Taskfile.yml

version: '3'

vars:
  CONTAINER_RUNTIME:
    sh: command -v podman 2>/dev/null || command -v docker 2>/dev/null || echo ""
  GOLANGCI_VERSION: "v2.14.0"
  TRIVY_IMAGE: "docker.io/aquasec/trivy@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa"
  # Stufe der Design-System-Migration. 1 = Token-Vertrag, 2 = kompiliertes CSS,
  # 3 = alte Klassen und JS-Farben, 6 = Spec-Sheets. Wird pro PR erhöht.
  DESIGN_PHASE: "6"

tasks:
  default:
    desc: List available tasks
    silent: true
    cmds:
      - task --list

  init:
    desc: Install npm deps, build CSS/JS, copy assets
    cmds:
      - npm install
      - task: css
      - task: js
      - task: icons
      - mkdir -p ./src/assets/js
      - cp ./node_modules/bootstrap/dist/js/bootstrap.bundle.min.js* ./src/assets/js/
      - cmd: cd src && go get -u

  vet:
    desc: Run go vet
    dir: src
    cmds:
      - go vet

  tidy:
    desc: Format code and tidy modfile
    dir: src
    cmds:
      - go fmt ./...
      - go mod tidy -v

  modernize:
    desc: Report the Go modernizations the code is missing (read-only, fails when any are pending)
    cmds:
      - bash scripts/check-modernize.sh

  modernize-fix:
    desc: Apply the Go modernizations (go fix)
    cmds:
      - bash scripts/check-modernize.sh --fix

  test:
    desc: Run code tests
    dir: src
    deps: [test-perf]
    cmds:
      - go test -race -vet=off ./...
      - go mod verify

  test-perf:
    desc: Run the wall-clock budget test on a clean build (the race detector inflates it beyond usefulness)
    dir: src
    cmds:
      - go test -vet=off -count=1 -run TestProductListPerformance10k ./controllers/database/

  test-js:
    desc: Run frontend (vitest) tests
    deps: [test-fixtures]
    cmds:
      - npm run test-js

  test-fixtures:
    desc: Check the JS unit-table fixtures against the Go tables (uncached)
    dir: src
    cmds:
      - go test -count=1 -run TestFrontendUnit ./util/...

  i18n:
    desc: Validate message catalogs (load, key parity, referenced keys)
    dir: src
    cmds:
      - go test ./i18n/

  cover:
    desc: Get code coverage report
    dir: src
    cmds:
      - go test -coverprofile=coverage.out ./...
      - go tool cover -html=coverage.out
      - go mod verify

  check:
    desc: Run quality control checks (requires podman or docker)
    preconditions:
      - sh: '[ -n "{{.CONTAINER_RUNTIME}}" ]'
        msg: "No container runtime found. Please install podman or docker."
    dir: src
    cmds:
      - |
        {{.CONTAINER_RUNTIME}} run -t --rm \
        -v ./:/app:Z -v ../.golangci.yml:/tmp/.golangci.yml:Z \
        -v ../.cache/golangci-lint:/root/.cache/golangci-lint:Z \
        -v ../.cache/go:/root/go/pkg/mod:Z \
        -v ../.cache/go-build:/root/.cache/go-build:Z \
        -e GOLANGCI_LINT_CACHE=/root/.cache/golangci-lint \
        -e GOMODCACHE=/root/go/pkg/mod \
        -e GOCACHE=/root/.cache/go-build \
        -w /app golangci/golangci-lint:{{.GOLANGCI_VERSION}} \
        golangci-lint run \
        -v -c /tmp/.golangci.yml

  check-changed:
    desc: Run quality control checks on changed files only (requires podman or docker)
    preconditions:
      - sh: '[ -n "{{.CONTAINER_RUNTIME}}" ]'
        msg: "No container runtime found. Please install podman or docker."
    dir: src
    cmds:
      - |
        {{.CONTAINER_RUNTIME}} run -t --rm \
        -v ./:/app:Z -v ../.golangci.yml:/tmp/.golangci.yml:Z \
        -v ../.cache/golangci-lint:/root/.cache/golangci-lint:Z \
        -v ../.cache/go:/root/go/pkg/mod:Z \
        -v ../.cache/go-build:/root/.cache/go-build:Z \
        -e GOLANGCI_LINT_CACHE=/root/.cache/golangci-lint \
        -e GOMODCACHE=/root/go/pkg/mod \
        -e GOCACHE=/root/.cache/go-build \
        -w /app golangci/golangci-lint:{{.GOLANGCI_VERSION}} \
        golangci-lint run \
        -v -c /tmp/.golangci.yml --new-from-rev HEAD~1

  packagedoc:
    desc: Generate package documentation as markdown
    dir: src
    cmds:
      - go run github.com/princjef/gomarkdoc/cmd/gomarkdoc@latest --output ./docs/README.md ./...

  apidoc:
    desc: Generate API documentation (Swagger)
    dir: src
    cmds:
      - go run github.com/swaggo/swag/cmd/swag@latest init -g api/api.go --parseDependency --quiet -o ./docs/

  doc:
    desc: Generate all documentation
    deps: [packagedoc, apidoc]

  containerimage:
    desc: Build container image (requires podman or docker)
    preconditions:
      - sh: '[ -n "{{.CONTAINER_RUNTIME}}" ]'
        msg: "No container runtime found. Please install podman or docker."
    cmds:
      - '{{.CONTAINER_RUNTIME}} build --no-cache --tag=proviant ./'

  demo-containerimage:
    desc: Build demo container image (requires podman or docker)
    preconditions:
      - sh: '[ -n "{{.CONTAINER_RUNTIME}}" ]'
        msg: "No container runtime found. Please install podman or docker."
    cmds:
      - '{{.CONTAINER_RUNTIME}} build --no-cache --tag=proviant ./ -f ./Dockerfile.demo'

  run:
    desc: Start development server
    dir: src
    cmds:
      - go run proviant.go

  runcontainer:
    desc: Build and run container (requires podman or docker)
    deps: [containerimage]
    preconditions:
      - sh: '[ -n "{{.CONTAINER_RUNTIME}}" ]'
        msg: "No container runtime found. Please install podman or docker."
    cmds:
      - '{{.CONTAINER_RUNTIME}} run -t --rm -p 5114:5114 -v ./src/config.yaml.sqlite.tmpl:/app/config.yaml:Z -e PROVIANT_SERVER_AUTHENTICATION_TOKENPASSWORD=dev-only-local-secret proviant:latest'

  runcontainerdebug:
    desc: Build and run container with shell entrypoint (requires podman or docker)
    deps: [containerimage]
    preconditions:
      - sh: '[ -n "{{.CONTAINER_RUNTIME}}" ]'
        msg: "No container runtime found. Please install podman or docker."
    cmds:
      - '{{.CONTAINER_RUNTIME}} run -it --rm -v ./src/config.yaml.sqlite.tmpl:/app/config.yaml:Z -e PROVIANT_SERVER_AUTHENTICATION_TOKENPASSWORD=dev-only-local-secret --entrypoint /bin/sh proviant:latest'

  fonts:
    desc: Copy font files to assets
    cmds:
      - cp ./node_modules/bootstrap-icons/font/fonts/bootstrap-icons.woff* ./src/assets/fonts/
      - cp ./node_modules/@fontsource-variable/jost/files/jost-latin-wght-*.woff2 ./src/assets/fonts/
      - cp ./node_modules/@fontsource/dm-mono/files/dm-mono-latin-400-normal.woff2 ./src/assets/fonts/

  icons:
    desc: Copy icon files to assets
    cmds:
      - cp ./res/icons/proviant_logo_256.png ./src/assets/icons/
      - cp ./res/icons/proviant_logo_512.png ./src/assets/icons/
      - cp ./res/icons/proviant_logo.ico ./src/assets/icons/favicon.ico
      - cp ./res/icons/proviant_logo_256.png ./src/assets/icons/favicon.png
      - cp ./res/icons/header_transparent.png ./src/assets/icons/hero.png
      - magick ./res/icons/proviant_logo_256.png -resize 192x192 ./src/assets/icons/proviant_logo_192.png
      - cp ./res/icons/header*.png ./src/assets/icons/

  design-tokens:
    desc: Regenerate the design-system token artifacts from the canonical SCSS source
    cmds:
      - node scripts/design-tokens.mjs

  design-check:
    desc: Verify the design token contract, contrast targets and manifest counts
    cmds:
      - node scripts/check-design-tokens.mjs --phase {{.DESIGN_PHASE}}

  css:
    desc: Compile SCSS to CSS
    deps: [fonts]
    cmds:
      - npm run css

  js:
    desc: Copy JS vendor files to assets
    cmds:
      - cp ./node_modules/html5-qrcode/html5-qrcode.min.js ./src/assets/js/
      - cp ./node_modules/bootstrap/dist/js/bootstrap.bundle.min.js ./src/assets/js/
      - cp ./node_modules/bootstrap/dist/js/bootstrap.bundle.min.js.map ./src/assets/js/
      - cp ./node_modules/chart.js/dist/chart.umd.min.js ./src/assets/js/
      - cp ./node_modules/chart.js/dist/chart.umd.min.js.map ./src/assets/js/

  lint-css:
    desc: Lint SCSS files
    cmds:
      - npm run lint-css

  lint-js:
    desc: Lint JavaScript files
    cmds:
      - npm run lint-js

  lint-html:
    desc: Lint HTML templates
    cmds:
      - npm run lint-html

  lint-selectors:
    desc: Check that every class the JavaScript queries still exists
    cmds:
      - python3 scripts/check-js-class-selectors.py

  lint:
    desc: Run all frontend linters (CSS, JS, HTML)
    deps: [lint-css, lint-js, lint-html, lint-selectors]

  vuln-go:
    desc: Scan Go dependencies for vulnerabilities
    dir: src
    cmds:
      - go run golang.org/x/vuln/cmd/govulncheck@latest ./...

  vuln-npm:
    desc: Audit frontend dependencies for vulnerabilities
    cmds:
      - bash scripts/npm-audit.sh

  vuln-image:
    desc: Scan container image for vulnerabilities (requires podman or docker)
    deps: [containerimage]
    preconditions:
      - sh: '[ -n "{{.CONTAINER_RUNTIME}}" ]'
        msg: "No container runtime found. Please install podman or docker."
    cmds:
      - |
        WORK_DIR="$(mktemp -d)"
        trap 'rm -rf "$WORK_DIR"' EXIT
        # No --format: `docker save` has no such flag (podman-only), and
        # docker-archive is the default for both runtimes.
        {{.CONTAINER_RUNTIME}} save -o "$WORK_DIR/proviant-image.tar" proviant:latest
        CONTAINER_RUNTIME={{.CONTAINER_RUNTIME}} TRIVY_IMAGE={{.TRIVY_IMAGE}} bash scripts/image-scan.sh "$WORK_DIR/proviant-image.tar"

  vuln:
    desc: Scan Go and npm dependencies for vulnerabilities
    deps: [vuln-go, vuln-npm]

  sonar-issues:
    desc: "Export SonarQube issues to JSON for agent consumption (requires SONAR_TOKEN). Usage: task sonar-issues [-- --branch main]"
    preconditions:
      - sh: '[ -n "$SONAR_TOKEN" ]'
        msg: "SONAR_TOKEN env var is not set."
    cmds:
      - ./scripts/sonarqube-export.sh {{if .CLI_ARGS}}{{.CLI_ARGS}}{{end}}

  sonar-duplications:
    desc: "Export SonarQube code duplications to JSON for agent consumption (requires SONAR_TOKEN). Usage: task sonar-duplications [-- --branch main]"
    preconditions:
      - sh: '[ -n "$SONAR_TOKEN" ]'
        msg: "SONAR_TOKEN env var is not set."
    cmds:
      - ./scripts/sonarqube-export.sh --duplications {{if .CLI_ARGS}}{{.CLI_ARGS}}{{end}}

  seed-products:
    desc: "Fill the pack size of the demo products from Open Food Facts. Usage: task seed-products [-- --dry-run]"
    cmds:
      - python3 scripts/seed-products.py {{if .CLI_ARGS}}{{.CLI_ARGS}}{{end}}

  seed:
    desc: "Seed demo products from seed-products.csv into SQLite. Usage: task seed -- <username>"
    dir: src
    vars:
      DB: data/proviant.db
      SEED_CSV: ../seed-products.csv
    cmds:
      - |
        USERNAME="{{if .CLI_ARGS}}{{.CLI_ARGS}}{{else}}demo{{end}}"
        if [ ! -f "{{.DB}}" ]; then echo "DB not found at {{.DB}} — start the server once first."; exit 1; fi
        if [ ! -f "{{.SEED_CSV}}" ]; then echo "CSV not found at {{.SEED_CSV}}"; exit 1; fi
        python3 - "{{.DB}}" "$USERNAME" "{{.SEED_CSV}}" <<'PYEOF'
        import csv, sqlite3, sys, datetime
        db_path, username, csv_path = sys.argv[1], sys.argv[2], sys.argv[3]
        conn = sqlite3.connect(db_path)
        cur = conn.cursor()
        cur.execute("SELECT id, household_id FROM users WHERE username=? AND deleted_at IS NULL LIMIT 1", (username,))
        row = cur.fetchone()
        if not row or not row[1]:
            print(f"Error: user '{username}' not found or has no household.", file=sys.stderr)
            sys.exit(1)
        user_id, household_id = row[0], row[1]
        print(f"Seeding as user='{username}' (household_id={household_id})")
        # The CSV names a storage location; the column stores its id.
        cur.execute("SELECT id, name FROM storage_locations WHERE household_id=? AND deleted_at IS NULL", (household_id,))
        locations = {name.strip().lower(): loc_id for loc_id, name in cur.fetchall()}
        now = datetime.datetime.utcnow()
        inserted = 0
        with open(csv_path, newline='') as f:
            for p in csv.DictReader(f, delimiter=';'):
                expire_days = p.get('expire_days', '').strip()
                if expire_days:
                    expire_at = (now + datetime.timedelta(days=int(expire_days))).isoformat()
                else:
                    expire_at = '0001-01-01T00:00:00'
                scanned_days = int(p.get('scanned_days', '0').strip() or '0')
                scanned_at = (now + datetime.timedelta(days=scanned_days)).isoformat()
                archived = p.get('archived', '').strip().lower() == 'true'
                deleted_at = now.isoformat() if archived else None
                location_name = (p.get('storage_location') or '').strip()
                location_id = locations.get(location_name.lower())
                cur.execute(
                    "INSERT INTO products (created_at, updated_at, deleted_at, barcode, product_name, categories, countries, image_url, expire_at, scanned_at, notified_at, household_id, user_id, quantity, pack_size, storage_location_id) VALUES (?,?,?,?,?,?,?,?,?,?,NULL,?,?,?,?,?)",
                    (now.isoformat(), now.isoformat(), deleted_at,
                     p['barcode'], p['product_name'], p['categories'], p['countries'], p['image_url'],
                     expire_at, scanned_at, household_id, user_id, int(p.get('quantity') or 1), p.get('pack_size', ''), location_id)
                )
                label = ' (archived)' if archived else ''
                print(f"  + {p['product_name']}{label}")
                inserted += 1
        conn.commit()
        active = cur.execute("SELECT COUNT(*) FROM products WHERE household_id=? AND deleted_at IS NULL", (household_id,)).fetchone()[0]
        archived_count = cur.execute("SELECT COUNT(*) FROM products WHERE household_id=? AND deleted_at IS NOT NULL", (household_id,)).fetchone()[0]
        print(f"\nDone. {inserted} inserted. Household totals: {active} active, {archived_count} archived.")
        PYEOF

  uicapture:
    desc: "Capture UI screenshots/video. Usage: task uicapture -- --preset dashboard [--no-video] [--gif] [--mp4]"
    cmds:
      - bash scripts/uicapture.sh {{.CLI_ARGS}}

  uicapture-publish:
    desc: Regenerate screenshots/ and the README gallery (requires podman or docker)
    preconditions:
      - sh: '[ -n "{{.CONTAINER_RUNTIME}}" ]'
        msg: "No container runtime found. Please install podman or docker."
    cmds:
      - bash scripts/uicapture.sh --publish

  uicapture-all:
    desc: "Capture every page as stills + video. Usage: task uicapture-all -- [--viewport mobile] [--gif]"
    cmds:
      - bash scripts/uicapture.sh --preset all {{.CLI_ARGS}}

  seed-reset:
    desc: "Remove all products for a user's household. Usage: task seed-reset -- <username>"
    dir: src
    vars:
      DB: data/proviant.db
    cmds:
      - |
        USERNAME="{{if .CLI_ARGS}}{{.CLI_ARGS}}{{else}}demo{{end}}"
        python3 - "{{.DB}}" "$USERNAME" <<'PYEOF'
        import sqlite3, sys
        db_path, username = sys.argv[1], sys.argv[2]
        conn = sqlite3.connect(db_path)
        cur = conn.cursor()
        cur.execute("SELECT household_id FROM users WHERE username=? AND deleted_at IS NULL LIMIT 1", (username,))
        row = cur.fetchone()
        if not row or not row[0]:
            print(f"Error: user '{username}' not found.", file=sys.stderr)
            sys.exit(1)
        household_id = row[0]
        cur.execute("DELETE FROM products WHERE household_id=?", (household_id,))
        conn.commit()
        print(f"Removed {cur.rowcount} products for household_id={household_id}.")
        PYEOF