Taskfile.yml

# https://taskfile.dev

version: "3"

dotenv: [".env.local", ".env"]

vars:
  # Container runtime configuration
  CONTAINER_RUNTIME: '{{.CONTAINER_RUNTIME | default "docker"}}'
  DOCKER_COMPOSE: '{{.CONTAINER_COMPOSE | default "docker compose"}}'
  SERVICE: retrieval
  PYTHON: "{{.DOCKER_COMPOSE}} exec {{.SERVICE}}"

tasks:
  # ==========================================================================
  # Setup & Installation
  # ==========================================================================

  default:
    desc: Show available tasks
    cmds:
      - task --list

  install:
    desc: Install project dependencies (dev)
    cmds:
      - "{{.PYTHON}} pip install '.[dev]'"

  setup:
    desc: First-time project setup
    cmds:
      - task: up
      - task: install
      - cmd: echo "Project is ready! Visit https://{{.COMPOSE_DOMAIN}}"

  # ==========================================================================
  # Container Management
  # ==========================================================================

  up:
    desc: Start containers
    cmds:
      - task: network:frontend
      - "{{.DOCKER_COMPOSE}} up -d --wait"

  build:
    desc: Build container image
    cmds:
      - "{{.DOCKER_COMPOSE}} build"

  network:frontend:
    desc: Check frontend network exists (created by Traefik)
    internal: true
    silent: true
    cmds:
      - cmd: |
          if ! {{.CONTAINER_RUNTIME}} network inspect frontend >/dev/null 2>&1; then
            echo ""
            echo "ERROR: The 'frontend' network does not exist."
            echo ""
            echo "This network is created by Traefik. Please start Traefik first:"
            echo "  itkdev-docker-compose traefik:start"
            echo ""
            echo "Or if running standalone without Traefik, create the network manually:"
            echo "  {{.CONTAINER_RUNTIME}} network create frontend"
            echo ""
            exit 1
          fi

  open:
    desc: Open site in browser
    cmds:
      - open "https://{{.COMPOSE_DOMAIN}}"

  down:
    desc: Stop containers
    cmds:
      - "{{.DOCKER_COMPOSE}} down"

  restart:
    desc: Restart containers
    cmds:
      - task: down
      - task: up

  logs:
    desc: Tail container logs
    cmds:
      - "{{.DOCKER_COMPOSE}} logs -f {{.SERVICE}}"

  shell:
    desc: Open a shell in the retrieval container
    cmds:
      - "{{.PYTHON}} bash"

  # ==========================================================================
  # Code Quality
  # ==========================================================================

  lint:
    desc: Run all linters
    cmds:
      - task: lint:check
      - task: lint:format:check

  lint:check:
    desc: Check code with ruff
    cmds:
      - "{{.PYTHON}} ruff check ."

  lint:fix:
    desc: Fix code issues with ruff
    cmds:
      - "{{.PYTHON}} ruff check --fix ."

  lint:format:
    desc: Format code with ruff
    cmds:
      - "{{.PYTHON}} ruff format ."

  lint:format:check:
    desc: Check code formatting with ruff
    cmds:
      - "{{.PYTHON}} ruff format --check ."

  # ==========================================================================
  # Testing
  # ==========================================================================

  test:
    desc: Run all tests
    cmds:
      - "{{.PYTHON}} pytest -v"

  test:coverage:
    desc: Run tests with coverage report
    cmds:
      - "{{.PYTHON}} pytest --cov=app --cov-report=term-missing -v"

  # ==========================================================================
  # Security audit
  # ==========================================================================
  # Both tasks run inside the retrieval container via {{.PYTHON}}, so the
  # versions of pip-audit / bandit are the ones pinned in pyproject.toml's
  # dev extras. Rebuild the image (or `task install` into a running
  # container) after pulling in the dev dependencies — the binaries aren't
  # on PATH otherwise and the tasks will fail with a clear "command not
  # found", which is what we want (vs. silently passing on a stale image).

  audit:
    desc: Run all security audit tools (fails on any finding)
    cmds:
      - task: audit:deps
      - task: audit:code

  audit:deps:
    desc: Scan declared dependencies for known CVEs (pip-audit)
    cmds:
      - "{{.PYTHON}} python -m pip_audit --strict ."

  audit:code:
    desc: Static security scan of app/ (bandit)
    cmds:
      - "{{.PYTHON}} python -m bandit -r app/ -ll"

  # ==========================================================================
  # Code Checks (CI)
  # ==========================================================================

  ci:
    desc: Run all CI checks (lint + test)
    cmds:
      - task: lint
      - task: test


  # ---------------------------------------------------------------------------
  # Build
  # ---------------------------------------------------------------------------
  build:image:
    desc: "Build and push production image to ghcr.io (multi-arch). Override PLATFORMS to build one arch (e.g. PLATFORMS=linux/amd64) for faster local builds."
    vars:
      IMAGE: ghcr.io/aarhusai/retrieval-agent
      TAG: '{{.TAG | default "latest"}}'
      PLATFORMS: '{{.PLATFORMS | default "linux/amd64,linux/arm64"}}'
    cmds:
      - task: build:image:builder
      - docker buildx build --builder retrieval-agent-builder --platform {{.PLATFORMS}} --target prod -t {{.IMAGE}}:{{.TAG}} --push .

  build:image:builder:
    desc: "Ensure the buildx builder + QEMU binfmt handlers for multi-arch builds exist (idempotent first-run setup)."
    internal: true
    silent: true
    cmds:
      - cmd: |
          if ! docker buildx inspect retrieval-agent-builder >/dev/null 2>&1; then
            echo "First-run setup: registering QEMU binfmt handlers (cross-arch emulation)..."
            docker run --privileged --rm tonistiigi/binfmt --install all
            echo "Creating buildx builder 'retrieval-agent-builder' (docker-container driver)..."
            docker buildx create --name retrieval-agent-builder --driver docker-container --bootstrap
          fi