mise.toml

# https://mise.jdx.dev
# Canonical task vocabulary shared by git hooks (lefthook) and CI (GitHub Actions).

[env]
_.source = ".env"

[settings.task]
run_auto_install = false

[tools]
actionlint = "latest"
dprint = "latest"
git-cliff = "latest"
gitleaks = "latest"
hadolint = "latest"
trivy = "latest"
uv = "latest"
zizmor = "latest"

# ALL

[tasks.all]
alias = "a"
description = "Format, check, test, and build the project (the canonical gate)"
run = ["mise run format", "mise run check", "mise run test", "mise run build"]

# INSTALL

[tasks.install]
alias = "i"
description = "Install dependencies and git hooks"
depends = ["install:hooks"]

[tasks."install:python"]
description = "Sync Python dependencies (uv)"
run = "uv sync --all-groups"

[tasks."install:hooks"]
description = "Install git hooks (lefthook)"
depends = ["install:python"]
run = "uv run lefthook install"

[tasks."install:rulesets"]
description = "Install or update the GitHub branch ruleset (idempotent)"
# POST creates a duplicate every time it runs, so look the ruleset up by name first and
# PUT over the existing one. Re-running this task must be a no-op, not a second ruleset.
run = """
repo=$(gh repo view --json=nameWithOwner --jq=.nameWithOwner)
name=$(jq -r .name .github/rulesets/main.json)
id=$(gh api "/repos/$repo/rulesets" --jq ".[] | select(.name == \\"$name\\") | .id" | head -n1)
if [ -n "$id" ]; then
  gh api --method PUT "/repos/$repo/rulesets/$id" --input=.github/rulesets/main.json
else
  gh api --method POST "/repos/$repo/rulesets" --input=.github/rulesets/main.json
fi
"""

# FORMAT

[tasks.format]
alias = "f"
description = "Format all sources and documents"
run = ["mise run format:python", "mise run format:dprint"]

[tasks."format:python"]
description = "Format Python sources and imports (ruff)"
run = "uv run ruff check --select=I --fix --force-exclude . && uv run ruff format --force-exclude ."

[tasks."format:dprint"]
description = "Format JSON, Markdown, TOML, YAML (dprint)"
run = "dprint fmt"

# CHECK

[tasks.check]
alias = "c"
description = "Run all static checks in parallel"
depends = [
  "check:actions",
  "check:dockerfile",
  "check:format",
  "check:leaks",
  "check:lint",
  "check:scan",
  "check:types",
  "check:vuln",
]

[tasks."check:actions"]
description = "Lint and audit GitHub Actions workflows (actionlint + zizmor)"
run = ["actionlint", "zizmor --offline .github/workflows/"]

[tasks."check:dockerfile"]
description = "Lint the container image definition (hadolint)"
run = "hadolint Dockerfile"

[tasks."check:format"]
description = "Check formatting and config validity"
run = [
  "uv run validate-pyproject pyproject.toml",
  "uv run ruff format --check .",
  "dprint check",
  "uv lock --check",
]

[tasks."check:lint"]
description = "Lint Python sources (ruff)"
run = "uv run ruff check --force-exclude ."

[tasks."check:types"]
description = "Type-check Python sources (ty)"
run = "uv run ty check"

[tasks."check:vuln"]
description = "Scan dependencies for vulnerabilities (pip-audit)"
run = "uv run pip-audit --skip-editable --cache-dir .cache/pip-audit"

[tasks."check:leaks"]
description = "Audit codebase for leaked secrets (gitleaks)"
run = 'gitleaks git --log-opts="--max-count=100" --verbose'

[tasks."check:scan"]
description = "Scan the checkout for misconfigurations, secrets, and licenses (trivy)"
# `--config` is explicit on purpose: without it a `TRIVY_CONFIG` exported in the user's
# shell silently wins over the policy committed here, and the repository's own rules
# never run. `fs` (not `config`) is what actually enables every scanner in trivy.yaml.
run = "trivy --config trivy.yaml fs ."

# TEST

[tasks.test]
alias = "t"
description = "Run the test suite with coverage (pytest)"
run = "uv run pytest"

[tasks."test:parallel"]
description = "Run the test suite across CPU cores, without the coverage gate (pytest-xdist)"
# Fast local feedback only. pytest-cov and pytest-xdist deadlock on this suite, so the
# coverage gate stays on the serial `test` task that hooks and CI run.
run = "uv run pytest -n auto --no-cov"

# BUILD

[tasks.build]
alias = "b"
description = "Build the Python distribution (wheel + sdist)"
depends = ["build:python"]

[tasks."build:python"]
description = "Build Python distribution artifacts (uv)"
run = "uv build"

[tasks."build:image"]
description = "Build the production OCI image (Docker)"
run = "docker build --tag=bikes:latest ."

# DOCS

[tasks.docs]
alias = "d"
description = "Generate the API documentation (pdoc)"
run = "uv run pdoc --docformat=google --output-directory=docs src/bikes"

[tasks."docs:serve"]
description = "Serve the API documentation (pdoc)"
run = "uv run pdoc --docformat=google --port=8088 src/bikes"

# MLFLOW

[tasks."mlflow:doctor"]
description = "Run the MLflow environment doctor"
run = "uv run mlflow doctor"

[tasks."mlflow:serve"]
description = "Start a local MLflow tracking server on the SQLite backend"
# Same store the jobs write to: metadata in mlflow.db, artifact files under ./mlruns.
# The server's artifact root is set explicitly so a served experiment and a directly
# tracked one land in the same directory instead of MLflow's separate ./mlartifacts.
run = "uv run mlflow server --host=127.0.0.1 --port=5000 --backend-store-uri=sqlite:///mlflow.db --artifacts-destination=./mlruns"

# PROJECT (MLflow Projects)

[tasks.project]
description = "Run every MLflow job in sequence"
run = [
  "mise run project:run tuning",
  "mise run project:run training",
  "mise run project:run promotion",
  "mise run project:run inference",
  "mise run project:run evaluations",
  "mise run project:run explanations",
]

[tasks."project:run"]
description = "Run one MLflow job by config name (e.g. `mise run project:run training`)"
usage = 'arg "job" help="Config name under confs/ (without extension)"'
# --env-manager=local reuses the uv-managed environment (no separate python_env.yaml to maintain).
run = 'uv run mlflow run --env-manager=local --experiment-name=bikes --run-name="$usage_job" -P "conf_file=confs/$usage_job.yaml" .'

# DOCKER

[tasks."docker:compose"]
description = "Start the local MLflow server with Docker Compose"
run = "docker compose up"

[tasks."docker:run"]
description = "Run the latest built image"
run = "docker run --rm bikes:latest"

# UTILITIES

[tasks.coverage]
alias = "v"
description = "Open the HTML coverage report"
run = "uv run pytest --cov=src --cov-report=html && echo 'Report: htmlcov/index.html'"

[tasks.upgrade]
alias = "u"
description = "Upgrade dependencies to the latest compatible versions"
run = "uv sync --upgrade"

[tasks.clean]
alias = "n"
description = "Remove caches and build artifacts"
run = [
  "find . -type f -name '*.py[co]' -delete",
  "find . -type d -name __pycache__ -exec rm -rf {} +",
  "rm -rf .cache .pytest_cache .ruff_cache .ty_cache .coverage htmlcov dist docs mlflow.db mlartifacts/* mlruns/* outputs/*",
]