Taskfile.yml

# yaml-language-server: $schema=https://taskfile.dev/schema.json
version: "3"

output: prefixed
silent: true
run: once

vars:
  DOTFILES: "{{.ROOT_DIR}}"
  # Icons
  OK: '\033[32m󰄬\033[0m'
  WARN: '\033[33m\033[0m'
  FAIL: '\033[31m󰅖\033[0m'
  LINK: '\033[32m󰌷\033[0m'
  WORK: '\033[35m󱁤\033[0m'
  BOLD: '\033[1m'
  RESET: '\033[0m'

env:
  CLICOLOR_FORCE: "1"
  FORCE_COLOR: "1"

tasks:
  # ===========================================================================
  # System update pipeline
  #
  # DAG:
  #   link:*, auth:*, claude, tmux:*            — parallel
  #   brew:bundle:update → brew → brew:upgrade → brew  — chained
  #   [brew, mise] → zsh-completions    — last
  # ===========================================================================

  # ---------------------------------------------------------------------------
  # Bootstrap tasks (fresh system)
  # ---------------------------------------------------------------------------

  xcode:install:
    desc: Install Xcode Command Line Tools
    platforms: [darwin]
    status: ["command -v git"]
    cmds:
      - xcode-select --install
      - |
        printf "{{.WARN}} waiting for Xcode CLI tools installer...\n"
        while ! command -v git >/dev/null 2>&1; do sleep 0.5; done
        printf "{{.OK}} xcode cli tools\n"

  dotfiles:clone:
    desc: Clone dotfiles repo
    deps: [xcode:install]
    status: ["test -d {{.DOTFILES}}"]
    cmds:
      - git clone https://github.com/radiosilence/dotfiles {{.DOTFILES}}
      - printf "{{.OK}} dotfiles cloned\n"

  brew:install:
    desc: Install Homebrew
    platforms: [darwin]
    status: ["command -v brew"]
    cmds:
      - /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
      - |
        if [ -d /opt/homebrew ]; then
          eval "$(/opt/homebrew/bin/brew shellenv)"
        else
          eval "$(/usr/local/bin/brew shellenv)"
        fi
      - printf "{{.OK}} homebrew\n"

  brew:roles:
    desc: Copy Brewfile roles template
    deps: [dotfiles:clone]
    status: ["test -f {{.DOTFILES}}/dotfiles-roles.yml"]
    cmds:
      - cp {{.DOTFILES}}/dotfiles-roles.yml.template {{.DOTFILES}}/dotfiles-roles.yml
      - printf "{{.WARN}} copied dotfiles-roles.yml — edit to enable brew roles\n"

  1password:setup:
    desc: Set up 1Password SSH agent
    platforms: [darwin]
    deps: [brew:bundle]
    status:
      - "test -S ~/Library/Group\\ Containers/2BUA8C4S2C.com.1password/t/agent.sock"

    cmds:
      - printf "{{.WARN}} open 1Password, sign in, and enable the SSH agent (Settings → Developer → SSH Agent)\n"
      - |
        sock="$HOME/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock"
        while [ ! -S "$sock" ]; do sleep 0.5; done
        printf "{{.OK}} 1password ssh agent\n"

  1password:ssh-config:
    desc: Add 1Password SSH agent to ~/.ssh/config
    platforms: [darwin]
    status: ["grep -q '2BUA8C4S2C.com.1password' ~/.ssh/config 2>/dev/null"]
    cmds:
      - |
        mkdir -p ~/.ssh
        [ -f ~/.ssh/config ] || touch ~/.ssh/config && chmod 600 ~/.ssh/config
        printf '\nHost *\n  IdentityAgent "~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock"\n' >> ~/.ssh/config
        printf "{{.OK}} 1password ssh agent added to ~/.ssh/config\n"

  gh:auth:
    desc: Authenticate GitHub CLI
    deps: [1password:setup]
    status: ["gh auth status 2>/dev/null"]
    cmds:
      - printf "{{.WARN}} gh is not authenticated — run 'gh auth login' in another terminal\n"
      - |
        while ! gh auth status &>/dev/null; do sleep 0.5; done
        printf "{{.OK}} gh authenticated\n"

  rosetta:install:
    desc: Install Rosetta 2 (Apple Silicon)
    platforms: [darwin]
    status: ["test $(uname -m) != arm64 || /usr/bin/pgrep -q oahd 2>/dev/null"]
    cmds:
      - /usr/sbin/softwareupdate --install-rosetta --agree-to-license
      - printf "{{.OK}} rosetta 2\n"

  claude:install:
    desc: Install Claude Code
    status: ["command -v claude"]
    cmds:
      - curl -fsSL https://claude.ai/install.sh | bash
      - printf "{{.OK}} claude code\n"


  brew:pam-reattach:
    desc: Install pam-reattach for tmux Touch ID support
    platforms: [darwin]
    status: ["test -f /opt/homebrew/lib/pam/pam_reattach.so"]
    cmds:
      - brew install pam-reattach
      - printf "{{.OK}} pam-reattach\n"

  sudo:touchid:
    desc: Enable TouchID for sudo
    platforms: [darwin]
    status: ["grep -q pam_tid /etc/pam.d/sudo_local 2>/dev/null"]
    cmds:
      - sudo sh -c 'printf "auth       sufficient     pam_tid.so\n" > /etc/pam.d/sudo_local'
      - printf "{{.OK}} touchid sudo\n"

  sudo:reattach:
    desc: Enable Touch ID inside tmux via pam_reattach
    platforms: [darwin]
    deps: [brew:pam-reattach, sudo:touchid]
    status: ["grep -q pam_reattach /etc/pam.d/sudo_local 2>/dev/null"]
    cmds:
      - sudo sh -c '{ printf "auth       optional       /opt/homebrew/lib/pam/pam_reattach.so\n"; cat /etc/pam.d/sudo_local; } > /etc/pam.d/sudo_local.tmp && mv /etc/pam.d/sudo_local.tmp /etc/pam.d/sudo_local'
      - printf "{{.OK}} sudo reattach (tmux touchid)\n"

  sudo:timeout:
    desc: Set sudo timeout to 30 min
    platforms: [darwin]
    status: ["test -f /etc/sudoers.d/timeout"]
    cmds:
      - sudo sh -c 'echo "Defaults timestamp_timeout=30" > /etc/sudoers.d/timeout && chmod 0440 /etc/sudoers.d/timeout'
      - printf "{{.OK}} sudo timeout\n"

  mise:ensure:
    desc: Ensure mise is installed
    platforms: [darwin]
    deps: [brew:install]
    status: ["command -v mise"]
    cmds:
      - brew install mise
      - printf "{{.OK}} mise installed\n"

  mise:install:
    desc: Install mise tools
    deps: [mise:ensure, gh:auth, link:config]
    status: ["! command -v mise"]
    cmds:
      - |
        export PATH="$HOME/.local/share/mise/shims:$PATH"
        mise install
      - printf "{{.OK}} mise tools installed\n"

  converge:
    desc: Converge system to desired state
    deps:
      # Bootstrap (skipped on working systems via status:)
      - dotfiles:clone
      - brew:install
      - brew:roles
      - rosetta:install
      - claude:install
      - sudo:touchid
      - sudo:reattach
      - sudo:timeout
      - 1password:ssh-config
      - reinstall-bins
      - use-ssh
      # Regular update
      - link
      - check:auth
      - brew:bundle
      - icon:wezterm
      - apt:upgrade
      - dnf:upgrade
      - mise:upgrade
      - tmux
      - generate:completions
    cmds:
      - rm -f ~/.cache/zsh/eval/*.zsh ~/.cache/zsh/eval/*.zwc
      - rm -f ~/.config/zsh/conf.d/*.zwc
      - rm -f ~/.zcompdump
      - printf "{{.OK}} {{.BOLD}}converged{{.RESET}} (restart shell for changes)\n"

  # ---------------------------------------------------------------------------
  # Link tasks
  # ---------------------------------------------------------------------------

  link:
    desc: Symlink dotfiles and configs
    deps:
      - link:dotfiles
      - link:config
      - patch:gitconfig
      - patch:ssh
      - link:brewfile
      - link:claude-hooks
      - link:sheldon
      - link:launchagents
      - patch:npmrc
      - link:cargo

  link:dotfiles:
    desc: Symlink dotfiles (.* → ~)
    cmds:
      - |
        for f in "{{.DOTFILES}}"/.* ; do
          name=$(basename "$f")
          case "$name" in
            .|..|.git|.gitignore|.github|.vscode|.sonarlint|\
            .editorconfig|.codeowners-lsp|.ruby-lsp|.crates.toml|.crates2.json)
              continue ;;
          esac
          target="$HOME/$name"
          [ -L "$target" ] && [ "$(readlink "$target")" = "$f" ] && continue
          rm -rf "$target"
          ln -s "$f" "$target"
          printf "{{.LINK}} %s\n" "$name"
        done

  link:config:
    desc: Symlink config dirs (config.d/* → ~/.config/*)
    cmds:
      - |
        mkdir -p "$HOME/.config"
        for f in "{{.DOTFILES}}/config.d"/*; do
          [ -e "$f" ] || continue
          name=$(basename "$f")
          target="$HOME/.config/$name"
          [ -L "$target" ] && [ "$(readlink "$target")" = "$f" ] && continue
          rm -rf "$target"
          ln -s "$f" "$target"
          printf "{{.LINK}} ~/.config/%s\n" "$name"
        done

  patch:gitconfig:
    desc: Ensure gitconfig includes dotfiles
    cmds:
      - |
        [ -f "$HOME/.gitconfig" ] || touch "$HOME/.gitconfig"
        grep -q '.dotfiles' "$HOME/.gitconfig" 2>/dev/null && exit 0
        printf '\n[include]\npath = ~/.dotfiles/git.d/core.conf\n' >> "$HOME/.gitconfig"
        printf "{{.OK}} gitconfig include\n"

  patch:ssh:
    desc: Ensure SSH config includes dotfiles
    cmds:
      - |
        mkdir -p "$HOME/.ssh"
        if [ ! -f "$HOME/.ssh/config" ]; then
          touch "$HOME/.ssh/config"
          chmod 600 "$HOME/.ssh/config"
        fi
        grep -q '.dotfiles' "$HOME/.ssh/config" 2>/dev/null && exit 0
        printf '\nInclude ~/.dotfiles/ssh.d/*.conf\n' >> "$HOME/.ssh/config"
        printf "{{.OK}} ssh config include\n"

  link:brewfile:
    desc: Symlink Brewfile
    platforms: [darwin]
    cmds:
      - |
        target="$HOME/Brewfile"
        [ -L "$target" ] && [ "$(readlink "$target")" = "{{.DOTFILES}}/Brewfile" ] && exit 0
        ln -sf "{{.DOTFILES}}/Brewfile" "$target"
        printf "{{.OK}} Brewfile\n"

  link:claude-hooks:
    desc: Inject Claude Code hooks into settings.json
    status: ["! command -v jq || ! test -f $HOME/.claude/settings.json"]
    cmds:
      - |
        claude_settings="$HOME/.claude/settings.json"
        jq -e '.hooks.PostToolUse[]?.hooks[]? | select(.command | contains("gastown-file-changed"))' "$claude_settings" >/dev/null 2>&1 && exit 0
        jq '
          .hooks //= {} |
          .hooks.PostToolUse //= [] |
          .hooks.PostToolUse += [{"matcher": "Write|Edit", "hooks": [{"type": "command", "command": "~/.dotfiles/hooks/gastown-file-changed.sh"}]}]
        ' "$claude_settings" > "$claude_settings.tmp" && mv "$claude_settings.tmp" "$claude_settings"
        printf "{{.OK}} claude hooks: gastown\n"

  patch:npmrc:
    desc: Ensure npmrc has security defaults
    cmds:
      - |
        npmrc="$HOME/.npmrc"
        [ -f "$npmrc" ] || touch "$npmrc"
        chmod 600 "$npmrc"
        changed=0
        while IFS= read -r line || [ -n "$line" ]; do
          case "$line" in \#*|"") continue ;; esac
          key="${line%%=*}"
          grep -q "^${key}=" "$npmrc" || { echo "$line" >> "$npmrc"; changed=1; }
        done < "{{.DOTFILES}}/packager.d/npmrc-security"
        [ "$changed" = 1 ] && printf "{{.OK}} npmrc security defaults\n"
        exit 0

  link:cargo:
    desc: Symlink cargo security config
    cmds:
      - |
        mkdir -p "$HOME/.cargo"
        target="$HOME/.cargo/config.toml"
        src="{{.DOTFILES}}/packager.d/cargo-config.toml"
        [ -L "$target" ] && [ "$(readlink "$target")" = "$src" ] && exit 0
        if [ -f "$target" ] && [ ! -L "$target" ]; then
          printf "{{.WARN}} ~/.cargo/config.toml exists — merge %s manually\n" "$src"
          exit 0
        fi
        ln -sf "$src" "$target"
        printf "{{.LINK}} cargo config\n"

  link:launchagents:
    desc: Symlink and reload LaunchAgents
    platforms: [darwin]
    cmds:
      - |
        mkdir -p "$HOME/Library/LaunchAgents"
        for f in "{{.DOTFILES}}/launchd"/*.plist; do
          [ -e "$f" ] || continue
          name=$(basename "$f")
          label="${name%.plist}"
          target="$HOME/Library/LaunchAgents/$name"
          [ -L "$target" ] && [ "$(readlink "$target")" = "$f" ] || {
            rm -f "$target"
            ln -s "$f" "$target"
            printf "{{.LINK}} LaunchAgents/%s\n" "$name"
          }
          launchctl bootout "gui/$(id -u)/$label" 2>/dev/null || true
          launchctl bootstrap "gui/$(id -u)" "$target"
          printf "{{.OK}} %s (loaded)\n" "$label"
        done

  link:sheldon:
    desc: Sheldon plugin manager
    status:
      - "! command -v sheldon"
    cmds:
      - sheldon source >/dev/null 2>&1 && printf "{{.OK}} sheldon\n"

  # ---------------------------------------------------------------------------
  # Build / utility tasks
  # ---------------------------------------------------------------------------

  reinstall-bins:
    desc: Build and install rust binaries from crates/
    deps: [mise:install]
    status: ["test -f {{.DOTFILES}}/bin/clean-dls"]
    cmds:
      - printf "{{.WORK}} building rust binaries\n"
      - cargo install --path {{.DOTFILES}}/crates --bins --root {{.DOTFILES}}
      - printf "{{.OK}} binaries installed\n"

  use-ssh:
    desc: Switch dotfiles remote from HTTPS to SSH
    dir: "{{.DOTFILES}}"
    cmds:
      - |
        current=$(git remote get-url origin)
        if echo "$current" | grep -q "^git@"; then
          printf "{{.OK}} already using SSH\n"
          exit 0
        fi
        ssh_url=$(echo "$current" | sed -E 's|https://github.com/(.+)|git@github.com:\1|')
        git remote set-url origin "$ssh_url"
        printf "{{.OK}} remote switched to %s\n" "$ssh_url"

  # ---------------------------------------------------------------------------
  # Update tasks
  # ---------------------------------------------------------------------------

  check:auth:
    desc: Check authentication status
    deps:
      - check:auth:gh
      - check:auth:op

  check:auth:gh:
    desc: Check GitHub CLI auth
    platforms: [darwin]
    status: ["! command -v gh"]
    cmds:
      - |
        if gh auth status >/dev/null 2>&1; then
          printf "{{.OK}} gh: authenticated\n"
        else
          printf "{{.WARN}} gh: not authenticated (run gh auth login)\n"
        fi

  check:auth:op:
    desc: Check 1Password CLI integration
    platforms: [darwin]
    status: ["! command -v op"]
    cmds:
      - |
        if op account list >/dev/null 2>&1; then
          printf "{{.OK}} op: integrated\n"
        else
          printf "{{.WARN}} op: not integrated (check 1Password CLI settings)\n"
        fi

  brew:bundle:
    desc: Install/upgrade brew packages
    deps: [link:brewfile, brew:pam-reattach]
    platforms: [darwin]
    status: ["! command -v brew"]
    cmds:
      - brew bundle --quiet
      - brew cleanup --quiet &

  icon:wezterm:
    desc: Apply custom WezTerm icon via Finder xattr (bypasses macOS 26 liquid-glass framing)
    platforms: [darwin]
    deps: [brew:bundle]
    status:
      - test ! -d /Applications/WezTerm.app
      - test -f "/Applications/WezTerm.app/Icon\r"
    cmds:
      - fileicon set /Applications/WezTerm.app "{{.DOTFILES}}/config.d/wezterm/wezterm.icns"
      - rm -f /var/folders/*/*/*/com.apple.dock.iconcache 2>/dev/null || true
      - rm -rf /var/folders/*/*/*/com.apple.iconservices* 2>/dev/null || true
      - killall Dock 2>/dev/null || true
      - killall Finder 2>/dev/null || true
      - printf "{{.OK}} WezTerm icon applied\n"

  apt:upgrade:
    desc: Update apt packages
    platforms: [linux]
    status: ["! command -v apt-get"]
    cmds:
      - sudo apt-get update
      - sudo apt-get upgrade -y
      - sudo apt-get autoremove -y

  dnf:upgrade:
    desc: Update dnf packages
    platforms: [linux]
    status: ["! command -v dnf"]
    cmds:
      - sudo dnf update -y

  mise:upgrade:
    desc: Update mise tools
    deps: [gh:auth]
    status: ["! command -v mise"]
    cmds:
      - mise up
      - mise reshim

  tmux:
    desc: Install/update tmux plugins
    deps:
      - tmux:resurrect
      - tmux:fzf-url

  tmux:resurrect:
    desc: Install/update tmux-resurrect
    cmds:
      - task: tmux:plugin
        vars:
          NAME: tmux-resurrect
          URL: https://github.com/tmux-plugins/tmux-resurrect.git

  tmux:fzf-url:
    desc: Install/update tmux-fzf-url
    cmds:
      - task: tmux:plugin
        vars:
          NAME: tmux-fzf-url
          URL: https://github.com/wfxr/tmux-fzf-url.git

  tmux:plugin:
    internal: true
    run: always
    vars:
      DEST: "{{.HOME}}/.tmux/plugins/{{.NAME}}"
    cmds:
      - mkdir -p {{.HOME}}/.tmux/plugins
      - |
        if [ -d "{{.DEST}}" ]; then
          before=$(git -C "{{.DEST}}" rev-parse HEAD)
          git -C "{{.DEST}}" pull --quiet
          after=$(git -C "{{.DEST}}" rev-parse HEAD)
          [ "$before" != "$after" ] && printf "{{.OK}} {{.NAME}} (updated)\n" || true
        else
          git clone --quiet {{.URL}} "{{.DEST}}"
          printf "{{.OK}} {{.NAME}} (installed)\n"
        fi

  generate:completions:
    desc: Regenerate zsh completions
    deps:
      - for:
          - argocd
          - buf
          - clean-dls
          - clean-exif
          - docker
          - embed-art
          - extract-exif-from-flac
          - fcloud
          - git-squash
          - git-sync
          - glow
          - golangci-lint
          - gt
          - helm
          - houston
          - imp
          - k9s
          - kill-port
          - kubecolor
          - kubectl
          - lefthook
          - nano-web
          - op
          - orbctl
          - parallel-dl-extract
          - procs
          - prune
          - prune-gen
          - pulumi
          - sesh
          - tilt
          - to-audio
          - turso
          - unfuck-xcode
          - url2base64
          - vimv
          - watchwoman
          - yq
        task: generate:completions:gen
        vars:
          TOOL: "{{.ITEM}}"
          CMD: "{{.ITEM}} completion zsh"
      # Custom completion commands
      - task: generate:completions:gen
        vars: { TOOL: gh, CMD: "gh completion -s zsh" }
      - task: generate:completions:gen
        vars: { TOOL: fastmail-cli, CMD: "fastmail-cli completions zsh" }
      - task: generate:completions:gen
        vars: { TOOL: koan, CMD: "koan completions zsh" }
      - task: generate:completions:gen
        vars: { TOOL: codeowners-cli, CMD: "codeowners-cli completions zsh" }
      - task: generate:completions:gen
        vars: { TOOL: task, CMD: "task --completion zsh" }
      - task: generate:completions:gen
        vars: { TOOL: just, CMD: "just --completions zsh" }
      - task: generate:completions:gen
        vars: { TOOL: aws-vault, CMD: "aws-vault --completion-script-zsh" }
      - task: generate:completions:gen
        vars: { TOOL: rg, CMD: "rg --generate complete-zsh" }
      - task: generate:completions:gen
        vars: { TOOL: xh, CMD: "xh --generate complete-zsh" }
      - task: generate:completions:gen
        vars: { TOOL: pup, CMD: "pup completions zsh" }
      - task: generate:completions:gen
        vars: { TOOL: bun, CMD: "bun completions zsh" }
      - task: generate:completions:gen
        vars: { TOOL: deno, CMD: "deno completions zsh" }
      - task: generate:completions:gen
        vars: { TOOL: starship, CMD: "starship completions zsh" }
      - task: generate:completions:gen
        vars: { TOOL: sheldon, CMD: "sheldon completions --shell zsh" }
      - task: generate:completions:gen
        vars: { TOOL: bat, CMD: "bat --completion zsh" }
      - task: generate:completions:gen
        vars: { TOOL: delta, CMD: "delta --generate-completion zsh" }
      # Prebuilt: lsd
      - task: generate:completions:lsd
      # Sourced: npm
      - task: generate:completions:npm

  generate:completions:setup:
    internal: true
    deps: [brew:bundle, mise:upgrade]
    vars:
      COMP_DIR: "{{.HOME}}/.config/zsh/completions"
    cmds:
      - mkdir -p {{.COMP_DIR}}
      - rm -f {{.COMP_DIR}}/_*

  generate:completions:gen:
    internal: true
    run: always
    deps: [generate:completions:setup]
    status: ["! command -v {{.TOOL}}"]
    vars:
      COMP_DIR: "{{.HOME}}/.config/zsh/completions"
    cmds:
      - |
        if {{.CMD}} > "{{.COMP_DIR}}/_{{.TOOL}}" 2>/dev/null && [ -s "{{.COMP_DIR}}/_{{.TOOL}}" ]; then
          printf "{{.OK}} %s\n" "{{.TOOL}}"
        else
          rm -f "{{.COMP_DIR}}/_{{.TOOL}}"
        fi

  generate:completions:lsd:
    internal: true
    deps: [generate:completions:setup]
    status: ["! command -v lsd"]
    vars:
      COMP_DIR: "{{.HOME}}/.config/zsh/completions"
    cmds:
      - |
        src="$(dirname "$(command -v lsd)")/autocomplete/_lsd"
        [ -f "$src" ] && cp "$src" "{{.COMP_DIR}}/_lsd" && printf "{{.OK}} lsd (pre-built)\n"

  generate:completions:npm:
    internal: true
    deps: [generate:completions:setup]
    status: ["! command -v npm"]
    cmds:
      - npm completion > "{{.DOTFILES}}/config.d/zsh/conf.d/npm-completion.zsh" 2>/dev/null && printf "{{.OK}} npm (sourced)\n"