Taskfile.yml

version: '3'

# Taskfile for one-cli. After the monorepo restructure the Go module lives at
# packages/cli/, the docs site at apps/docs/, and the `one serve` UI at
# apps/dashboard/. Run `task` (no args) for the menu of available targets.

vars:
  PKG: github.com/torchstellar-team/one-cli/packages/cli
  CLI_DIR: packages/cli
  KERNEL_DIR: packages/kernel
  BIN_DIR: packages/cli/bin
  GOEXE:
    sh: go env GOEXE
  BIN: 'packages/cli/bin/one{{.GOEXE}}'
  GOPROXY: '{{.GOPROXY | default "https://goproxy.cn,direct"}}'
  # Release builds pass RELEASE_VERSION explicitly. Ordinary local builds use
  # a clearly non-release value so no tracked file can drift from a Git tag.
  BUILD_VERSION: '{{.RELEASE_VERSION | default "0.0.0-dev"}}'
  LDFLAGS: '-s -w -X main.version={{.BUILD_VERSION}}'
  LOCAL_VERSION:
    sh: |
      base="${RELEASE_VERSION:-0.0.0-dev}"
      commit=$(git rev-parse --short=7 HEAD 2>/dev/null || echo unknown)
      dirty=""
      if [ -n "$(git status --porcelain 2>/dev/null)" ]; then dirty=".dirty"; fi
      echo "${base}-local.${commit}${dirty}"
  LOCAL_LDFLAGS: '-s -w -X main.version={{.LOCAL_VERSION}}'
  LOCAL_GO_PROCS: '{{.LOCAL_GO_PROCS | default "2"}}'

env:
  GOPROXY: '{{.GOPROXY}}'

tasks:
  # Keep cached tasks at the repository root so sources/generates resolve
  # against the same paths. Use go -C when a command needs the CLI directory.
  default:
    desc: List available tasks
    cmds:
      - task --list

  build:
    desc: Build the local binary into packages/cli/bin/one
    deps: [sync-bundled, sync-web]
    status:
      - test -f '{{.BIN}}'
      - test "$({{.BIN}} --version)" = "{{.BUILD_VERSION}}"
    cmds:
      - mkdir -p '{{.BIN_DIR}}'
      - go -C '{{.CLI_DIR}}' build -trimpath -ldflags '{{.LDFLAGS}}' -o 'bin/one{{.GOEXE}}' ./cmd/one
    sources:
      - 'Taskfile.yml'
      - 'go.work'
      - 'go.work.sum'
      - 'packages/kernel/go.mod'
      - 'packages/kernel/**/*.go'
      - 'packages/cli/cmd/**/*.go'
      - 'packages/cli/internal/**/*.go'
      - 'packages/cli/internal/adapters/runtime/mise/assets/*.tar.gz'
      - 'packages/cli/internal/adapters/runtime/mise/assets/*.zip'
      - 'packages/cli/internal/adapters/deploy/kustomize/templates/*'
      - 'packages/cli/internal/platform/i18n/locales/*.json'
      - 'packages/cli/internal/resources/bundled/**/*'
      - 'packages/cli/pkg/**/*.go'
      - 'packages/cli/go.mod'
      - 'packages/cli/go.sum'
    generates:
      - '{{.BIN}}'

  gen-error-codes:
    desc: Render apps/docs/content/docs/zh/error-codes.md from internal/platform/errors/codes.go
    cmds:
      - go -C '{{.CLI_DIR}}' run ./tools/gen-error-codes
    sources:
      - 'packages/cli/internal/platform/errors/codes.go'
      - 'packages/cli/tools/gen-error-codes/**/*.go'
    generates:
      - 'apps/docs/content/docs/zh/error-codes.md'

  verify-cli-references:
    desc: Refuse `one <subcommand>` references in docs that name unregistered commands
    # The tool imports internal/bootstrap/cli → internal/resources/bundled, so it can't compile
    # without the //go:embed sources being present. sync-bundled covers
    # registry/_templates; sync-web covers _web. Both run before
    # `go run` here so a fresh checkout works without prior task invocations.
    deps: [sync-bundled, sync-web]
    cmds:
      - go -C '{{.CLI_DIR}}' run ./tools/verify-cli-references
    sources:
      - 'packages/cli/internal/**/*.go'
      - 'packages/cli/tools/verify-cli-references/**/*.go'
      - 'README.md'
      - 'CONTRIBUTING.md'
      - 'apps/docs/content/docs/**/*.md'
      - 'apps/docs/content/docs/**/*.mdx'
      - 'packages/templates/*/README.md'
      - 'packages/templates/*/README.md.hbs'

  verify-preset-codes:
    desc: Lock the v1 preset code table (template + deploy + env + container) — codes are append-only and never re-used
    # The test package imports internal/core/template → internal/resources/bundled, so it
    # needs the embed sources present. Mirrors verify-cli-references.
    deps: [sync-bundled, sync-web]
    cmds:
      - go -C '{{.CLI_DIR}}' test -count=1 -run 'TestTemplateCodesMatchGoldenAndRegistry|TestDeployCodesMatchGolden|TestEnvCodesMatchGolden|TestContainerCodesMatchGolden|TestGoldenSortedByCode' ./internal/modules/preset/...
    sources:
      - 'packages/cli/internal/modules/preset/**/*.go'
      - 'packages/cli/testdata/preset/v1_codes.json'
      - 'packages/templates/registry.json'

  verify-preset-vectors:
    desc: Lock the v1 preset id encoding — Encode(spec) and Parse(id) roundtrip every frozen vector
    deps: [sync-bundled, sync-web]
    cmds:
      - go -C '{{.CLI_DIR}}' test -count=1 -run 'TestEncodeVectors|TestParseEncodeRoundTrip|TestEncodeOrderIndependent' ./internal/modules/preset/...
    sources:
      - 'packages/cli/internal/modules/preset/**/*.go'
      - 'packages/cli/testdata/preset/v1_vectors.json'

  verify-help:
    desc: Refuse drift in cobra help text (rootHelp completeness + Example flag existence)
    # The tool imports internal/bootstrap/cli → internal/resources/bundled, so it can't compile
    # without the //go:embed sources being present. sync-bundled covers
    # registry/_templates; sync-web covers _web. Mirrors the deps
    # on verify-cli-references and verify-preset-codes.
    deps: [sync-bundled, sync-web]
    cmds:
      - go -C '{{.CLI_DIR}}' run ./tools/verify-help
    sources:
      - 'packages/cli/internal/**/*.go'
      - 'packages/cli/internal/platform/i18n/locales/*.json'
      - 'packages/cli/tools/verify-help/**/*.go'

  verify-docs:
    desc: All documentation drift checks (CLI references + help text + frontmatter presence + preset codes / vectors)
    cmds:
      - task: verify-cli-references
      - task: verify-help
      - task: verify-preset-codes
      - task: verify-preset-vectors
      - go run ./packages/cli/tools/repo-checks frontmatter

  verify-node-workspace:
    desc: Keep application dependency resolution owned by the root pnpm workspace
    cmds:
      - go run ./packages/cli/tools/repo-checks node-workspace

  hooks:install:
    desc: Enable the repository-managed Git hooks for this checkout
    summary: |
      Configures this checkout to load hooks from .githooks/. The pre-commit
      hook runs `task check`, which is the same PR gate used by GitHub Actions.
    cmds:
      - git config --local core.hooksPath .githooks
      - echo "Git pre-commit hook enabled (task check)"

  install:
    aliases: [install-local]
    desc: Build the CLI, install its launcher, and enable repository Git hooks
    summary: |
      One-shot developer install: builds the Dashboard, refreshes all bundled
      assets, compiles the CLI with local version metadata, and creates a launcher
      under ~/.local/bin pointing at the absolute binary in this checkout.
      macOS/Linux use a one symlink. Windows prefers a one.exe symlink and
      falls back to a one.cmd forwarding shim when symlinks are unavailable.
      Both keep working when later builds replace the binary in place.

      `task install-local` remains a compatibility alias.

      Idempotent — safe to re-run after switching branches.

      Requires ~/.local/bin to be on PATH. Add to your shell rc if not:
        export PATH="$HOME/.local/bin:$PATH"
    deps: [build-local]
    cmds:
      - task: hooks:install
      - go run ./packages/cli/tools/install-local "{{.BIN}}"

  build-local:
    internal: true
    deps: [sync-bundled, sync-web]
    dir: '{{.CLI_DIR}}'
    cmds:
      - mkdir -p bin
      - cmd: go build -p {{.LOCAL_GO_PROCS}} -trimpath -ldflags '{{.LOCAL_LDFLAGS}}' -o 'bin/one{{.GOEXE}}' ./cmd/one
        env:
          GOMAXPROCS: '{{.LOCAL_GO_PROCS}}'

  build-all:
    desc: Cross-compile every supported platform under go-dist/
    deps: [sync-bundled, sync-mise-all, sync-web]
    dir: '{{.CLI_DIR}}'
    cmds:
      - rm -rf ../../go-dist
      - mkdir -p ../../go-dist
      - for: { var: PLATFORMS, default: ['darwin/amd64', 'darwin/arm64', 'linux/amd64', 'linux/arm64', 'windows/amd64'] }
        cmd: |
          plat={{.ITEM}}
          os=${plat%/*}
          arch=${plat#*/}
          out=../../go-dist/one-${os}-${arch}
          [ "$os" = "windows" ] && out="${out}.exe"
          echo "→ $out"
          GOOS=$os GOARCH=$arch go build -trimpath -ldflags '{{.LDFLAGS}}' -o "$out" ./cmd/one

  check:
    desc: Run the complete monorepo PR gate
    summary: |
      Single local and CI entrypoint for One CLI's Go workspace and embedded
      Dashboard. Static checks and tests remain separate subtasks so CI can run
      them in parallel while `task check` preserves the same contract locally.
    cmds:
      - task: check:static
      - task: check:test

  check:static:
    desc: Run documentation, Go, and Dashboard static checks
    cmds:
      - task: verify-node-workspace
      - task: verify-docs
      - task: vet
      - task: fmt:check
      - task: check:dashboard

  check:test:
    desc: Build the binary and run Go plus Dashboard tests without race detection
    cmds:
      - task: test:go:plain
      - task: test:dashboard

  check:dashboard:
    desc: Run Dashboard lint and formatting checks
    cmds:
      - pnpm --dir apps/dashboard run check

  fmt:check:
    desc: Check Go formatting without rewriting files
    cmds:
      - go run ./packages/cli/tools/repo-checks gofmt

  test:
    desc: Run Go tests with race detector and Dashboard interaction tests
    cmds:
      - task: test:go
      - task: test:dashboard

  test:go:
    desc: Run kernel and CLI tests with race detector
    deps: [build]
    cmds:
      - go test -race ./{{.KERNEL_DIR}}/...
      - go test -race ./{{.CLI_DIR}}/...

  test:go:plain:
    desc: Run kernel and CLI tests without race detector
    deps: [build]
    cmds:
      - go test ./{{.KERNEL_DIR}}/...
      - go test ./{{.CLI_DIR}}/...

  test:dashboard:
    desc: Run Dashboard interaction tests
    deps: [build-web]
    cmds:
      - pnpm --dir apps/dashboard run test

  test:snapshot:
    desc: Run only the JSON-snapshot tests against testdata/reference
    deps: [build]
    dir: '{{.CLI_DIR}}'
    cmds:
      - go test -run Snapshot ./...

  pre-push:
    desc: Run the PR gate plus Go race tests before pushing
    summary: |
      Runs `task check`, the exact PR CI contract, then repeats the Go suites
      under the race detector. Dashboard architecture, lint, format, build, and
      interaction tests are already covered by `task check`.

      Run before every push. Cheap enough (~10–30s on a warm cache) that you
      shouldn't have to skip it. The first run on a fresh clone takes longer
      because sync-web bootstraps the dashboard via pnpm install + vite build.
    cmds:
      - task: check
      - task: test:go

  fmt:
    desc: gofmt the codebase
    cmds:
      - go fmt ./{{.KERNEL_DIR}}/...
      - go fmt ./{{.CLI_DIR}}/...

  vet:
    desc: go vet kernel and CLI modules
    deps: [sync-bundled, sync-web]
    cmds:
      - go vet ./{{.KERNEL_DIR}}/...
      - go vet ./{{.CLI_DIR}}/...

  tidy:
    desc: Tidy every Go workspace module
    cmds:
      - go -C {{.KERNEL_DIR}} mod tidy
      - go -C {{.CLI_DIR}} mod tidy
      - go work sync

  clean:
    desc: Remove packages/cli/bin/ and go-dist/
    cmds:
      - rm -rf {{.BIN_DIR}} go-dist

  dev:
    desc: Run the Go Dashboard API and Vite UI together
    summary: |
      Starts the current Go source on http://127.0.0.1:5174 and the Vite
      Dashboard on http://localhost:5173. Open that Vite URL directly.

      Workspace and Project data comes from the checked-in Dashboard fixture.
      Profile CRUD still reads and writes this machine's real One config;
      Profile bindings are real and scoped to the fixture Workspace root.

      Both processes stop together when you press Ctrl-C.
    deps: [sync-bundled, sync-web]
    cmds:
      - task --parallel --failfast --output prefixed dev:serve dev:dashboard

  dev:serve:
    dir: '{{.CLI_DIR}}/testdata/dashboard-dev-workspace'
    cmds:
      - go run ../../cmd/one serve --port 5174 --open=false -o text

  dev:dashboard:
    env:
      VITE_DEV_API_TARGET: http://127.0.0.1:5174
      VITE_DEV_DATA_MODE: fixture-live-profiles
    cmds:
      - pnpm --filter one-serve-web dev

  build-web:
    desc: Build the embedded `one serve` web UI (apps/dashboard/ → apps/dashboard/dist/)
    summary: |
      Builds the React UI shipped with `one serve` (sources at apps/dashboard/).
      Output lands at apps/dashboard/dist/. The bundled mirror at
      packages/cli/internal/resources/bundled/_web/ is refreshed by `task sync-web`,
      which depends on this task.

      Idempotent: reruns cheaply when sources are unchanged (task hashes
      sources/generates fingerprints).

      Requires Node + pnpm locally and in CI. Dependencies are resolved from
      the repository root pnpm-lock.yaml; app-level lockfiles are forbidden.
      Edit the UI → run `task sync-web` to rebuild the ignored embedded mirror.
    cmds:
      - pnpm --filter one-serve-web install --frozen-lockfile
      - pnpm --dir apps/dashboard build
    sources:
      - 'apps/dashboard/src/**/*'
      - 'apps/dashboard/index.html'
      - 'apps/dashboard/package.json'
      - 'apps/dashboard/vite.config.ts'
      - 'apps/dashboard/tsconfig*.json'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - 'pnpm-workspace.yaml'
    generates:
      - 'apps/dashboard/dist/index.html'

  sync-mise:
    desc: Fetch and verify the pinned mise archive embedded for the local platform
    run: once
    cmds:
      - go run ./packages/cli/tools/sync-mise

  sync-mise-all:
    desc: Fetch and verify mise archives for all release platforms
    run: once
    cmds:
      - go run ./packages/cli/tools/sync-mise --all

  sync-bundled:
    deps: [sync-mise]
    desc: Regenerate registry/_templates under packages/cli/internal/resources/bundled (go:embed sources)
    run: once
    summary: |
      Go's embed cannot traverse `..` or follow symlinks, so we keep physical
      copies of canonical assets under packages/cli/internal/resources/bundled. The
      whole bundled tree is gitignored and regenerated on demand.

      This task handles the cheap copies: registry.json, _templates/.
      It runs implicitly as a dep of `vet` / `test` / `build`. The dashboard
      build (sync-web) is separate but identically wired — both have to run
      before any Go command will compile the bundled package.

      Direct `go build` / IDE-driven `gopls` won't run any task, so a fresh
      clone needs `task sync-bundled && task sync-web` once before the Go
      toolchain stops complaining about missing embed paths.

      Agent instruction files and .one/.agents directories are excluded from
      the bundled templates. Dev-only go.mod files inside packages/templates/<id>/ are stripped
      from the bundled copy — their presence isolates each Go-based template
      from the parent module during repository development, but go:embed
      treats any directory containing go.mod as a separate module and
      excludes its subtree, which would silently drop the go-api template
      from the binary.
    cmds:
      - go run ./packages/cli/tools/sync-resources bundled

  sync-web:
    desc: Rebuild the embedded `one serve` UI from apps/dashboard/ and refresh packages/cli/internal/resources/bundled/_web/
    run: once
    summary: |
      Requires Node + pnpm — both CI and local dev need them. _web/ is
      gitignored; this task is the only path that creates it. Runs as a
      dep of `vet` / `test` / `build`, so the normal Taskfile flow always
      keeps it fresh.

      First run on a clean checkout takes 30–90s (pnpm install + vite build).
      Subsequent runs hit the task-level sources/generates fingerprint and
      are near-free unless you've edited apps/dashboard/.
    deps: [build-web]
    cmds:
      - go run ./packages/cli/tools/sync-resources web