Taskfile.yml

version: '3'

env:
  JQ: docker run --rm -i ghcr.io/jqlang/jq:1.8.1
  HADOLINT_IMAGE: ghcr.io/hadolint/hadolint:v2.14.0
  ACTIONLINT_IMAGE: rhysd/actionlint:1.7.12
  ZIZMOR_IMAGE: ghcr.io/zizmorcore/zizmor:1.25.2
  PINACT_IMAGE: ghcr.io/toshy/docker-pinact:4.1.0

tasks:
  default:
    cmds:
      - task --list

  # nektos/act
  act:push:
    desc: Test release
    cmds:
      - act push {{.CLI_ARGS}}

  act:push:version:
    desc: Test release for specific version
    summary: |
      Example:

      task act:push:version pv="8.5.2"
    vars:
      PHP_VERSIONS: '{{ .pv | default "8.5.2"}}'
    cmds:
      - act push --input version={{.PHP_VERSIONS}}

  act:job:prepare:
    desc: Act test "prepare" job
    cmds:
      - act -j prepare {{.CLI_ARGS}}

  act:job:build:
    desc: Act test "build" job
    cmds:
      - act -j build {{.CLI_ARGS}}

  act:job:merge:
    desc: Act test "merge" job
    cmds:
      - act -j merge {{.CLI_ARGS}}

  # buildx bake
  bake:
    desc: Bake
    vars:
      PHP_VERSIONS: '{{ .pv | default "8.2.33,8.3.32,8.4.23,8.5.8"}}'
    cmds:
      - PHP_VERSIONS={{.PHP_VERSIONS}} docker buildx bake --set *.platform=linux/amd64

  bake:print:
    desc: Bake print options without building
    vars:
      PHP_VERSIONS: '{{ .pv | default "8.2.33,8.3.32,8.4.23,8.5.8"}}'
    cmds:
      - PHP_VERSIONS={{.PHP_VERSIONS}} docker buildx bake --print | $JQ

  # zensical
  docs:
    desc: Zensical build
    cmds:
      - docker run --rm -it -v $(pwd):/docs -w /docs docker.io/zensical/zensical:0.0 build --clean

  docs:live:
    desc: Zensical development server
    vars:
      PORT: '{{.p | default "8001"}}'
    cmds:
      - docker run --rm -it -p {{.PORT}}:8000 -v $(pwd):/docs -w /docs docker.io/zensical/zensical:0.0 serve --dev-addr 0.0.0.0:8000


  # trivy
  trivy:
    desc: Trivy from local build
    vars:
      TRIVY_VERSION: '{{ .tv | default "latest" }}'
      PHP_BASE: '{{ .pv | default "8.5.2-fpm-trixie"}}'
      TARGET: '{{ .t | default "ffmpeg" }}'
    cmds:
      - |
        docker build \
        --build-context php-base=docker-image://php:{{.PHP_BASE}} \
        --target {{.TARGET}} \
        -t toshy/trivy:{{.PHP_BASE}} .
      - |
        docker run --rm --pull=always \
        -v /var/run/docker.sock:/var/run/docker.sock \
        aquasec/trivy:{{.TRIVY_VERSION}} image \
        --ignore-unfixed --severity CRITICAL,HIGH --exit-code 1 \
        toshy/trivy:{{.PHP_BASE}}

  trivy:remote:
    desc: Trivy scan remote image
    vars:
      TRIVY_VERSION: '{{ .tv | default "latest" }}'
      IMAGE: '{{ .t | default "ghcr.io/toshy/php:8.3-fpm-trixie-ffmpeg" }}'
    cmds:
      - |
        docker pull {{.IMAGE}}
      - |
        docker run --rm --pull=always \
        -v /var/run/docker.sock:/var/run/docker.sock \
        aquasec/trivy:{{.TRIVY_VERSION}} image \
        --ignore-unfixed --severity CRITICAL --exit-code 1 \
        {{.IMAGE}}

  # Linting
  hadolint:
    desc: Lint all Dockerfiles
    cmds:
      - docker run --rm -v "{{.ROOT_DIR}}:/repo" -w /repo {{.HADOLINT_IMAGE}} hadolint /repo/Dockerfile

  actionlint:
    desc: Lint GitHub Actions workflows in .github/workflows
    silent: true
    cmds:
      - docker run --rm -v "{{.ROOT_DIR}}:/repo" -w /repo "{{.ACTIONLINT_IMAGE}}" -color

  zizmor:
    desc: Audit GitHub Actions workflows for security issues in .github/workflows
    silent: true
    cmds:
      - docker run --rm -v "{{.ROOT_DIR}}:/repo" -w /repo "{{.ZIZMOR_IMAGE}}" --color=always --collect=workflows .

  pinact:
    desc: Validate GitHub Actions are pinned to commit SHAs in .github/workflows
    summary: |
      Check pinned GitHub Actions against commit SHAs in .github/workflows.

      Usage:
      - task pinact TOKEN=github_pat_...

      If no "TOKEN" environment variable is passed, you might experience rate limiting.
      See https://github.com/suzuki-shunsuke/pinact#github-access-token.
    silent: true
    vars:
      TOKEN: '{{.t | default ""}}'
    cmds:
      - |
        if [ ! -d "{{.ROOT_DIR}}/.github/workflows" ]; then
          printf "\033[33m[pinact]\033[0m no .github/workflows directory found\n"
          exit 0
        fi
        docker run --rm \
          -v "{{.ROOT_DIR}}:/repo" \
          -e PINACT_GITHUB_TOKEN="{{.TOKEN}}" \
          "{{.PINACT_IMAGE}}" run --diff

  pinact:fix:
    desc: Pin GitHub Actions to commit SHAs in-place in .github/workflows
    summary: |
      Check pinned GitHub Actions against commit SHAs in .github/workflows and fixes them.

      Usage:
      - task pinact:fix TOKEN=github_pat_...

      If no "TOKEN" environment variable is passed, you might experience rate limiting.
      See https://github.com/suzuki-shunsuke/pinact#github-access-token.
    silent: true
    vars:
      TOKEN: '{{.t | default ""}}'
    cmds:
      - |
        if [ ! -d "{{.ROOT_DIR}}/.github/workflows" ]; then
          printf "\033[33m[pinact]\033[0m no .github/workflows directory found\n"
          exit 0
        fi
        docker run --rm \
          -v "{{.ROOT_DIR}}:/repo" \
          -u "${UID}:${GID}" \
          -e PINACT_GITHUB_TOKEN="{{.TOKEN}}" \
          "{{.PINACT_IMAGE}}" run --fix