Taskfile.yml

---
version: '3'

vars:
  START_URL: https://app.install.doctor/start
  CONTROL_PLANE_URL: '{{default "https://app.install.doctor" .CONTROL_PLANE_URL}}'

tasks:
  default:
    desc: Run the full install.doctor verification suite
    cmds:
      - task: test

  test:
    desc: Run every production package and repository verification suite
    cmds:
      - bash scripts/test-all.sh
      - cd packages/aid-core && npm test
      - cd packages/installer-engine && npm test
      - cd packages/desktop-tools-runtime && npm test
      - npm run test:desktop-tools-status
      - cd packages/control-plane && npm test

  test:scripts:
    desc: Run all shell & provisioning verification suites (scripts/test-all.sh)
    cmds:
      - bash scripts/test-all.sh

  test:aid-core:
    desc: Run unit tests for packages/aid-core
    cmds:
      - cd packages/aid-core && npm test

  test:control-plane:
    desc: Type-check and run unit tests for packages/control-plane
    cmds:
      - cd packages/control-plane && npm test

  test:installer-engine:
    desc: Build, bundle, and test the Desktop Tools installer mutation authority
    cmds:
      - cd packages/installer-engine && npm test

  test:desktop-tools-runtime:
    desc: Build and test the pinned Desktop Tools runtime supervisor
    cmds:
      - cd packages/desktop-tools-runtime && npm test

  validate:software:
    desc: Validate software.yml schema and installer keys
    cmds:
      - bash scripts/validate-software-yml.sh

  audit:deprecated:
    desc: Audit repository for deprecated tools and removed references
    cmds:
      - bash scripts/audit-deprecated.sh

  drift:check:
    desc: Check observed host state against desired Chezmoi state
    cmds:
      - bash scripts/drift-check.sh

  desktop-tools:production-readiness:
    desc: Audit signer, release authority, DNS, and canonical profile transport without reading secrets
    cmds:
      - node scripts/audit-desktop-tools-production-readiness.mjs

  sbom:
    desc: Generate CycloneDX Software Bill of Materials (SBOM)
    cmds:
      - bash scripts/generate-sbom.sh

  firewall:cloudflare:
    desc: Apply Cloudflare-Only Zero-Trust Firewall policy (ports 22, 80, 443 restricted to Cloudflare CIDRs)
    cmds:
      - bash home/dot_local/bin/executable_cloudflare-firewall

  firewall:cidrs:
    desc: Print active Cloudflare IPv4 and IPv6 edge CIDR blocks
    cmds:
      - curl -fsSL https://www.cloudflare.com/ips-v4 && echo "" && curl -fsSL https://www.cloudflare.com/ips-v6

  autologin:enable:
    desc: Configure unlocked desktop autologin using Infisical secret (DESKTOP_AUTOLOGIN_PASSWORD / SUDO_PASSWORD)
    cmds:
      - bash home/dot_local/bin/executable_desktop-autologin

  autologin:disable:
    desc: Disable desktop autologin and remove /etc/kcpassword
    cmds:
      - bash home/dot_local/bin/executable_desktop-autologin --disable

  provision:
    desc: Fetch and execute the canonical signed Install Doctor bootstrap
    cmds:
      - curl --proto '=https' --tlsv1.2 -fsSL {{.START_URL}} | bash

  provision:remote:
    desc: Compatibility alias for the canonical signed bootstrap
    cmds:
      - task: provision

  ssh:deploy:
    desc: Push and apply install.doctor desired state to a remote fleet host (HOST=zen|omen|legion|ubuntu)
    cmds:
      - ssh -o BatchMode=yes {{.HOST}} 'cd ~/.local/share/chezmoi && git pull --ff-only && ~/.local/bin/chezmoi apply'

  verify:parity:
    desc: Run fleet disaster-recovery and host posture verification across reachable fleet computers
    cmds:
      - |
        for h in zen omen legion ubuntu; do
          printf "=== %s ===\n" "$h"
          ssh -o BatchMode=yes -o ConnectTimeout=5 "$h" '/usr/local/bin/fleet-dr-verify || true' 2>/dev/null || printf "unreachable: %s\n" "$h"
        done

  fleet:status:
    desc: Query desktop-tools and systemd posture across local and remote fleet hosts
    cmds:
      - bash home/dot_local/bin/executable_desktop-tools doctor || true