search-agent/Taskfile.yml at develop · AarhusAI/search-agent · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
version: "3"

dotenv: [".env.docker.local", ".env.local", ".env"]

vars:
  DOCKER_COMPOSE: '{{.TASK_DOCKER_COMPOSE | default "docker compose"}}'
  SERVICE: agent
  #PYTHON: "{{.DOCKER_COMPOSE}} exec {{.SERVICE}}"
  PYTHON: "docker exec -e HOME=/tmp -i openwebui-search-agent-1 uv run --no-sync"

tasks:
  default:
    desc: "List available tasks"
    cmds:
      - task --list-all
    silent: true

  # ---------------------------------------------------------------------------
  # Docker Compose
  # ---------------------------------------------------------------------------

  compose:
    cmds:
      - "{{.DOCKER_COMPOSE}} {{.CLI_ARGS}}"

  up:
    desc: "Start all services"
    cmds:
      - "{{.DOCKER_COMPOSE}} up --detach --remove-orphans"
    silent: true

  # ---------------------------------------------------------------------------
  # Build
  # ---------------------------------------------------------------------------

  build:image:
    desc: "Build and push production image to ghcr.io (multi-arch). Override PLATFORMS to build one arch (e.g. PLATFORMS=linux/amd64) for faster local builds."
    vars:
      IMAGE: ghcr.io/aarhusai/search-agent
      TAG: '{{.TAG | default "latest"}}'
      PLATFORMS: '{{.PLATFORMS | default "linux/amd64,linux/arm64"}}'
    cmds:
      - task: build:image:builder
      - docker buildx build --builder search-agent-builder --platform {{.PLATFORMS}} --target prod -t {{.IMAGE}}:{{.TAG}} --push .

  build:image:builder:
    desc: "Ensure the buildx builder + QEMU binfmt handlers for multi-arch builds exist (idempotent first-run setup)."
    internal: true
    silent: true
    cmds:
      - cmd: |
          if ! docker buildx inspect search-agent-builder >/dev/null 2>&1; then
            echo "First-run setup: registering QEMU binfmt handlers (cross-arch emulation)..."
            docker run --privileged --rm tonistiigi/binfmt --install all
            echo "Creating buildx builder 'search-agent-builder' (docker-container driver)..."
            docker buildx create --name search-agent-builder --driver docker-container --bootstrap
          fi

  # ---------------------------------------------------------------------------
  # Dependencies
  # ---------------------------------------------------------------------------

  uv:lock:
    desc: "Regenerate uv.lock (pass -- --upgrade to bump versions, or -- --upgrade-package <name>)"
    cmds:
      - >-
        docker run --rm
        -u "$(id -u):$(id -g)"
        -e HOME=/tmp
        -v "$PWD":/work -w /work
        ghcr.io/astral-sh/uv:python3.12-bookworm-slim
        uv lock {{.CLI_ARGS}}

  # ---------------------------------------------------------------------------
  # Test / Lint / Format
  # ---------------------------------------------------------------------------

  test:
    desc: "Run tests"
    cmds:
      - "{{.PYTHON}} pytest {{.CLI_ARGS}}"

  lint:
    desc: "Check coding standards"
    cmds:
      - task: lint:check
      - task: lint:format:check
    silent: true

  lint:check:
    desc: "Lint code"
    cmds:
      - "{{.PYTHON}} ruff check src/"

  lint:fix:
    desc: "Fix lint issues"
    cmds:
      - "{{.PYTHON}} ruff check --fix src/"

  lint:format:
    desc: "Format code"
    cmds:
      - "{{.PYTHON}} ruff format src/"

  lint:format:check:
    desc: "Check code formatting"
    cmds:
      - "{{.PYTHON}} ruff format --check src/"

  coding-standards:apply:
    desc: "Apply coding standards"
    cmds:
      - task: lint:fix
      - task: lint:format
    silent: true

  # ---------------------------------------------------------------------------
  # Security audit
  # ---------------------------------------------------------------------------

  audit:
    desc: "Run all security audit tools (advisory, doesn't fail CI by default)"
    cmds:
      - task: audit:deps
      - task: audit:code

  audit:deps:
    desc: "Scan installed dependencies for known CVEs (pip-audit)"
    cmds:
      - "{{.PYTHON}} pip-audit --strict ."

  audit:code:
    desc: "Static security scan of src/ (bandit)"
    cmds:
      - "{{.PYTHON}} bandit -r src/ -ll"