waybar-modules/justfile at main · rbright/waybar-modules · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
set shell := ["bash", "-euo", "pipefail", "-c"]
set positional-arguments

default:
    @just --list

fmt: fmt-workspace

fmt-check: fmt-workspace-check

test: test-workspace

lint: lint-workspace

build: build-workspace

ci-check: fmt-check test lint build guardrails

fmt-workspace:
    cargo fmt --all

fmt-workspace-check:
    cargo fmt --all --check

lint-workspace:
    cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::pedantic

test-workspace:
    cargo test --workspace

test-nextest:
    cargo nextest run --workspace --all-targets

build-workspace:
    cargo build --workspace --all-targets

deps-workspace:
    cargo fetch

deps-check: cargo-deny-check cargo-audit-check cargo-machete-check

cargo-deny-check:
    cargo deny check bans licenses sources advisories

cargo-audit-check:
    cargo audit

cargo-machete-check:
    cargo machete

guardrails-tools:
    scripts/guardrails/install_tools.sh opengrep ast-grep gitleaks

guardrails base_commit="":
    #!/usr/bin/env bash
    set -euo pipefail

    base_commit="{{ base_commit }}"
    if [[ -z "$base_commit" ]]; then
        if git rev-parse --verify origin/main >/dev/null 2>&1; then
            base_commit="$(git merge-base HEAD origin/main)"
            echo "ℹ️  guardrails: using merge-base with origin/main: $base_commit"
        elif git rev-parse --verify main >/dev/null 2>&1; then
            base_commit="$(git merge-base HEAD main)"
            echo "ℹ️  guardrails: using merge-base with main: $base_commit"
        else
            echo "⚠️  guardrails: could not resolve a merge-base; running full scans where possible"
        fi
    fi

    just opengrep "$base_commit"
    if [[ -n "$base_commit" ]]; then
        just diff-checks "$base_commit"
        just ast-grep "$base_commit"
        just gitleaks "$base_commit"
    else
        echo "ℹ️  guardrails: skipping diff-only checks"
        just ast-grep
        echo "ℹ️  guardrails: skipping gitleaks range scan (no base commit)"
    fi

opengrep base_commit="":
    scripts/guardrails/opengrep.sh {{ base_commit }}

ast-grep base_commit="":
    scripts/guardrails/ast_grep.sh {{ base_commit }}

gitleaks base_commit="":
    scripts/guardrails/gitleaks.sh {{ base_commit }}

diff-checks base_commit:
    scripts/guardrails/diff_checks.sh {{ base_commit }}

guardrails-staged:
    scripts/guardrails/staged_diff_checks.sh
    scripts/guardrails/gitleaks.sh

opengrep-report:
    scripts/guardrails/opengrep_report.sh

ast-grep-report:
    scripts/guardrails/ast_grep_report.sh

nix-build:
    nix build --no-link 'path:.#agent-usage'
    nix build --no-link 'path:.#github'
    nix build --no-link 'path:.#linear'
    nix build --no-link 'path:.#schedule'
    nix build --no-link 'path:.#waybar-modules'

precommit-install:
    prek install --overwrite --install-hooks --hook-type pre-commit --hook-type pre-push

precommit-run:
    prek run --all-files --stage pre-commit

prepush-run:
    prek run --all-files --stage pre-push