Taskfile.yml

# dezhban task runner — https://taskfile.dev (`brew install go-task`, v3.30+ for `prompt:`).
#
# `task` with no arguments is the entry point: an interactive picker on a TTY,
# the static grouped menu otherwise (`task help` prints it directly). The visible
# vocabulary is ~15 intent-named commands in four groups (everyday / safe loop /
# real install / release); plumbing is hidden but callable (`task --list-all`).
#
# Two roll loops (macOS):
#   fast : task dev      — rebuild CLI+GUI, swap them in place, restart/relaunch
#   full : task install  — cross-compile, universal app, .pkg, installer, open app
#
# Each OS firewall backend is isolated behind build tags (pf/darwin,
# nftables/linux, wf/windows), so every target compiles only its own backend.
# The version is stamped via -ldflags; nothing else is linked in.
#
# scripts/*.sh stay runnable without task (escape hatches must not depend on
# dev tooling): `sh scripts/panic.sh` always works. The source-install scripts
# (install-local.sh / reinstall.sh / uninstall-local.sh) have no task wrappers —
# they are the standalone / non-macOS path, run them directly.

version: '3'

silent: true

vars:
  BINARY: dezhban
  PKG: ./cmd/dezhban
  DIST: dist
  ABS_DIST: '{{.ROOT_DIR}}/{{.DIST}}'
  # Overridable per invocation: task build:all VERSION=v0.4.0
  VERSION:
    sh: git describe --tags --always --dirty 2>/dev/null || echo dev
  # The v-prefix is normalised HERE, once, and nowhere else. VERSION may or may
  # not carry a leading "v" (a tag does, a bare `git describe --always` SHA does
  # not); artifact FILENAMES never do, because packaging/macos/build-pkg.sh writes
  # dezhban-${VERSION#v}.pkg. Deriving the filename independently on each side is
  # what used to break the install step — it looked for dezhban-v0.1-17-g….pkg
  # while build-pkg.sh had written dezhban-0.1-17-g….pkg.
  VERSION_BARE: '{{trimPrefix "v" .VERSION}}'
  COMMIT:
    sh: git rev-parse HEAD 2>/dev/null || echo ""
  DATE:
    sh: date -u +%Y-%m-%dT%H:%M:%SZ
  LDFLAGS: '-X main.version={{.VERSION}} -X main.commit={{.COMMIT}} -X main.date={{.DATE}}'
  # Dev-loop config knobs, e.g.:
  #   task rules MODE=fullblock CONFIG=configs/dezhban.vpn-guard.json
  CONFIG: configs/dezhban.local.json
  MODE: guard
  # Installed locations (macOS). Mirror cmd/dezhban + packaging/macos.
  INSTALL_BIN: /usr/local/bin/dezhban
  APP_DIR: /Applications/Dezhban.app
  DAEMON_PLIST: /Library/LaunchDaemons/dezhban.plist

tasks:
  default:
    cmds:
      - |
        if [ -t 0 ] && [ -t 1 ]; then
          go run ./tools/taskmenu
        else
          task help
        fi

  help:
    cmds:
      - |
        cat <<'EOF'
        dezhban — dev tasks   (interactive picker: run `task` on a TTY)

          everyday
            build      compile for this host into ./dezhban
            check      vet + test + lint (golangci-lint if installed)
            dev        fast roll: rebuild CLI+GUI, swap, restart (sudo)
            clean      remove build artifacts

          safe loop (no root, no firewall effects)
            monitor    build + run the monitor in dry-run, Ctrl-C to stop (CONFIG=…)
            validate   parse + validate CONFIG
            rules      print the ruleset for MODE (guard|fullblock|switch), don't apply
            doctor     diagnose VPN-guard config (flags after --: task doctor -- --discover)
            status     current posture

          real install (macOS installer)
            pkg        build dist/dezhban-<version>.pkg (universal CLI + app)
            install    pkg + macOS Installer + open app — asks to wipe first (FRESH=1/0 skips; sudo)
            uninstall  run the uninstaller — asks whether to keep config (KEEP_CONFIG=1/0 skips; sudo)
            panic      force-remove dezhban's firewall rules — the lockout escape hatch

          release
            release:check    preflight: on main? clean? synced? CI green?
            release:preview  dry run: version, notes, CHANGELOG diff (VERSION=|BUMP=, or asked)
            release          cut it: confirm, dispatch the workflow, watch it (VERSION=|BUMP=, or asked)

          plumbing (hidden; see `task --list-all`): build:all gui:build dev:cli dev:gui vet test lint
          escape hatches (never need task): sh scripts/panic.sh, sh scripts/install-local.sh, …
        EOF

  # --- everyday ---------------------------------------------------------------

  build:
    desc: Compile for this host into ./dezhban, version-stamped
    cmds:
      - go build -ldflags "{{.LDFLAGS}}" -o {{.BINARY}} {{.PKG}}
      - echo "built ./{{.BINARY}} ({{.VERSION}})"

  check:
    desc: vet + test + lint (golangci-lint if installed, else gofmt + go vet)
    cmds:
      - task: lint
      - task: test
      - echo "check passed"

  clean:
    desc: Remove build artifacts (dist/, ./dezhban, ./dezhban.exe, Swift .build)
    cmds:
      - rm -rf {{.DIST}} {{.BINARY}} {{.BINARY}}.exe gui/macos/.build

  # --- safe loop (no root, no firewall effects) -------------------------------

  monitor:
    desc: Build + run the monitor in dry-run — no firewall touch, Ctrl-C to stop (CONFIG=…)
    cmds:
      - CONFIG={{.CONFIG}} sh scripts/dev.sh

  validate:
    desc: Load + validate CONFIG without side effects
    cmds:
      - go run {{.PKG}} validate --config {{.CONFIG}}

  rules:
    desc: Print the ruleset for MODE (guard|fullblock|switch) without applying
    cmds:
      - go run {{.PKG}} print-rules --mode {{.MODE}} --config {{.CONFIG}}

  doctor:
    desc: 'Diagnose VPN guard config (extra flags after "--": task doctor -- --discover)'
    cmds:
      - go run {{.PKG}} doctor --config {{.CONFIG}} {{.CLI_ARGS}}

  status:
    desc: Show current posture (installed CLI if present, else go run)
    cmds:
      - |
        if [ -x {{.INSTALL_BIN}} ]; then {{.INSTALL_BIN}} status; else go run {{.PKG}} status; fi

  # --- fast dev loop (everyday roll; seconds, not minutes) --------------------

  dev:
    desc: 'Fast roll: rebuild CLI+GUI, swap in place, restart daemon + relaunch app (sudo)'
    platforms: [darwin]
    preconditions:
      - sh: test -f {{.DAEMON_PLIST}} || test -d {{.APP_DIR}}
        msg: 'Nothing installed yet — run `task install` first (or sh scripts/install-local.sh).'
    cmds:
      # Ask for sudo up front so the prompt fires now, not after the build.
      - sudo -v
      - task: dev:cli
      - task: dev:gui

  dev:cli:
    platforms: [darwin]
    deps: [build]
    cmds:
      # install(1) unlinks the destination before writing: never modify a
      # running (ad-hoc signed) binary in place — the kernel kills such a
      # process on Apple Silicon. The running daemon keeps its old image
      # until the restart below.
      - echo "→ swapping {{.INSTALL_BIN}}"
      - sudo install -m 0755 ./{{.BINARY}} {{.INSTALL_BIN}}
      - |
        if [ -f {{.DAEMON_PLIST}} ]; then
          echo "→ restarting daemon"
          sudo {{.INSTALL_BIN}} restart
        else
          echo "no LaunchDaemon registered; skipping restart (task install)"
        fi
      - '{{.INSTALL_BIN}} version'

  dev:gui:
    platforms: [darwin]
    cmds:
      - task: gui:build
      - echo "→ relaunching Dezhban.app"
      - osascript -e 'quit app "Dezhban"' 2>/dev/null || true
      - pkill -x DezhbanMenu 2>/dev/null || true
      - sleep 1
      # Root-owned copy, matching what the .pkg installs; ditto preserves
      # bundle structure and extended attributes.
      - sudo rm -rf {{.APP_DIR}}
      - sudo ditto {{.DIST}}/Dezhban.app {{.APP_DIR}}
      - open {{.APP_DIR}}

  # --- real install (macOS installer) -----------------------------------------

  pkg:
    desc: Build the macOS installer into ./dist/dezhban-<version>.pkg (universal CLI + app)
    platforms: [darwin]
    preconditions:
      - sh: xcode-select -p >/dev/null 2>&1
        msg: 'Xcode Command Line Tools required — run `xcode-select --install`.'
    deps: # independent — run in parallel
      - build:all
      - task: gui:build
        vars: { UNIVERSAL: '1' }
    cmds:
      - VERSION={{.VERSION}} bash packaging/macos/build-pkg.sh {{.ABS_DIST}}

  pkg:linux:
    desc: Build .deb/.rpm packages into ./dist/ for both Linux arches (needs nfpm)
    preconditions:
      - sh: command -v nfpm >/dev/null 2>&1
        msg: 'nfpm required — https://nfpm.goreleaser.com/install/ (or: go install github.com/goreleaser/nfpm/v2/cmd/nfpm@latest)'
    deps:
      - build:all
    cmds:
      - |
        set -eu
        mkdir -p {{.DIST}}/nfpm-stage
        for arch in amd64 arm64; do
          cp {{.DIST}}/{{.BINARY}}-linux-$arch {{.DIST}}/nfpm-stage/dezhban
          chmod 0755 {{.DIST}}/nfpm-stage/dezhban
          for packager in deb rpm; do
            echo "building $packager ($arch, {{.VERSION_BARE}})"
            VERSION={{.VERSION_BARE}} GOARCH=$arch nfpm package \
              --config nfpm.yaml --packager "$packager" --target {{.DIST}}/
          done
        done
        rm -rf {{.DIST}}/nfpm-stage

  install:
    desc: 'Real install: build the .pkg, run the macOS Installer, open the app (asks to wipe first; FRESH=1/0 skips the question; sudo)'
    platforms: [darwin]
    cmds:
      # Ask for sudo up front so the prompt fires now, not after the build.
      - sudo -v
      # On-demand var: FRESH unset on a TTY → ask; FRESH=1/0 explicit (or no
      # TTY) → no question. task gives commands no TTY, hence /dev/tty — the
      # same pattern as `release`.
      - |
        fresh='{{.FRESH | default ""}}'
        if [ -z "$fresh" ] && (exec </dev/tty) 2>/dev/null; then
          printf 'Wipe first? Runs the uninstaller before installing (config kept). [y/N] ' > /dev/tty
          read -r reply < /dev/tty
          case "$reply" in y|Y) fresh=1 ;; esac
        fi
        if [ "$fresh" = "1" ]; then
          echo "→ uninstalling first"
          sudo env KEEP_CONFIG=1 sh packaging/macos/uninstall.sh
        fi
      - task: pkg
      - |
        set -eu
        pkg={{.DIST}}/dezhban-{{.VERSION_BARE}}.pkg
        [ -f "$pkg" ] || { echo "missing $pkg — did the pkg build fail?" >&2; exit 1; }
        echo "→ installing $pkg"
        sudo installer -pkg "$pkg" -target /
      - open {{.APP_DIR}}
      - echo "installed $({{.INSTALL_BIN}} version 2>/dev/null || echo '(version unavailable)')"

  uninstall:
    desc: Tear down the installed dezhban — asks whether to keep the config (KEEP_CONFIG=1/0 skips the question; sudo)
    platforms: [darwin]
    prompt: This removes the dezhban daemon, app, CLI, and firewall rules. Continue?
    cmds:
      - sudo -v
      # On-demand var: KEEP_CONFIG unset on a TTY → ask (default keep);
      # explicit 1/0 or no TTY → keep without asking.
      - |
        keep='{{.KEEP_CONFIG | default ""}}'
        if [ -z "$keep" ] && (exec </dev/tty) 2>/dev/null; then
          printf 'Keep the /etc/dezhban config? [Y/n] ' > /dev/tty
          read -r reply < /dev/tty
          case "$reply" in n|N) keep=0 ;; *) keep=1 ;; esac
        fi
        sudo env KEEP_CONFIG="${keep:-1}" sh packaging/macos/uninstall.sh

  panic:
    desc: Force-remove dezhban's firewall rules — the lockout escape hatch (sudo inside)
    cmds:
      - sh scripts/panic.sh

  # --- hidden plumbing (callable, not listed) ---------------------------------

  build:all:
    # CI (ci.yml, release.yml) calls this by name — keep it callable.
    cmds:
      - |
        mkdir -p {{.DIST}}
        for p in darwin/arm64 darwin/amd64 linux/amd64 linux/arm64 windows/amd64; do
          os=${p%/*}; arch=${p#*/}; ext=""
          [ "$os" = windows ] && ext=.exe
          out={{.DIST}}/{{.BINARY}}-$os-$arch$ext
          echo "building $out ({{.VERSION}})"
          GOOS=$os GOARCH=$arch CGO_ENABLED=0 \
            go build -ldflags "{{.LDFLAGS}}" -o "$out" {{.PKG}} || exit 1
        done
        echo "done -> {{.DIST}}/"

  gui:build:
    # Build the menubar app into ./dist/Dezhban.app (UNIVERSAL=1 for arm64+x86_64).
    platforms: [darwin]
    cmds:
      # build-app.sh checks DEZHBAN_APP_UNIVERSAL for non-emptiness, so it must
      # stay UNSET (not "0") for a single-arch build.
      - |
        if [ "{{.UNIVERSAL}}" = "1" ]; then export DEZHBAN_APP_UNIVERSAL=1; fi
        DEZHBAN_VERSION={{.VERSION}} bash gui/macos/build-app.sh {{.ABS_DIST}}

  vet:
    cmds:
      - go vet ./...

  test:
    cmds:
      - go test ./...

  test:cover:
    desc: 'Run the suite with coverage and enforce .testcoverage.yml'
    vars:
      # Pinned, never @latest: the gate decides whether CI goes red, so a new
      # upstream release must not be able to change that verdict without a
      # commit here. Bump deliberately. Keep in sync with .github/workflows/ci.yml.
      COVERAGE_TOOL: github.com/vladopajic/go-test-coverage/v2@v2.19.0
    cmds:
      - go test ./... -coverprofile=cover.out
      # Unconditional install, not "skip if the binary exists": `go install` is
      # a fast no-op once the module is cached, and skipping would silently keep
      # whatever version a developer installed first — which is exactly what the
      # pin above exists to prevent.
      - go install {{.COVERAGE_TOOL}}
      - '"$(go env GOPATH)/bin/go-test-coverage" --config=.testcoverage.yml'

  lint:
    cmds:
      - |
        if command -v golangci-lint >/dev/null 2>&1; then
          golangci-lint run
        else
          echo "golangci-lint not found; running gofmt + go vet"
          unformatted="$(gofmt -l .)"
          if [ -n "$unformatted" ]; then echo "gofmt needed:"; echo "$unformatted"; exit 1; fi
          go vet ./...
        fi

  # --- release ------------------------------------------------------------------
  #
  # All three delegate to scripts/release.sh, which is the SAME code the Release
  # workflow runs — so a local preview cannot drift from what CI will do.
  #
  #   task release:check                  is it safe to release right now?
  #   task release:preview VERSION=0.2.0  what exactly would a release do?
  #   task release BUMP=minor             actually cut it
  #
  # Pass either VERSION=X.Y.Z[-rc.N] or BUMP=patch|minor|major|rc.

  release:check:
    desc: 'Preflight: on main? clean? synced? [Unreleased] filled? CI green?'
    cmds:
      - bash scripts/release.sh preflight

  release:preview:
    desc: 'Dry run: print the resolved version, the notes, and the CHANGELOG diff (VERSION=|BUMP=, or asked)'
    cmds:
      - |
        set -eu
        # VERSION doubles as the build-stamp var (defaulting to `git describe`), so
        # only a release-SHAPED value counts as an explicit request here. With
        # neither given, ask on-demand on a TTY.
        if [ -n "{{.BUMP | default ""}}" ]; then
          eval "$(bash scripts/release.sh resolve --bump '{{.BUMP}}')"
        elif echo '{{.VERSION}}' | grep -Eq '^v?[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$'; then
          eval "$(bash scripts/release.sh resolve --version '{{.VERSION}}')"
        elif (exec </dev/tty) 2>/dev/null; then
          printf 'release spec — patch|minor|major|rc, or a version X.Y.Z[-rc.N]: ' > /dev/tty
          read -r spec < /dev/tty
          case "$spec" in
            patch|minor|major|rc) eval "$(bash scripts/release.sh resolve --bump "$spec")" ;;
            *)
              echo "$spec" | grep -Eq '^v?[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$' \
                || { echo "unrecognised: '$spec' — expected patch|minor|major|rc or X.Y.Z[-rc.N]" >&2; exit 2; }
              eval "$(bash scripts/release.sh resolve --version "$spec")" ;;
          esac
        else
          echo "pass VERSION=X.Y.Z[-rc.N] or BUMP=patch|minor|major|rc" >&2
          echo "(VERSION is '{{.VERSION}}' — the git-describe default, not a release version)" >&2
          exit 2
        fi

        echo "next tag    $TAG   ($KIND)"
        echo "prev tag    ${PREV_TAG:-(none)}"
        echo "numeric     $VERSION_NUM   (pkg receipt / CFBundleShortVersionString)"
        echo "artifacts   .pkg, 5 CLI binaries, 4 tarballs, 2 .deb, 2 .rpm, app zip, SHA256SUMS(.sig)"
        echo
        echo "--- release notes ------------------------------------------------------"
        bash scripts/release.sh notes "$VERSION" "$KIND"
        echo "--- end notes ----------------------------------------------------------"
        echo

        if [ "$KIND" = rc ]; then
          echo "CHANGELOG: not rolled (rc is a tag-only snapshot; main is untouched)"
          exit 0
        fi
        # Roll a scratch copy so the working tree is never touched by a preview.
        tmp="$(mktemp -d)"
        trap 'rm -rf "$tmp"' EXIT
        cp CHANGELOG.md "$tmp/CHANGELOG.md.orig"
        bash scripts/release.sh roll "$VERSION"
        echo "--- CHANGELOG diff -----------------------------------------------------"
        diff -u "$tmp/CHANGELOG.md.orig" CHANGELOG.md | sed '1,2d' || true
        cp "$tmp/CHANGELOG.md.orig" CHANGELOG.md
        echo "--- end diff (working tree restored) -----------------------------------"

  release:
    desc: 'Cut a release: preflight, roll+commit+push the CHANGELOG, dispatch, watch it (VERSION=|BUMP=, or asked)'
    cmds:
      - |
        set -eu
        command -v gh >/dev/null 2>&1 || { echo "gh is required to dispatch a release" >&2; exit 1; }

        if [ -n "{{.BUMP | default ""}}" ]; then
          eval "$(bash scripts/release.sh resolve --bump '{{.BUMP}}')"
          dispatch_args="-f bump={{.BUMP}}"
        elif echo '{{.VERSION}}' | grep -Eq '^v?[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$'; then
          eval "$(bash scripts/release.sh resolve --version '{{.VERSION}}')"
          dispatch_args="-f version={{.VERSION}}"
        elif (exec </dev/tty) 2>/dev/null; then
          printf 'release spec — patch|minor|major|rc, or a version X.Y.Z[-rc.N]: ' > /dev/tty
          read -r spec < /dev/tty
          case "$spec" in
            patch|minor|major|rc)
              eval "$(bash scripts/release.sh resolve --bump "$spec")"
              dispatch_args="-f bump=$spec" ;;
            *)
              echo "$spec" | grep -Eq '^v?[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$' \
                || { echo "unrecognised: '$spec' — expected patch|minor|major|rc or X.Y.Z[-rc.N]" >&2; exit 2; }
              eval "$(bash scripts/release.sh resolve --version "$spec")"
              dispatch_args="-f version=$spec" ;;
          esac
        else
          echo "pass VERSION=X.Y.Z[-rc.N] or BUMP=patch|minor|major|rc" >&2
          echo "(VERSION is '{{.VERSION}}' — the git-describe default, not a release version)" >&2
          exit 2
        fi

        bash scripts/release.sh preflight

        # Roll the CHANGELOG for real (not a scratch copy — see release:preview
        # for that). This is the whole point of the new flow: CI never writes to
        # the repo, so the roll has to happen here, as you, before dispatch.
        # An rc never rolls; main stays untouched for it.
        if [ "$KIND" != rc ]; then
          bash scripts/release.sh roll "$VERSION"
          echo "--- CHANGELOG diff -----------------------------------------------------"
          git --no-pager diff -- CHANGELOG.md
          echo "--- end diff --------------------------------------------------------------"
        fi

        echo
        echo "  about to release   $TAG  ($KIND)"
        echo "  from commit        $(git rev-parse --short HEAD)"
        if [ "$KIND" = rc ]; then
          echo "  effect             tags $TAG, publishes it as a --prerelease"
          echo "                     main is untouched; no CHANGELOG roll"
        else
          echo "  effect             commits + pushes the rolled CHANGELOG to main"
          echo "                     (as you — no PR, this repo's ruleset lets its"
          echo "                     owner bypass it; only github-actions[bot] can't),"
          echo "                     then tags $TAG and publishes it as the latest release"
        fi
        echo

        # task does not give the command a TTY, so a bare `read` gets EOF and the
        # confirmation would abort instantly. Read from /dev/tty. CONFIRM=<tag>
        # skips the prompt for a non-interactive caller.
        if [ -n "{{.CONFIRM | default ""}}" ]; then
          reply='{{.CONFIRM}}'
          echo "  confirmed via CONFIRM=$reply"
        elif (exec </dev/tty) 2>/dev/null; then
          printf '  type the tag to confirm: ' > /dev/tty
          read -r reply < /dev/tty
        else
          echo "  no terminal to confirm on — re-run with CONFIRM=$TAG" >&2
          exit 1
        fi
        [ "$reply" = "$TAG" ] || { echo "  got '$reply', expected '$TAG' — aborted."; git checkout -- CHANGELOG.md 2>/dev/null || true; exit 1; }

        if [ "$KIND" != rc ]; then
          git add CHANGELOG.md
          git commit -q -m "chore(release): $TAG"
          git push origin main
          echo "  pushed the rolled CHANGELOG to main ($(git rev-parse --short HEAD))"
        fi

        # Note which run is the newest BEFORE dispatching, so we watch the run we
        # just created rather than a stale one (the dispatch is asynchronous, and
        # the new run takes a few seconds to appear).
        prev="$(gh run list --workflow=release.yml --limit 1 --json databaseId -q '.[0].databaseId' 2>/dev/null || echo none)"

        # shellcheck disable=SC2086
        gh workflow run release.yml --ref main $dispatch_args
        echo "  dispatched. waiting for the run to appear..."

        run_id="$prev"
        for _ in 1 2 3 4 5 6 7 8 9 10 11 12; do
          sleep 5
          run_id="$(gh run list --workflow=release.yml --limit 1 --json databaseId -q '.[0].databaseId')"
          [ "$run_id" != "$prev" ] && break
        done
        [ "$run_id" != "$prev" ] || { echo "  the run never appeared; check the Actions tab" >&2; exit 1; }

        echo "  https://github.com/Behnam-RK/dezhban/actions/runs/$run_id"
        gh run watch "$run_id" --exit-status