mise.toml

# mise.toml - Tool versions and tasks for Agent Plugins for AWS
# See: https://mise.jdx.dev

min_version = "2026.2.4"

[env]
# Vendored Semgrep ruleset (RFC #211). Used by any bare `semgrep` call in a mise
# context because Semgrep reads SEMGREP_RULES whenever --config is absent. See
# tools/semgrep/ and `mise run semgrep:update`.
SEMGREP_RULES = "tools/semgrep/rules-vendored.yaml"

[tools]
uv = "0.10"
node = "24"
"npm:markdownlint-cli2" = "0.17"
"npm:ajv-cli" = "5"
"npm:dprint" = "0.51"
"pipx:pre-commit" = "4"
"pipx:bandit[sarif]" = "1"
"pipx:checkov" = "3"
"pipx:semgrep" = "1.151.0"
"grype" = "0.107.1"
"gitleaks" = "8.30.0"

# ==================
# ROOT LEVEL TASKS
# ==================

[tasks.pre-commit]
description = "Run pre-commit"
run = [
  "pre-commit run --all-files"
]

# ======================
# LINTING & FORMATTING
# ======================

[tasks.fmt]
description = "Format all files"
run = "dprint fmt"

[tasks."fmt:check"]
description = "Check formatting (CI)"
run = "dprint check"

[tasks."lint:md"]
description = "Lint Markdown files (includes SKILL.md validation)"
run = "markdownlint-cli2 '**/*.md' '#node_modules' '#.git'"

[tasks."lint:md:fix"]
description = "Lint Markdown files (includes SKILL.md validation)"
run = "markdownlint-cli2 '**/*.md' '#node_modules' --fix"

[tasks."lint:manifests"]
description = "Validate JSON manifests"
run = [
  "ajv validate -s schemas/marketplace.schema.json -d '.claude-plugin/marketplace.json' --all-errors --errors=text",
  "ajv validate -s schemas/plugin.schema.json -d 'plugins/**/.claude-plugin/plugin.json' --all-errors --errors=text",
  "ajv validate -s schemas/codex-marketplace.schema.json -d '.agents/plugins/marketplace.json' --all-errors --errors=text",
  "ajv validate -s schemas/codex-plugin.schema.json -d 'plugins/**/.codex-plugin/plugin.json' --all-errors --errors=text",
  "ajv validate -s schemas/mcp.schema.json -d 'plugins/**/.mcp.json' --all-errors --errors=text",
]

[tasks."lint:cross-refs"]
description = "Validate cross-references between manifests"
run = "node tools/validate-cross-refs.cjs"

[tasks.lint]
description = "Run all linters"
run = [
    { task = "lint:md" },
    { task = "lint:manifests" },
    { task = "lint:cross-refs"}
]

# =============
# VALIDATION
# =============

[tasks."validate:refs"]
description = "Detect broken links and orphaned reference files"
run = "uv run tools/validate-references.py"

[tasks."validate:size"]
description = "Check SKILL.md sizes and flag extraction candidates"
run = "uv run tools/validate-size.py"

[tasks."validate:urls"]
description = "Check HTTPS URLs in markdown files return 200 (network-dependent, not in build)"
run = "uv run tools/validate-urls.py"

[tasks.validate]
description = "Run all validation checks"
run = [
    { task = "validate:refs" },
    { task = "validate:size" }
]

# =============
# SCAFFOLDING
# =============

[tasks."init:skill"]
description = "Scaffold a new skill directory"
run = "uv run tools/init-skill.py"

# =========
# TESTING
# =========

[tasks."test:python"]
description = "Run Python unit tests with pytest (ephemeral, no repo dependency)"
# `uv run --with pytest` installs pytest into a cached, throwaway env for this
# run only — nothing is added to the repo's declared deps. pytest handles
# discovery/parametrize/fixtures natively. Exit code 5 = "no tests collected",
# which we treat as success so the build never breaks when tests are absent.
run = "uv run --with pytest pytest tools plugins || [ $? -eq 5 ]"

[tasks."test:node"]
description = "Run Node (JS/TS) unit tests when a package.json defines them"
run = "if [ -f package.json ] && grep -q '\"test\"' package.json; then npm test; else echo 'no package.json test script; skipping'; fi"

[tasks.test]
description = "Run unit tests across languages"
run = [
  { task = "test:python" },
  { task = "test:node" },
]

# =========
# SECURITY
# =========

[tasks."security:bandit"]
description = "Run Bandit"
run = [
  "bandit -r . -x ./.tmp,./node_modules",
]

[tasks."security:semgrep"]
description = "Run SemGrepOSS"
# Uses the vendored ruleset (RFC #211): exclusions are baked into the vendored
# file, so no --exclude-rule flags. --config is explicit here for parity with
# CI/pre-commit; SEMGREP_RULES ([env]) covers bare `semgrep` calls too.
run = [
 "semgrep scan --oss-only --verbose --metrics=off --config=tools/semgrep/rules-vendored.yaml --max-log-list-entries=0"
]

[tasks."semgrep:update"]
description = "Refresh the vendored Semgrep ruleset (RFC #211)"
# Re-downloads r/all and rebuilds rules-vendored.yaml (dropping rules marked
# excluded in rules-status.toml); reports new/orphaned rules. Run manually;
# then re-run security:semgrep.
run = "uv run tools/semgrep/rules-update.py"

[tasks."security:checkov"]
description = "Run Checkov"
run = [
  "checkov --quiet --directory . "
]

[tasks."security:gitleaks"]
description = "Run GitLeaks"
# Scan only history reachable from HEAD (the current branch), not every ref in
# the clone. Without --log-opts, gitleaks walks all refs and fails on secrets
# that exist only on other, unmerged branches. Matches the CI scan scope.
run = [
  "gitleaks git --config=.gitleaks.toml --baseline-path=.gitleaks-baseline.json --log-opts=HEAD",
]

[tasks."security:grype"]
description = "Run Grype"
run = [
  "grype ."
]

[tasks."security:zizmor"]
description = "Run zizmor (GitHub Actions static analysis)"
# Runs via `uvx` so no repo dependency is added (same ephemeral pattern as
# tests). Scans .github/ (workflows + actions). ADVISORY for now: the repo has
# pre-existing findings (see #221), so `|| true` keeps this non-blocking until
# that backlog is burned down, after which the `|| true` is removed to gate.
run = [
  "uvx zizmor@1.26.1 --offline .github/ || true",
]

[tasks.security]
description = "Run security scans"
run = [
    { task = "security:bandit" },
    { task = "security:semgrep" },
    { task = "security:gitleaks" },
    { task = "security:checkov" },
    { task = "security:grype" },
    { task = "security:zizmor" },
]

# ===============
# BUILD PROCESS
# ===============

[tasks.build]
description = "Complete build: lint, format, validate, test, security scans"
run = [
    { task = "lint" },
    { task = "fmt:check" },
    { task = "validate" },
    { task = "test" },
    { task = "security"}
]