Taskfile.yml

version: '3'

# The VS Code extension spin-stack.spinbox-remote: TypeScript in src/, bundled by esbuild into
# lib/, packaged into a VSIX by hack/vsix. Every install goes through Socket Firewall (sfw), and every workflow
# step is one of these tasks (taskgate), so a developer runs what CI runs.

vars:
  # The release a publish is for: the tag a workflow runs on, or TAG=v1.2.3 on the command line.
  TAG: '{{.GITHUB_REF_NAME}}'
  # Where publish:github lays out the release's files.
  RELEASE: build/release

tasks:
  install:
    desc: Install the dependencies from the lockfile, through Socket Firewall (sfw).
    cmds:
      - sfw pnpm install --frozen-lockfile

  build:
    desc: Bundle the extension into lib/extension.js.
    cmds:
      - pnpm build

  lint:
    desc: Lint with Biome.
    cmds:
      - pnpm lint

  typecheck:
    desc: Typecheck src/ and test/ with tsc.
    cmds:
      - pnpm typecheck

  test:
    desc: The unit tests - Vitest, with vscode replaced by test/mocks/vscode.ts, and coverage held to the floor in vitest.config.ts - and hack/'s Go.
    cmds:
      - pnpm test
      - go test ./hack/...

  coverage:summary:
    desc: The coverage task test left in coverage/, as the job's summary (hack/coverage-summary.mjs); the HTML is coverage/index.html.
    cmds:
      - node hack/coverage-summary.mjs

  test:e2e:
    desc: >-
      The Spinbox resolver against spin's e2e stack and the real spin CLI (test/e2e/). Bring the
      stack up in a spin checkout first - task build:cli, task e2e:up and task e2e:workspaces,
      which need KVM and sudo -n - then SPIN=<that checkout>. VSCODE_COMMIT is a VS Code commit
      the stack publishes a server for: e2e:up publishes the newest two releases, as its log says.
    requires:
      vars: [SPIN, VSCODE_COMMIT]
    env:
      SPIN_E2E_CLI: '{{.SPIN}}/bin/spin'
      SPIN_E2E_HOME: '{{.SPIN}}/_output/run/e2e/people/user'
      SPIN_E2E_COMMIT: '{{.VSCODE_COMMIT}}'
    cmds:
      - pnpm test:e2e

  package:
    desc: Package the extension into spinbox-remote.vsix with hack/vsix, the same bytes for the same files.
    cmds:
      - task: build
      # Everything the package holds: the rest of the checkout is how it is built and tested.
      - go run ./hack/vsix -out spinbox-remote.vsix package.json LICENSE.txt README.md lib/extension.js resources/icon.png

  # The Marketplace refuses an extension that uses a proposed API (resolvers), so a release is
  # the GitHub release, which `spin vscode install` downloads and holds to the digest spin's
  # versions.yaml pins.
  publish:check:
    desc: Fail before anything is built when the tag is not v and package.json's version - a VSIX carries the version it was packaged with, never the tag's.
    env:
      TAG: '{{.TAG}}'
    silent: true
    cmds:
      - cmd: |
          if [ "${TAG}" != "v$(node -p 'require("./package.json").version')" ]; then
            echo "publish: the tag '${TAG}' is not v and package.json's version" >&2
            exit 1
          fi

  publish:github:
    desc: >-
      The tag's GitHub release, with spinbox-remote-<version>.vsix, SHA256SUMS of it and
      SHA256SUMS.sigstore.json - cosign's keyless signature of SHA256SUMS as the Publish workflow
      at the tag, verified before anything is uploaded. A release the tag already has gets these
      files again, over the ones it had: a run is run again whole. Needs GH_TOKEN and the job's
      OIDC token.
    vars:
      COSIGN:
        sh: echo "go run github.com/sigstore/cosign/v3/cmd/cosign@$(versions version cosign)"
      VERSION:
        sh: node -p 'require("./package.json").version'
      # Who signs: this workflow at the tag.
      IDENTITY: '{{.GITHUB_SERVER_URL}}/{{.GITHUB_REPOSITORY}}/.github/workflows/publish.yml@{{.GITHUB_REF}}'
    cmds:
      - task: package
      - rm -rf {{.RELEASE}} && mkdir -p {{.RELEASE}}
      - cp spinbox-remote.vsix {{.RELEASE}}/spinbox-remote-{{.VERSION}}.vsix
      - cd {{.RELEASE}} && sha256sum spinbox-remote-{{.VERSION}}.vsix > SHA256SUMS
      - '{{.COSIGN}} sign-blob --yes --bundle {{.RELEASE}}/SHA256SUMS.sigstore.json {{.RELEASE}}/SHA256SUMS'
      # A signature nothing verifies is a step that can quietly stop working: one that does not
      # check fails here, before anything is published.
      - '{{.COSIGN}} verify-blob --bundle {{.RELEASE}}/SHA256SUMS.sigstore.json --certificate-identity {{.IDENTITY}} --certificate-oidc-issuer https://token.actions.githubusercontent.com {{.RELEASE}}/SHA256SUMS'
      # Created with its files at once, so no release is ever listed without them.
      - gh release view {{.TAG}} >/dev/null 2>&1 || gh release create {{.TAG}} --verify-tag --title {{.TAG}} --generate-notes {{.RELEASE}}/*
      - gh release upload {{.TAG}} --clobber {{.RELEASE}}/*

  gate:
    desc: What holds the repository's shape - every install through the firewall, every workflow step a task, and no commit since origin/main by a test's identity.
    cmds:
      - sfw check
      # The Task running this one, which taskgate asks for the task names.
      - taskgate -task {{.TASK_EXE}}
      # A test that writes git's author into the checkout makes every commit after it the
      # test's; this refuses those commits before they reach main.
      - testidentity -base origin/main

  ci:
    desc: What CI's Gate job runs - the gate, the install, lint, typecheck, the unit tests, and the package.
    cmds:
      - task: gate
      - task: install
      - task: lint
      - task: typecheck
      - task: test
      - task: package