Repository navigation
Expand file tree
/
Copy pathmise.toml
More file actions
151 lines (122 loc) · 4.82 KB
/
Copy pathmise.toml
File metadata and controls
151 lines (122 loc) · 4.82 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
# https://mise.jdx.dev
# Canonical task vocabulary shared by git hooks (lefthook) and CI (GitHub Actions).
[env]
_.source = ".env"
[settings.task]
run_auto_install = false
[tools]
"aqua:rhysd/actionlint" = "1.7.12"
"aqua:dprint/dprint" = "0.63.0"
"aqua:gitleaks/gitleaks" = "8.30.1"
"aqua:evilmartians/lefthook" = "2.2.1"
"aqua:lycheeverse/lychee" = "0.24.2"
# Python 3.14 is the tested ML stack; qualify NumPy/Numba/SHAP on 3.15 before changing the course runtime.
"python" = "3.14.8"
"aqua:aquasecurity/trivy" = "0.75.0"
"aqua:astral-sh/uv" = "0.13.0"
"aqua:zizmorcore/zizmor" = "1.30.1"
# ALL
[tasks.all]
alias = "a"
description = "Format, check, execute examples, and build the site (the canonical gate)"
run = ["mise run format", "mise run check", "mise run test", "mise run build"]
[tasks.test]
description = "Execute the maintained configuration and temporal evaluation labs"
run = [
"uv run --locked examples/configuration.py",
"uv run --locked examples/temporal_evaluation.py",
]
# INSTALL
[tasks.install]
alias = "i"
description = "Install dependencies and git hooks"
depends = ["install:hooks"]
[tasks."install:python"]
description = "Sync dependencies (uv)"
run = "uv sync"
[tasks."install:hooks"]
description = "Install git hooks (lefthook)"
depends = ["install:python"]
run = "lefthook install"
# FORMAT
[tasks.format]
alias = "f"
description = "Format all config and markup files"
depends = ["format:dprint"]
[tasks."format:dprint"]
description = "Format JSON, Markdown, TOML, YAML (dprint)"
# `--allow-no-files` because the pre-commit hook passes staged paths and dprint.jsonc
# excludes `docs/**`: without it, dprint exits 14 on a commit that touches only chapter
# files, which is every content contribution this repository asks for.
run = "dprint fmt --allow-no-files"
# CHECK
[tasks.check]
alias = "c"
description = "Run all checks in parallel"
depends = [
"check:actions",
"check:build",
"check:format",
"check:leaks",
"check:scan",
"check:vuln",
]
[tasks."check:actions"]
description = "Lint and audit GitHub Actions workflows (actionlint + zizmor)"
run = ["actionlint", "zizmor --offline .github/workflows/"]
[tasks."check:build"]
description = "Build the site in strict mode to catch broken links and config"
run = "uv run --locked zensical build --clean --strict"
[tasks."check:links"]
description = "Check external links in the README and every chapter (lychee)"
# Deliberately NOT in `check`. It takes minutes, hits ~700 external URLs, and most of
# what it reports is other people's rate limiting: a full run found 63 failures, of which
# 37 were HTTP 429 and 14 were bot-blocking 403s against only 9 genuinely dead links.
# Wiring that into the commit gate would train everyone to ignore a red check. It runs
# monthly and on demand from `.github/workflows/links.yml` instead, where a human reads it.
# 429 is accepted on purpose: a host that rate-limits a scanner is a host that is up, so
# treating it as a failure would report the opposite of what the check exists to find.
# Per-host pacing and slower retries keep bursts off hosts such as docs.python.org, which
# answered the 2026-10-01 CI run with 16 transient 503s while every link passed locally.
run = "lychee --no-progress --max-concurrency 8 --host-concurrency 2 --host-request-interval 250ms --max-retries 3 --retry-wait-time 5 --timeout 20 --accept 200..=299,429 README.md AGENTS.md 'docs/**/*.md'"
[tasks."check:format"]
description = "Check formatting and config validity"
run = [
"uv run validate-pyproject pyproject.toml",
"dprint check",
"uv lock --check",
]
[tasks."check:leaks"]
description = "Audit for leaked secrets (gitleaks)"
run = 'gitleaks git --log-opts="--max-count=100" --redact=100 --verbose'
[tasks."check:scan"]
description = "Scan the checkout for misconfigurations, secrets, and licenses (trivy)"
# `--config` is explicit on purpose: without it a `TRIVY_CONFIG` exported in the user's
# shell silently wins over the policy committed here, and the repository's own rules
# never run. `fs` (not `config`) is what actually enables every scanner in trivy.yaml.
run = "trivy --config trivy.yaml fs ."
[tasks."check:vuln"]
description = "Scan dependencies for vulnerabilities (pip-audit)"
run = "uv run pip-audit --skip-editable --cache-dir .cache/pip-audit"
# BUILD
[tasks.build]
alias = "b"
description = "Build the documentation site"
run = "uv run --locked zensical build --clean --strict"
# UTILITIES
[tasks.serve]
alias = "s"
description = "Serve the documentation with live reload"
run = "uv run --locked zensical serve -a 127.0.0.1:8000"
[tasks.watch]
alias = "w"
description = "Serve the documentation with live reload"
depends = ["serve"]
[tasks.upgrade]
alias = "u"
description = "Upgrade dependencies to the latest compatible versions"
run = "uv sync --upgrade"
[tasks.clean]
alias = "n"
description = "Remove caches and the built site"
run = "rm -rf .cache site"