Taskfile.yml

version: "3"

# Silent by default — set TASK_VERBOSE=1 or use --verbose to show commands
silent: true

vars:
  # Default registry for local publishing; CI overrides CUE_REGISTRY in the
  # environment (GHCR mapping). opmodel.dev resolves the core@v1 dependency and
  # this catalog's own publish target; cue.dev / others fall through.
  CUE_LOCAL_REGISTRY: 'opmodel.dev=localhost:5000+insecure,registry.cue.works'

tasks:
  default:
    desc: Show available tasks
    cmds:
      - task --list

  ## CUE catalog

  fmt:
    desc: Format all CUE files
    dir: src
    cmds:
      - cue fmt ./...

  fmt:check:
    desc: Verify CUE files are formatted (fails if any file would change)
    cmds:
      - (cd src && cue fmt ./...)
      - git diff --exit-code -- 'src/**/*.cue' 'src/*.cue'

  vet:
    desc: Validate the catalog package
    dir: src
    cmds:
      - cue vet ./...

  tidy:
    desc: Tidy the CUE module manifest
    dir: src
    cmds:
      - cue mod tidy

  ## Index generation

  generate:index:
    desc: Regenerate src/INDEX.md from the CUE definitions
    cmds:
      - bash .tasks/generate-index.sh "$(pwd)" > src/INDEX.md

  generate:index:check:
    desc: Verify src/INDEX.md matches generated output (exits non-zero if stale)
    cmds:
      - |
        set -euo pipefail
        tmp=$(mktemp)
        trap 'rm -f "$tmp"' EXIT
        bash .tasks/generate-index.sh "$(pwd)" > "$tmp"
        if ! diff -q src/INDEX.md "$tmp" >/dev/null 2>&1; then
          echo "FAIL: src/INDEX.md is out of date — run 'task generate:index'"
          diff src/INDEX.md "$tmp" || true
          exit 1
        fi
        echo "OK: src/INDEX.md is up to date."

  ## Publishing
  #
  # The catalog uses publish-time version stamping (not plain `cue mod publish`).
  # The committed tree resolves identity.Version to the "0.0.0-dev" sentinel;
  # publish copies src/ to a transient build dir, writes
  # identity/version_override.cue pinning the concrete bare SemVer, vets from the
  # build dir, then runs `cue mod publish vX.Y.Z`. The source tree is never
  # mutated. Publishing the dev sentinel is refused.

  publish:
    desc: Publish opmodel.dev/catalogs/opm at VERSION via temp-build stamping (e.g. task publish VERSION=v0.1.0)
    requires:
      vars: [VERSION]
    vars:
      BUILD_DIR: .build/catalog
    preconditions:
      - sh: command -v rsync >/dev/null 2>&1
        msg: "rsync is required"
      - sh: command -v cue >/dev/null 2>&1
        msg: "cue is required"
    cmds:
      - |
        set -euo pipefail

        # Inherit CUE_REGISTRY from the environment (CI sets GHCR); default to
        # the local registry for laptop publishing.
        : "${CUE_REGISTRY:={{.CUE_LOCAL_REGISTRY}}}"
        export CUE_REGISTRY

        SRC="src"
        BUILD="{{.BUILD_DIR}}"
        DEV_SENTINEL="0.0.0-dev"

        # Normalize: strip a leading v for the bare SemVer; the OCI tag re-adds it.
        BARE="$(printf '%s' '{{.VERSION}}' | sed 's/^v//')"

        # Stage a clean build tree (source untouched).
        rm -rf "$BUILD"
        mkdir -p "$BUILD"
        rsync -a \
          --exclude='cue.mod/pkg' \
          --exclude='cue.mod/gen' \
          --exclude='cue.mod/usr' \
          "$SRC/" "$BUILD/"

        # Stamp the concrete version into the build tree only (never the source
        # tree). With no real VERSION the stamp is skipped and the resolved
        # version stays at the dev sentinel, tripping the guard below.
        if [ -n "$BARE" ] && [ "$BARE" != "$DEV_SENTINEL" ]; then
          printf 'package identity\n\nVersion: "%s"\n' "$BARE" > "$BUILD/identity/version_override.cue"
        fi

        # Resolve the effective version from the staged identity package.
        RESOLVED="$(cd "$BUILD" && cue export ./identity -e Version 2>/dev/null | tr -d '"')"

        # Guard: the dev sentinel is never publishable.
        if [ -z "$RESOLVED" ] || [ "$RESOLVED" = "$DEV_SENTINEL" ]; then
          echo "::error:: refusing to publish catalog at version '${RESOLVED:-<unset>}' — supply VERSION=X.Y.Z ('$DEV_SENTINEL' is the dev sentinel and is not publishable)" >&2
          exit 1
        fi

        echo "Validating catalog at ${RESOLVED}..."
        (cd "$BUILD" && cue vet ./...)

        echo "Publishing opmodel.dev/catalogs/opm@${RESOLVED} (OCI tag v${RESOLVED}) to ${CUE_REGISTRY}..."
        (cd "$BUILD" && cue mod publish "v${RESOLVED}")
        echo "Published opmodel.dev/catalogs/opm@${RESOLVED}"

  branch-tag:
    desc: Print the branch-publish tag for HEAD (no side effects)
    cmds:
      - bash .tasks/branch-tag.sh "$(pwd)"

  publish:branch:
    desc: Publish HEAD as a -dev pre-release derived from the commit
    cmds:
      - task: check
      - |
        set -euo pipefail
        tag=$(bash .tasks/branch-tag.sh "$(pwd)")
        # branch-tag.sh emits a v-prefixed tag; the publish task re-adds the v.
        task publish VERSION="${tag}"

  ## Aggregate

  check:
    desc: Format check, vet, and INDEX freshness
    cmds:
      - task: fmt:check
      - task: vet
      - task: generate:index:check