Socket Firewall (go tool sfw).
    cmds:
      - go tool sfw pnpm install --frozen-lockfile

  dev:
    desc: Serve the site with live reload.
    cmds:
      - pnpm dev

  sources:
    desc: Fetch spin, spin-terraform-aws and brand into .sources/, each at the commit versions.yaml pins, and spin's release's screenshots (site-shots.tar.gz) beside them. spin is private - SOURCES_TOKEN, or git's own credentials, reads it.
    cmds:
      - go run ./tools/sources spin spin-terraform-aws brand

  sources:bump:
    desc: Move the pins to the newest releases - spin only to one that holds the commit pinned, brand to its main - and fetch them. Then task reference.
    cmds:
      - go run ./tools/sources -bump spin spin-terraform-aws brand

  sync:pr:
    desc: Commit what sources:bump and reference changed to branch sync/sources as the sync App (SYNC_TOKEN, BOT its login), and open its one pull request or update it. sync.yml runs it.
    cmds:
      - go run ./tools/sync pr -bot '{{.BOT}}' -reference '{{.REFERENCE | default "success"}}'

  sync:issue:
    desc: Write spin's issue "Site vs spin main" as the sources App (SOURCES_TOKEN, BOT its login) - MODE release, the commits a bump takes in, or main, what spin main has past the pin - with the release chain. sync.yml runs it.
    cmds:
      - go run ./tools/sync issue -mode '{{.MODE}}' -bot '{{.BOT}}'

  reference:
    desc: Write the reference pages (CLI, Terraform, config file, API) and what the site copies from the spin, spin-terraform-aws and brand checkouts.
    cmds:
      - task: sources
      - go run ./tools/refgen -spin {{.SPIN}} -terraform {{.TERRAFORM}} -brand {{.BRAND}} -shots {{.SHOTS}}

  reference:check:
    desc: Fail if a reference page is not what the sources say.
    cmds:
      - task: sources
      - go run ./tools/refgen -spin {{.SPIN}} -terraform {{.TERRAFORM}} -brand {{.BRAND}} -shots {{.SHOTS}} -check

  reference:public:
    desc: Fail if what the site has of spin-terraform-aws and brand is not what they say at the commits versions.yaml pins. Needs no spin checkout, nor any credential.
    # A fork's pull request has no token to read spin with, and this half needs nothing of it:
    # what the site says of spin stays as reference.json has it, and is held by reference:check.
    cmds:
      - go run ./tools/sources spin-terraform-aws brand
      - go run ./tools/refgen -only terraform,brand -terraform .sources/spin-terraform-aws -brand .sources/brand -check

  build:
    desc: Build the site into dist/, with llms.txt, llms-full.txt and a .md twin of every page.
    cmds:
      - pnpm build

  links:
    desc: Fail on a link to a page or an anchor the build did not produce.
    cmds:
      - go run ./tools/linkcheck -base {{.BASE_PATH}} dist

  links:external:
    desc: Open every link out of the site and every ghcr.io reference, as a reader with no credential would. Run it on the day the repositories go public.
    cmds:
      - go run ./tools/linkcheck -external dist

  gate:
    desc: What CI runs - every install through the firewall and every workflow step a task, the install, vet and the tools' tests, the reference against the public sources, the build, and every link.
    cmds:
      - go tool sfw check
      - go tool taskgate
      - task: install
      - go vet ./...
      - go test ./...
      - task: reference:public
      - task: build
      - task: links

  exposure:
    desc: What this repository shows the world - every ref's commits, pull request heads included, and its issues, pull requests and comments - against .github/exposure-allow.txt.
    # The repository is public: a value that lands in a pull request is published the moment the
    # pull request is opened. The private repositories are named, so this finds what the daily
    # workflow does, whose token sees none of the organization's.
    cmds:
      - go tool exposure -allow .github/exposure-allow.txt -gitleaks-config .gitleaks.toml -private ami,ci,shipset,skills,spin,spinbox.dev-deploy spin-stack/website

  check:
    desc: What CI runs with the token that reads spin - the reference against the sources at their pins, and the gate.
    cmds:
      - task: reference:check
      - task: gate

  check:public:
    desc: What CI runs with no token to read spin, a fork's pull request - the gate, whose reference:public needs none.
    cmds:
      - task: gate