.mise.toml

experimental_monorepo_root = true

[env]
FIG_IDENTITY = "${FIG_IDENTITY:-namjul}"
SOPS_AGE_KEY_FILE = "{{env.HOME}}/.config/age/key.txt"
MISE_AGE_KEY_FILE = "{{env.HOME}}/.config/age/key.txt"

[monorepo]
config_roots = [
  "aspects/*",
]

[settings]
sops.rops = false
experimental = true
env_shell_expand = true

[tools]
sops = "3.13.0"
age = "1.3.1"
deno = "2.8.0"
gomplate = "5.0.0"
fnox = "1.21.0"

[tasks."fig:test"]
description = "Run fig tests"
run = "deno test -A"

[tasks."fig:lint"]
description = "Lint fig modules"
run = "deno lint fig/"

[tasks."fig:check"]
description = "Type-check fig modules"
run = "deno check fig"

[tasks."fig:format"]
description = "Type-check fig modules"
run = "deno fmt fig"

[tasks."fig:verify"]
description = "Run fig check, lint, and tests"
depends = ["fig:check", "fig:lint", "fig:test"]

[tasks."fig"]
description = "Run all fig:* tasks"
depends = ["fig:*"]

[tasks."aspects:setup"]
description = "One-time machine bootstrap: verify age key exists at canonical location"
run = """
#!/usr/bin/env bash
AGE_KEY="${HOME}/.config/age/key.txt"
if [[ -f "$AGE_KEY" ]]; then
  echo "age key found: $AGE_KEY"
else
  echo "missing: $AGE_KEY — place your age identity file there"
  exit 1
fi
"""

[tasks."arch:test-container"]
description = "Start ephemeral Arch test container with dotfiles bind-mounted"
run = """
sudo systemd-nspawn \
  --ephemeral \
  --bind=$HOME/.dotfiles:/root/.dotfiles \
  --bind-ro=$HOME/.config/age/key.txt:/root/.config/age/key.txt \
  --bind-ro=$HOME/fnox.local.toml:/root/fnox.local.toml \
  --bind-ro=/dev/null:/run/fig-test-container \
  -bD /var/lib/machines/arch
"""

[tasks."aspects:check"]
description = "Type-check fig modules"
run = "deno check aspects/**/*.ts"

[tasks."encrypt"]
description = "Encrypt a file with sops+age, writing <file>.encrypted"
usage = 'arg "<file>" help="Plaintext file to encrypt"'
run = """
#!/usr/bin/env bash
set -euo pipefail
PLAINTEXT="${usage_file?}"
CIPHERTEXT="${PLAINTEXT}.encrypted"
sops --encrypt --output "$CIPHERTEXT" "$PLAINTEXT"
"""

[tasks."decrypt"]
description = "Decrypt a <file>.encrypted sops file to its plaintext path"
usage = 'arg "<file>" help="Encrypted .encrypted file to decrypt"'
run = """
#!/usr/bin/env bash
set -euo pipefail
CIPHERTEXT="${usage_file?}"
PLAINTEXT="${CIPHERTEXT%.encrypted}"
sops --decrypt --filename-override "$PLAINTEXT" --output "$PLAINTEXT" "$CIPHERTEXT"
"""