Taskfile.yml

version: '3'

vars:
  APP_NAME: "renbrowser"
  BIN_DIR: "bin"
  PACKAGE_MANAGER: '{{.PACKAGE_MANAGER | default "pnpm"}}'
  VITE_PORT: '{{.WAILS_VITE_PORT | default 9245}}'
  GOOS: '{{.GOOS | default OS}}'
  RETICULUM_GO: '{{.RETICULUM_GO | default "../Reticulum/Reticulum-Go"}}'
  TRIVY_SKIP_DIR_FLAGS: --skip-dirs vendor --skip-dirs frontend/node_modules --skip-dirs bin --skip-dirs .cache --skip-dirs third_party --skip-dirs build/android/.gradle --skip-dirs build/android/build
  GIT_COMMIT:
    sh: git rev-parse --short HEAD 2>/dev/null || echo dev
  BUILD_TIME:
    sh: date -u +'%Y-%m-%dT%H:%M:%SZ'

includes:
  common: ./build/Taskfile.yml
  windows: ./build/windows/Taskfile.yml
  darwin: ./build/darwin/Taskfile.yml
  linux: ./build/linux/Taskfile.yml
  ios: ./build/ios/Taskfile.yml
  android: ./build/android/Taskfile.yml
  trivy:
    taskfile: ./build/taskfiles/trivy.yml
    flatten: true

tasks:
  default:
    cmds:
      - task: check

  check:
    desc: Run Go and frontend quality gates
    deps:
      - fmt:go
      - test:go
      - gosec
      - task: common:check:brand
      - frontend:check

  fmt:go:
    desc: Format Go sources
    cmds:
      - bash build/scripts/gofmt-project.sh write
    env:
      GOFLAGS: "-mod=vendor"

  vendor:go:
    desc: Refresh vendor/ from go.mod (fetches reticulum-go, patches, vendors all deps)
    cmds:
      - bash build/scripts/vendor-go.sh
    env:
      GOFLAGS: "-mod=mod"

  format:
    desc: Format Go and frontend sources
    deps:
      - fmt:go
      - frontend:fmt

  gosec:
    desc: Run gosec security scanner
    cmds:
      - bash "{{.ROOT_DIR}}/build/scripts/gosec.sh" ./...

  check:reproducible:
    desc: Verify headless server binary builds are bitwise reproducible
    cmds:
      - bash build/scripts/check-reproducible-binary.sh
    env:
      GOFLAGS: "-mod=vendor"

  test:
    desc: Run all tests
    deps:
      - test:go
      - frontend:test

  test:go:
    desc: Run Go unit tests
    cmds:
      - go test ./...
    env:
      GOFLAGS: "-mod=vendor"

  test:go:race:
    desc: Run Go tests with race detector
    cmds:
      - go test -race ./...
    env:
      GOFLAGS: "-mod=vendor"

  test:contract:
    desc: Verify Wails bindings match Go service methods
    cmds:
      - bash build/scripts/ci-prep-go.sh
      - go test ./internal/contract/...
    env:
      GOFLAGS: "-mod=vendor"

  test:go:stress:
    desc: Concurrent stress tests with race detector (deadlock/race checks)
    cmds:
      - go test -race -tags=stress -timeout=5m ./internal/store/... ./internal/db/... ./internal/cache/...
    env:
      GOFLAGS: "-mod=vendor"

  test:regression:
    desc: Reliability and optimization regression suite
    cmds:
      - go test ./internal/regression/... ./internal/cache/... ./internal/nomadnet/... ./internal/micron/... ./internal/store/... ./internal/app/... ./internal/servermw/... ./internal/limits/... ./internal/apperrors/... ./internal/db/... ./internal/plugins/... ./internal/content/... ./internal/safe/...
      - go test -race -tags=stress -timeout=5m ./internal/cache/...
      - pnpm --dir frontend exec vitest run src/lib/micron/render-page.test.ts src/lib/micron/ascii-render.test.ts src/lib/components/content-viewer-micron.test.ts src/lib/app/create-app.test.ts
    env:
      GOFLAGS: "-mod=vendor"

  test:plugins:
    desc: Run plugin system unit tests
    cmds:
      - go test ./internal/plugins/...
      - pnpm --dir frontend exec vitest run src/lib/plugins
    env:
      GOFLAGS: "-mod=vendor"

  test:go:leak:
    desc: Goroutine leak checks via goleak
    cmds:
      - go test -tags=leak ./internal/store/... ./internal/db/...
    env:
      GOFLAGS: "-mod=vendor"

  fuzz:go:
    desc: Run Go fuzz tests
    cmds:
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzParseURL$' -fuzztime=30s -timeout=2m ./internal/nomadnet/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzParseURLFields$' -fuzztime=30s -timeout=2m ./internal/nomadnet/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzCheckResponseSize$' -fuzztime=30s -timeout=2m ./internal/nomadnet/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzResolveNavigation$' -fuzztime=30s -timeout=2m ./internal/micron/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzSanitizeHTML$' -fuzztime=30s -timeout=2m ./internal/content/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzVerifyPassword$' -fuzztime=30s -timeout=2m ./internal/auth/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzHashPassword$' -fuzztime=30s -timeout=2m ./internal/auth/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzNewSessionToken$' -fuzztime=30s -timeout=2m ./internal/auth/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzNormalizeIP$' -fuzztime=30s -timeout=2m ./internal/auth/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzClientHash$' -fuzztime=30s -timeout=2m ./internal/auth/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzClientIP$' -fuzztime=30s -timeout=2m ./internal/auth/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzParseWhitelist$' -fuzztime=30s -timeout=2m ./internal/auth/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzWhitelistAllows$' -fuzztime=30s -timeout=2m ./internal/auth/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzUnwrap$' -fuzztime=30s -timeout=2m ./internal/deeplink/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzHandleIncoming$' -fuzztime=30s -timeout=2m ./internal/deeplink/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzValidateIdentityID$' -fuzztime=30s -timeout=2m ./internal/rns/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzValidateIdentityName$' -fuzztime=30s -timeout=2m ./internal/rns/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzParseIdentityRegistryJSON$' -fuzztime=30s -timeout=2m ./internal/rns/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzValidateIdentityKeyData$' -fuzztime=30s -timeout=2m ./internal/rns/...
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzValidateRSG$' -fuzztime=30s -timeout=2m ./internal/plugins
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzAssessManifestJSON$' -fuzztime=30s -timeout=2m ./internal/plugins
      - bash build/scripts/fuzz-run.sh -fuzz='^FuzzExtractURLsFromText$' -fuzztime=30s -timeout=2m ./internal/plugins
      - bash build/scripts/fuzz-run.sh -tags server -fuzz='^FuzzGuardLogin$' -fuzztime=30s -timeout=2m ./internal/serverauth
      - bash build/scripts/fuzz-run.sh -tags server -fuzz='^FuzzGuardRoute$' -fuzztime=30s -timeout=2m ./internal/serverauth
    env:
      GOFLAGS: "-mod=vendor"

  test:go:hard:
    desc: Race, leak, stress, and fuzz checks
    deps:
      - test:go:race
      - test:go:leak
      - test:go:stress
      - test:regression
      - fuzz:go

  bench:go:
    desc: Run Go benchmarks (smoke run for CI artifacts)
    cmds:
      - mkdir -p bench
      - bash -c 'set -euo pipefail; go test -run="^$" -bench=. -benchmem -count=5 ./internal/cache/... ./internal/content/... ./internal/nomadnet/... | tee bench/go.txt'
    env:
      GOFLAGS: "-mod=vendor"

  bench:compare:
    desc: Compare bench/go.txt against a baseline (BENCH_BASELINE path)
    cmds:
      - bash build/scripts/bench-compare.sh "{{.BENCH_BASELINE}}" "{{.BENCH_CURRENT | default "bench/go.txt"}}"

  coverage:go:
    desc: Generate Go coverage report under coverage/
    cmds:
      - bash build/scripts/coverage-go.sh
    env:
      GOFLAGS: "-mod=vendor"

  coverage:frontend:
    desc: Generate Vitest coverage report under coverage/frontend
    deps:
      - common:install:frontend:deps
    cmds:
      - pnpm --dir frontend run test:coverage

  test:e2e:
    desc: Playwright E2E against renbrowser-server
    deps:
      - common:install:frontend:deps
    cmds:
      - task: common:build:server
      - pnpm --dir frontend exec playwright install --with-deps chromium
      - pnpm --dir frontend run test:e2e
    env:
      GOFLAGS: "-mod=vendor"

  test:visual:
    desc: Playwright visual regression against renbrowser-server
    deps:
      - common:install:frontend:deps
    cmds:
      - task: common:build:server
      - pnpm --dir frontend exec playwright install --with-deps chromium
      - pnpm --dir frontend run test:visual
    env:
      GOFLAGS: "-mod=vendor"

  test:server:smoke:
    desc: Start renbrowser-server and verify HTTP responds
    cmds:
      - task: common:build:server
      - bash build/scripts/server-smoke.sh
    env:
      GOFLAGS: "-mod=vendor"

  test:interop:
    desc: Live Reticulum interop tests (requires network)
    cmds:
      - go test -tags=interop -timeout=15m ./internal/interop/...
    env:
      GOFLAGS: "-mod=vendor"

  frontend:check:
    desc: Typecheck, lint, format check, knip, and unit tests
    deps:
      - common:install:frontend:deps
    cmds:
      - task: common:frontend:run
        vars: { SCRIPT: check }
      - task: common:frontend:run
        vars: { SCRIPT: lint }
      - task: common:frontend:run
        vars: { SCRIPT: format:check }
      - task: common:frontend:run
        vars: { SCRIPT: knip }
      - task: common:frontend:run
        vars: { SCRIPT: audit }
      - task: common:frontend:run
        vars: { SCRIPT: test }

  frontend:test:
    deps:
      - common:install:frontend:deps
    cmds:
      - task: common:frontend:run
        vars: { SCRIPT: test }

  frontend:fmt:
    desc: Format frontend sources with Prettier
    deps:
      - common:install:frontend:deps
    cmds:
      - task: common:frontend:run
        vars: { SCRIPT: format }

  mod:tidy:
    desc: Refresh go.mod, go.sum, and vendor/
    cmds:
      - go mod tidy -e
      - task: vendor:go
    env:
      GOFLAGS: "-mod=mod"

  build:
    summary: Builds the application
    timeout: 20m
    cmds:
      - task: "{{.GOOS}}:build"

  package:
    summary: Packages a production build of the application
    cmds:
      - task: "{{.GOOS}}:package"

  package:windows:
    desc: Package Ren Browser for Windows (NSIS installer)
    cmds:
      - task: windows:package

  package:darwin:
    desc: Package Ren Browser for macOS (.app bundle)
    cmds:
      - task: darwin:package

  package:darwin:universal:
    desc: Package universal macOS binary
    cmds:
      - task: darwin:package:universal

  package:linux:appimage:
    desc: Build a fuse3-compatible AppImage
    cmds:
      - task: linux:create:appimage

  package:linux:flatpak:install:
    desc: Build and install the Flatpak locally
    cmds:
      - task: linux:flatpak:install

  package:linux:flatpak:bundle:
    desc: Build a single-file Flatpak bundle
    cmds:
      - task: linux:flatpak:bundle

  build:windows:
    desc: Cross-compile for Windows
    cmds:
      - task: windows:build

  build:darwin:
    desc: Build for macOS
    cmds:
      - task: darwin:build

  toolchain:mte:
    desc: Build or refresh the patched mobile Go toolchain (iOS MTE parity)
    cmds:
      - bash build/scripts/ensure-go-mte.sh

  build:android:
    desc: Build debug universal APK for Android (arm64-v8a + armeabi-v7a)
    cmds:
      - task: android:build
        vars:
          ARCH: arm64
          KEEP_OTHER_ABIS: "true"
      - task: android:compile:go:shared
        vars:
          ARCH: arm
          KEEP_OTHER_ABIS: "true"
      - task: android:assemble:apk

  build:android:emu:
    desc: Build debug APK for the Android emulator (host ABI)
    cmds:
      - task: android:build
      - task: android:assemble:apk

  package:android:
    desc: Package production universal APK for Android (arm64-v8a + armeabi-v7a)
    cmds:
      - task: android:package:universal

  package:linux:arch:
    desc: Build an Arch Linux package (.pkg.tar.zst)
    cmds:
      - task: linux:create:aur

  run:android:
    desc: Build, install, and launch on Android emulator
    cmds:
      - task: android:run

  run:
    summary: Runs the application
    cmds:
      - task: "{{.GOOS}}:run"
        vars: { CLI_ARGS: '{{.CLI_ARGS}}' }

  dev:
    summary: Runs the application in development mode
    cmds:
      - wails3 dev -config ./build/config.yml -port {{.VITE_PORT}}

  screenshots:
    desc: Capture README preview screenshots into screenshots/desktop and screenshots/mobile
    deps:
      - common:install:frontend:deps
    cmds:
      - task: common:build:server
      - pnpm --dir frontend exec playwright install chromium
      - pnpm --dir frontend run screenshots
    env:
      GOFLAGS: "-mod=vendor"

  run:assets-dir:
    desc: Run using frontend assets from a directory
    cmds:
      - go run . --assets-dir {{.ASSETS_DIR | default "frontend/dist"}}
    env:
      GOFLAGS: "-mod=vendor"

  run:assets-zip:
    desc: Run using frontend assets from a zip archive
    cmds:
      - go run . --assets-zip {{.ASSETS_ZIP}}
    env:
      GOFLAGS: "-mod=vendor"

  setup:docker:
    summary: Builds Docker image for cross-compilation (~800MB download)
    cmds:
      - task: common:setup:docker

  build:server:
    summary: Builds the application in server mode (no GUI, HTTP server only)
    cmds:
      - task: common:build:server

  build:server:windows-legacy:
    desc: Build headless server .exe for Windows 7/8/8.1 (go-legacy-win7)
    cmds:
      - task: common:build:server:windows-legacy

  run:server:
    summary: Runs the application in server mode
    cmds:
      - task: common:run:server

  build:docker:
    summary: Builds a Docker image for server mode deployment
    cmds:
      - task: common:build:docker

  run:docker:
    summary: Builds and runs the Docker image
    cmds:
      - task: common:run:docker


  tree-manifest:
    desc: Print SHA-256 inventory of git-tracked files (excludes renbrowser.rsm and vendor/)
    cmds:
      - sh build/scripts/tree-manifest.sh generate

  tree-rsm-sign:
    desc: Sign tree inventory into renbrowser.rsm (requires RNS_ID_PATH)
    cmds:
      - sh build/scripts/sign-tree-rsm.sh

  tree-rsm-verify:
    desc: Verify renbrowser.rsm signature and byte-level file hashes
    cmds:
      - sh build/scripts/verify-tree-rsm.sh

  hooks:install:
    desc: Enable tracked .githooks (pre-commit resigns renbrowser.rsm)
    cmds:
      - sh build/scripts/install-git-hooks.sh

  tree-workspace-clean:
    desc: Recheck inventory and fail on unexpected workspace changes
    cmds:
      - sh build/scripts/verify-workspace-clean.sh "${RNS_INVENTORY_OUT:-/tmp/renbrowser-tree-inventory.txt}"

  release:rngit:
    desc: Build Linux/Windows/server/APK binaries and publish an rngit release
    cmds:
      - bash build/scripts/rngit-release.sh {{if .SKIP_BUILD}}--skip-build{{end}}
    env:
      GOFLAGS: "-mod=vendor"

  release:rngit:local:
    desc: Build release binaries and create a local rngit manifest without uploading
    cmds:
      - bash build/scripts/rngit-release.sh --local {{if .SKIP_BUILD}}--skip-build{{end}}
    env:
      GOFLAGS: "-mod=vendor"

  # ...