lotor/Taskfile.yml at main · meshrunner-dev/lotor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
# Development tasks. `task check` is the gate: everything a commit must
# pass, composed from the atomic tasks below in the order that fails
# fastest. Tools run through `go run` at pinned versions, so the gate is
# reproducible on any machine with a Go toolchain and nothing else.
version: "3"

vars:
  GOLANGCI: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.0
  GOVULNCHECK: go run golang.org/x/vuln/cmd/govulncheck@latest

tasks:
  default:
    desc: List the available tasks (run `task check` for the full gate)
    silent: true
    cmds:
      - task --list

  check:
    desc: "Full gate: formatting, tidy, lint, race tests, lean build, govulncheck"
    cmds:
      - task: fmt
      - task: tidy
      - task: lint
      - task: identity:check
      - task: test:race
      - task: build:lean
      - task: vuln

  fmt:
    desc: Verify formatting without rewriting anything
    cmds:
      - |
        unformatted="$(gofmt -l .)"
        if [ -n "$unformatted" ]; then
          echo "gofmt — files need formatting:"
          echo "$unformatted"
          exit 1
        fi

  tidy:
    desc: Verify go.mod/go.sum are minimal and complete
    cmds:
      - go mod tidy -diff

  lint:
    desc: Run golangci-lint (strict baseline in .golangci.yml; wraps vet and staticcheck)
    cmds:
      - "{{.GOLANGCI}} run"

  test:
    desc: Run the test suite
    cmds:
      - go test ./...

  test:race:
    desc: Tests under the race detector
    cmds:
      - go test -race ./...

  vuln:
    desc: Scan dependencies for known vulnerabilities
    cmds:
      - "{{.GOVULNCHECK}} ./..."

  identity:check:
    desc: Verify the product identity invariants in units and docs
    cmds:
      - ./scripts/identity-check.sh

  build:lean:
    desc: Compile the memory-lean variant (no CLI history, for tight hosts)
    cmds:
      - go build -tags lean ./...

  build:
    desc: Build the daemon into ./bin, through the one shared recipe
    cmds:
      - ./scripts/build.sh -o bin/lotor

  build:arm64:
    desc: Cross-compile the daemon for a 64-bit ARM board
    cmds:
      - ./scripts/build.sh -o bin/lotor-arm64 -goos linux -goarch arm64

  build:arm:
    desc: Cross-compile the daemon for a 32-bit ARM board (Cortex-A7 and up)
    cmds:
      - ./scripts/build.sh -o bin/lotor-arm -goos linux -goarch arm -goarm 7

  build:info:
    desc: Build then print the binary's own account of itself
    cmds:
      - ./scripts/build.sh -o bin/lotor
      - go version -m bin/lotor
      - bin/lotor version

  build:repro:
    desc: "Reproducibility proof: two clean builds must be byte-identical (publication path, not the per-commit gate)"
    cmds:
      - |
        a="$(mktemp -d)"; b="$(mktemp -d)"
        trap 'rm -rf "$a" "$b"' EXIT
        ./scripts/build.sh -o "$a/lotor" -goos linux -goarch arm64
        ./scripts/build.sh -o "$b/lotor" -goos linux -goarch arm64
        ha="$(sha256sum "$a/lotor" | cut -d' ' -f1)"
        hb="$(sha256sum "$b/lotor" | cut -d' ' -f1)"
        if [ "$ha" != "$hb" ]; then
          echo "build is not reproducible: $ha != $hb"; exit 1
        fi
        echo "reproducible: $ha"

  dev:
    desc: "Live reload: a hardware-free daemon that rebuilds and restarts on every edit"
    cmds:
      - ./scripts/dev-bench.sh
      - air

  dev:console:
    desc: Open the console of the running bench (a second terminal)
    interactive: true
    cmds:
      - go run ./cmd/lotor console .dev/console.sock

  dev:reset:
    desc: Discard the bench — its database, its generated configuration and its identities
    cmds:
      - rm -rf .dev