Taskfile.yml

# SPDX-FileCopyrightText: 2026 OpenSerbia
# SPDX-License-Identifier: MIT
# https://taskfile.dev
version: '3'

vars:
  IMAGE: ghcr.io/openserbia/github-runner
  # Image ref that scan/sbom/smoke operate on. Defaults to the locally-built
  # :latest; CI overrides it per arch leg, e.g.
  # `task scan sbom smoke REF=$IMAGE:latest-arm64`.
  REF: '{{.IMAGE}}:latest'

tasks:
  build:
    desc: Build the image (:latest)
    cmds:
      - docker build -t {{.IMAGE}}:latest .

  scan:
    desc: Trivy — fail on FIXABLE CRITICAL, report HIGH+CRITICAL
    cmds:
      # --ignore-unfixed: the Ubuntu base carries kernel-header CVEs in
      # linux-libc-dev that are fixed=none and DON'T apply to a container (it
      # uses the host kernel). Gating on those would make the build permanently
      # red. So the gate fails only on CRITICALs that HAVE a fix — the actionable
      # ones (e.g. the git-lfs Go-stdlib CVE the Dockerfile recompiles away).
      - trivy image --exit-code 1 --severity CRITICAL --ignore-unfixed --ignorefile .trivyignore {{.REF}}
      # Visibility report (non-gating) — fixable HIGH+CRITICAL.
      - trivy image --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore {{.REF}}

  sbom:
    desc: Generate CycloneDX SBOM
    cmds:
      - syft {{.REF}} -o cyclonedx-json=sbom.cdx.json

  smoke:
    desc: Smoke-test the built image (runner binary + toolchain present & sane)
    cmds:
      - ./test/smoke.sh {{.REF}}

  test:go:
    desc: Run the Go entrypoint unit tests
    cmds:
      - go test ./...

  lint:go:
    desc: Run golangci-lint (the strict shared openserbia config)
    cmds:
      - golangci-lint run

  fmt:go:
    desc: Apply gci + gofumpt formatting
    cmds:
      - golangci-lint fmt

  tidy:
    desc: Tidy Go modules
    cmds:
      - go mod tidy

  ci:
    desc: build -> scan -> sbom -> smoke (no push)
    cmds:
      - task: build
      - task: scan
      - task: sbom
      - task: smoke

  default:
    cmds:
      - task -l