fix(mixins): recurse into nested components and only update existing copies

Closes #47.

The `mixins:update-all` task previously assumed a flat `./components/*`
layout, so nested deployable instances like `aws-iam/delegated-tf-role`
were never updated.

It also unconditionally copied the mixin into every top-level component
directory, which is wrong: a given mixin is not universally applicable
(e.g. the `secrets.sops.tf` mixin only belongs in components that actually
consume SOPS secrets). Copying it everywhere creates unused files that
have to be deleted by hand.

Changes:

- Locate destinations by recursively finding existing copies of the named
  mixin under `./components/` (`find ... -type f -name <file>`). A
  component opts in to a mixin by having a copy of it on disk; this task
  only keeps those existing copies in sync. To adopt a mixin in a new
  component, copy it in manually once — that becomes the explicit opt-in
  and future `update-all` runs will track the template.
- Recursion picks up nested instance layouts (e.g.
  `components/aws-iam/delegated-tf-role/<file>`) automatically.
- Prune `.terraform/` and `.terragrunt-cache/` so vendored child-module
  copies that Terraform/Terragrunt drop on disk during init are not
  overwritten.
- Set `dir: "{{.USER_WORKING_DIR}}"` so `./mixins/` and `./components/`
  resolve from where the user invoked `task`, not from the included
  taskfile's own directory.
- Drop the `generates:` glob — it cannot express nested outputs and was
  causing Task to falsely treat the task as up-to-date.
- Rewrite the loop to avoid `read -d ''` (not supported by Task's
  mvdan/sh interpreter).

Author: oycyc

lib/mixins/Taskfile.yml

@@ -2,21 +2,30 @@ version: "3"
 
 tasks:
   update-all:
-    desc: "Update a mixin across the components. Example: `task mixins:update-all -- context.tf`."
+    # Updates (by overwriting) every existing copy of the named mixin under
+    # ./components/ with the current ./mixins/<file> template.
+    #
+    # Directories opt in to a mixin by having a copy of it on disk; this task only
+    # touches directories that already contain <file>. It does NOT add the mixin
+    # to directories that don't already have it — adopt a mixin in a new component
+    # by copying it in manually first as it needs to be an explicit choice, then
+    # future `update-all` runs will keep it in sync.
+    #
+    # `.terraform/` and `.terragrunt-cache/` are pruned so we don't overwrite the
+    # mixin inside vendored child-module copies that Terraform/Terragrunt drop on
+    # disk during init.
+    desc: "Update (by overwriting) every existing copy of a mixin under ./components/ with the current template. Does not add the mixin to directories that don't already have it. Example: `task mixins:update-all -- context.tf`."
+    dir: "{{.USER_WORKING_DIR}}"
     preconditions:
       - sh: test -f ./mixins/{{.CLI_ARGS}}
         msg: "File does not exist: ./mixins/{{.CLI_ARGS}}"
-      - sh: test -d ./components && [ "$(ls -A ./components)" ]
-        msg: ./components/ directory is empty or does not exist.
     sources:
       - ./mixins/{{.CLI_ARGS}}
-    generates:
-      - ./components/*/{{.CLI_ARGS}}
     cmds:
       - cmd: |
-          for comp in ./components/*; do
-            cp -v ./mixins/{{.CLI_ARGS}}  $comp/{{.CLI_ARGS}}
-          done;
+          find ./components -type d \( -name .terraform -o -name .terragrunt-cache \) -prune -o -type f -name {{.CLI_ARGS}} -print | while IFS= read -r dest; do
+            cp -v ./mixins/{{.CLI_ARGS}} "$dest"
+          done
         silent: true
 
   pull-sops: