Taskfile.yml

version: '3'

vars:
  IMAGE: toshy/ffconv

env:
  UID:
    sh: id -u
  GID:
    sh: id -g
  DOCKER_COMPOSE_RUN: docker compose --progress quiet run --rm --build
  HADOLINT_IMAGE: ghcr.io/hadolint/hadolint:v2.14.0
  ACTIONLINT_IMAGE: rhysd/actionlint:1.7.12
  ZIZMOR_IMAGE: ghcr.io/zizmorcore/zizmor:1.26.1
  PINACT_IMAGE: ghcr.io/toshy/docker-pinact:4.1.0

tasks:
  default:
    cmds:
      - task --list

  # Docker
  build:
    desc: Build local images
    vars:
      TARGETS: [ 'dev', 'prod' ]
    cmds:
      - for:
          var: TARGETS
        cmd: docker buildx build --load --target {{.ITEM}} --tag {{.IMAGE}}:{{.ITEM}} .

  down:
    desc: Down service
    cmds:
      - docker compose down --remove-orphans

  # Shell
  shell:dev:
    desc: Container shell
    vars:
      TARGET: 'dev'
    cmds:
      - $DOCKER_COMPOSE_RUN {{.TARGET}} {{.CLI_ARGS | default "/bin/bash"}}

  shell:prod:
    desc: Container shell prod
    vars:
      TARGET: 'prod'
      INPUT_DIRECTORY: '{{.i | default "input"}}'
      OUTPUT_DIRECTORY: '{{.o | default "output"}}'
      FONTS_DIRECTORY: '{{.o | default "fonts"}}'
    cmds:
      - docker buildx build --quiet --target {{.TARGET}} --tag {{.IMAGE}}:{{.TARGET}} .
      - docker run -it -u $(id -u):$(id -g) -v ${PWD}/{{.INPUT_DIRECTORY}}:/app/input -v ${PWD}/{{.OUTPUT_DIRECTORY}}:/app/output -v ${PWD}/{{.FONTS_DIRECTORY}}:/app/fonts --entrypoint="/bin/bash" --rm {{.IMAGE}}:{{.TARGET}} {{.CLI_ARGS}}

  # Test
  dev:
    desc: Test dev image (compose)
    vars:
      TARGET: 'dev'
      INPUT_DIRECTORY: '{{.i | default "input"}}'
      OUTPUT_DIRECTORY: '{{.o | default "output"}}'
    cmds:
      - mkdir -p ${PWD}/{{.INPUT_DIRECTORY}} ${PWD}/{{.OUTPUT_DIRECTORY}}
      - $DOCKER_COMPOSE_RUN -u $(id -u):$(id -g) {{.TARGET}} python -m ffconv {{.CLI_ARGS}}

  prod:
    desc: Test prod image (docker)
    silent: true
    vars:
      TARGET: 'prod'
      INPUT_DIRECTORY: '{{.i | default "input"}}'
      OUTPUT_DIRECTORY: '{{.o | default "output"}}'
      FONTS_DIRECTORY: '{{.o | default "fonts"}}'
    cmds:
      - docker buildx build --quiet --load --target {{.TARGET}} --tag {{.IMAGE}}:{{.TARGET}} .
      - mkdir -p ${PWD}/{{.INPUT_DIRECTORY}} ${PWD}/{{.OUTPUT_DIRECTORY}} ${PWD}/{{.FONTS_DIRECTORY}}
      - docker run -it -u $(id -u):$(id -g) -v ${PWD}/{{.INPUT_DIRECTORY}}:/app/input -v ${PWD}/{{.OUTPUT_DIRECTORY}}:/app/output -v ${PWD}/{{.FONTS_DIRECTORY}}:/app/fonts --rm {{.IMAGE}}:{{.TARGET}} {{.CLI_ARGS}}

  prod:gpu:
    desc: Test prod image with GPU (docker)
    silent: true
    vars:
      TARGET: 'prod'
      INPUT_DIRECTORY: '{{.i | default "input"}}'
      OUTPUT_DIRECTORY: '{{.o | default "output"}}'
      FONTS_DIRECTORY: '{{.o | default "fonts"}}'
    cmds:
      - docker buildx build --quiet --load --target {{.TARGET}} --tag {{.IMAGE}}:{{.TARGET}} .
      - mkdir -p ${PWD}/{{.INPUT_DIRECTORY}} ${PWD}/{{.OUTPUT_DIRECTORY}} ${PWD}/{{.FONTS_DIRECTORY}}
      - docker run -it --gpus all -u $(id -u):$(id -g) -v ${PWD}/{{.INPUT_DIRECTORY}}:/app/input -v ${PWD}/{{.OUTPUT_DIRECTORY}}:/app/output -v ${PWD}/{{.FONTS_DIRECTORY}}:/app/fonts --rm {{.IMAGE}}:{{.TARGET}} {{.CLI_ARGS}}

  # Development tools
  test:
    desc: Run tests
    summary: |
      Run the pytest test suite inside the dev container.

      Usage:
      - task test
      - task test -- -v
      - task test -- --cov=ffconv
      - task test -- tests/test_helper.py
    cmds:
      - $DOCKER_COMPOSE_RUN dev python3 -m pytest tests/ {{.CLI_ARGS}}

  ruff:
    desc: Run ruff
    cmds:
      - $DOCKER_COMPOSE_RUN dev ruff check .

  ruff:fix:
    desc: Run ruff fix
    cmds:
      - $DOCKER_COMPOSE_RUN dev ruff check --fix .

  black:
    desc: Run black
    cmds:
      - $DOCKER_COMPOSE_RUN dev black . --check --diff --color

  black:fix:
    desc: Run black fix
    cmds:
      - $DOCKER_COMPOSE_RUN dev black .

  mypy:
    desc: Run mypy
    cmds:
      - $DOCKER_COMPOSE_RUN dev mypy .

  # zensical
  docs:
    desc: Zensical build
    cmds:
      - docker run --rm -it -v $(pwd):/docs -w /docs docker.io/zensical/zensical:0.0 build --clean

  docs:live:
    desc: Zensical development server
    vars:
      PORT: '{{.p | default "8001"}}'
    cmds:
      - docker run --rm -it -p {{.PORT}}:8000 -v $(pwd):/docs -w /docs docker.io/zensical/zensical:0.0 serve --dev-addr 0.0.0.0:8000

  # Linting
  hadolint:
    desc: Lint all Dockerfiles
    cmds:
      - docker run --rm -v "{{.ROOT_DIR}}:/repo" -w /repo {{.HADOLINT_IMAGE}} hadolint /repo/Dockerfile

  actionlint:
    desc: Lint GitHub Actions workflows in .github/workflows
    silent: true
    cmds:
      - docker run --rm -v "{{.ROOT_DIR}}:/repo" -w /repo "{{.ACTIONLINT_IMAGE}}" -color

  zizmor:
    desc: Audit GitHub Actions workflows and Dependabot config for security issues
    summary: |
      Audit everything in .github that zizmor understands: workflows, composite
      actions and dependabot.yml.

      Limiting this to `--collect=workflows` hides findings that GitHub's own
      zizmor integration does report, such as the Dependabot cooldown audit.
    silent: true
    cmds:
      - docker run --rm -v "{{.ROOT_DIR}}:/repo" -w /repo "{{.ZIZMOR_IMAGE}}" --color=always .

  pinact:
    desc: Validate GitHub Actions are pinned to commit SHAs in .github/workflows
    summary: |
      Check pinned GitHub Actions against commit SHAs in .github/workflows.

      Usage:
      - task pinact TOKEN=github_pat_...

      If no "TOKEN" environment variable is passed, you might experience rate limiting.
      See https://github.com/suzuki-shunsuke/pinact#github-access-token.
    silent: true
    vars:
      TOKEN: '{{.t | default ""}}'
    cmds:
      - |
        if [ ! -d "{{.ROOT_DIR}}/.github/workflows" ]; then
          printf "\033[33m[pinact]\033[0m no .github/workflows directory found\n"
          exit 0
        fi
        docker run --rm \
          -v "{{.ROOT_DIR}}:/repo" \
          -e PINACT_GITHUB_TOKEN="{{.TOKEN}}" \
          "{{.PINACT_IMAGE}}" run --diff

  pinact:fix:
    desc: Pin GitHub Actions to commit SHAs in-place in .github/workflows
    summary: |
      Check pinned GitHub Actions against commit SHAs in .github/workflows and fixes them.

      Usage:
      - task pinact:fix TOKEN=github_pat_...

      If no "TOKEN" environment variable is passed, you might experience rate limiting.
      See https://github.com/suzuki-shunsuke/pinact#github-access-token.
    silent: true
    vars:
      TOKEN: '{{.t | default ""}}'
    cmds:
      - |
        if [ ! -d "{{.ROOT_DIR}}/.github/workflows" ]; then
          printf "\033[33m[pinact]\033[0m no .github/workflows directory found\n"
          exit 0
        fi
        docker run --rm \
          -v "{{.ROOT_DIR}}:/repo" \
          -u "${UID}:${GID}" \
          -e PINACT_GITHUB_TOKEN="{{.TOKEN}}" \
          "{{.PINACT_IMAGE}}" run --fix