Taskfile.yml

---
# https://taskfile.dev

version: '3'

set:
  - nounset
  - errexit
  - pipefail

silent: true

vars:
  PRESENTATION:
    sh: |
      rel="${USER_WORKING_DIR#"{{.TASKFILE_DIR}}"}"
      rel="${rel#/}"        # drop any leading slash
      rel="${rel#*/}"       # drop "presentations/" or "modules/"
      printf '%s\n' "${rel%%/*}"   # keep up to next slash → foo/bar

tasks:
  lock:
    desc: Update uv.lock if pyproject.toml has changed
    internal: true
    sources:
      - pyproject.toml
    generates:
      - uv.lock
    cmds:
      - uv lock

  init-uv:
    desc: Initializes uv if uv.lock changes
    internal: true
    sources:
      - uv.lock
    cmds:
      - uv sync

  init-submodules:
    desc: >
      Initializes git submodules; paved road projects include the Seiso goat 🐐
      for its shared configs, etc.
    internal: true
    status:
      # Only update submodules if you are in a git repository; quote to avoid yaml intrepretering the ! as a node tag
      # https://yaml.org/spec/1.2.2/#691-node-tags
      - '! test -d .git'
    cmds:
      - git submodule update --init --recursive

  init:
    desc: Initialize the repo for local use; intended to be run after git clone
    deps: [lock]
    cmds:
      - task: init-uv
      - task: init-submodules

  lint:
    desc: Run the linter(s)
    cmds:
      - prek run --all-files

  validate:
    desc: Validate the pre-commit config and hooks files
    cmds:
      - prek validate-config .pre-commit-config.yaml

  update:
    desc: Update the project dependencies, and other misc components
    cmds:
      - uv lock
      - prek autoupdate --bleeding-edge --freeze --jobs 4
      - for repo in $(find ./modules/iac_security/demo -type d -mindepth 1 -maxdepth 1); do pushd "${repo}"; git pull origin main; popd; done

  start:
    desc: Start the presentation based on the directory the user is currently in
    vars:
      PRESENTATION:
        sh: |
          if [ -n "{{.PRESENTATION}}" ] && [ "{{.PRESENTATION}}" != "<no value>" ]; then
            echo "{{.PRESENTATION}}"
          else
            rel="${USER_WORKING_DIR#"{{.TASKFILE_DIR}}"}"
            rel="${rel#/}"        # drop any leading slash
            rel="${rel#*/}"       # drop "presentations/" or "modules/"
            printf '%s\n' "${rel%%/*}"   # keep up to next slash → foo/bar
          fi
    cmds:
      - '{{.TASKFILE_DIR}}/start.sh --preso={{.PRESENTATION}} {{.CLI_ARGS}}'

  generate-pdfs:
    desc: Generate all of the PDFs
    vars:
      PRESENTATIONS:
        sh: ./start.sh --list
    cmds:
      - for: { var: PRESENTATIONS }
        task: generate-pdf
        vars:
          PRESENTATION: '{{.ITEM}}'

  generate-pdf:
    desc: Generate one PDF
    requires:
      vars:
        - PRESENTATION
    vars:
      OUTPUT_PDF: '{{.USER_WORKING_DIR}}/{{.PRESENTATION}}.pdf'
      PDF_PORT: '8399'
    cmds:
      # A fixed port, so this task knows where to point Chrome and can stop
      # exactly what it started — `task stop` with no args would kill any deck
      # the user happens to be presenting.
      - defer: { task: stop, vars: { CLI_ARGS: '{{.PDF_PORT}}' } }
      - task: start
        vars:
          PRESENTATION: '{{.PRESENTATION}}'
          CLI_ARGS: --no-open --no-cleanup --port={{.PDF_PORT}}
      # The modern engine serves each deck at /current-<name>.html; revealjs
      # serves it at / and needs ?print-pdf.
      - |
        modern="http://localhost:{{.PDF_PORT}}/current-{{.PRESENTATION}}.html"
        if curl --fail -s -o /dev/null "${modern}"; then
          url="${modern}"
        else
          url="http://localhost:{{.PDF_PORT}}/?print-pdf"
        fi
        /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --headless --no-pdf-header-footer --window-size=1920,1080 \
          --virtual-time-budget=15000 --print-to-pdf="{{.OUTPUT_PDF}}" "${url}"

  cleanup-pdfs:
    desc: Cleanup the generated PDFs
    cmds:
      - rm -f *.pdf

  stop:
    desc: >
      Shut down running presentations. With no args, stops all of them;
      pass a port (task stop -- 8001) to stop just that one.
    cmds:
      - |
        shopt -s nullglob
        args="{{.CLI_ARGS}}"
        if [ -n "${args}" ]; then
          files=""
          for port in ${args}; do files="${files} .container_id.${port}"; done
        else
          files=".container_id .container_id.*"
        fi
        found=0
        for f in ${files}; do
          [ -r "${f}" ] || continue
          found=1
          docker kill "$(cat "${f}")" >/dev/null 2>&1 || true
          rm -f "${f}"
          port="${f#.container_id}"; port="${port#.}"
          echo "Stopped presentation${port:+ on port ${port}}"
        done
        [ "${found}" -eq 1 ] || echo "No running presentations found"

  clean:
    desc: Clean up build artifacts, cache files/directories, temp files, etc.
    cmds:
      - mv -f reveal.js/index.html.bkp reveal.js/index.html 2>/dev/null || true
      - rm -f modules/current.html
              current.html
              current-*.html
              modules/shared/css/modern.css
              reveal.js/modules 2>/dev/null || true
      - rm -f reveal.js/dist/theme/fonts/bitter
              reveal.js/dist/theme/fonts/rock-salt
              reveal.js/dist/theme/custom.css
              reveal.js/css/theme/source/custom.scss
              reveal.js/dist/theme/seiso.css
              reveal.js/css/theme/source/seiso.scss
              reveal.js/modules
              reveal.js/presentations 2>/dev/null || true
      - rm -rf modules/policy_as_code/demo/TODO
               modules/policy_as_code/demo/cosign*
               modules/policy_as_code/demo/Dockerfile 2>/dev/null || true
      - rm -rf presentations/2023-09-TechFest/demo/TODO
               presentations/2023-09-TechFest/demo/cosign*
               presentations/2023-09-TechFest/demo/Dockerfile 2>/dev/null || true
      - rm -rf presentations/2025-07-BSides-PGH/demo/bsidespgh25 2>/dev/null || true
      # Legacy-engine housekeeping. The reveal.js submodule is not checked out
      # in every worktree, and the modern engine never touches it, so a missing
      # one must not fail the clean that every `start.sh` run begins with.
      - if [ -e reveal.js/package-lock.json ]; then (cd reveal.js && git restore package-lock.json); fi
      - find {{.TASKFILE_DIR}} -type d -name '*.egg-info' -exec rm -rf {} +
      - find {{.TASKFILE_DIR}} -type d -name 'coverage-reports' -exec rm -rf {} +
      - find {{.TASKFILE_DIR}} -type f -name '.coverage' -delete
      - find {{.TASKFILE_DIR}} -type d -name 'htmlcov' -exec rm -rf {} +
      - find {{.TASKFILE_DIR}} -type d -name 'build' -exec rm -rf {} +
      - find {{.TASKFILE_DIR}} -type d -name '__pycache__' -exec rm -rf {} +
      - find {{.TASKFILE_DIR}} -type d -name '.mypy_cache' -exec rm -rf {} +
      - find {{.TASKFILE_DIR}} -type d -name '.pytest_cache' -exec rm -rf {} +
      - find {{.TASKFILE_DIR}} -type f -name '*.pyc' -delete
      - find {{.TASKFILE_DIR}} -type f -name '*.whl' -delete
      - find {{.TASKFILE_DIR}} -type d -name '.ruff_cache' -exec rm -rf {} +
      - find {{.TASKFILE_DIR}} -type f -name '.DS_Store' -delete
      - find {{.TASKFILE_DIR}} -type f -name '.Thumbs.db' -delete
      - find {{.TASKFILE_DIR}} -type d -name '.task' -exec rm -rf {} +
      - '{{if eq .CLI_ARGS "all"}}echo "WARNING: Running a clean all in {{.TASKFILE}}"{{end}}'
      - '{{if eq .CLI_ARGS "all"}}find {{.TASKFILE_DIR}} -type d -name ".venv" -exec rm -rf {} +{{end}}'