mise.toml

min_version = "2026.5.0"
experimental_monorepo_root = true

# Redact sensitive values from `mise run` output (see https://mise.jdx.dev/environments/#redactions).
redactions = [
  "DATABASE_URL",
  "R2_ACCESS_KEY_ID",
  "R2_SECRET_ACCESS_KEY",
  "GOOGLE_CLIENT_ID",
  "GOOGLE_CLIENT_SECRET",
  "DISCORD_CLIENT_ID",
  "DISCORD_CLIENT_SECRET",
  "RESEND_API_KEY",
  "VITE_SENTRY_DSN_FRONTEND",
  "SENTRY_DSN_API",
  "SENTRY_AUTH_TOKEN",
  "LOCAL_CLOUDFLARE_API_TOKEN",
  "CLOUDFLARE_MASTER_TOKEN",
  "*_SECRET",
  "*_TOKEN",
  "*_DSN",
]

[settings]
experimental = true
task_output = "quiet"

[tools]
node = "24.16.0"
pnpm = "11.5.2"
# Graphite stacked PRs (`gt` via mise tool alias)
gt = "1.8.6"
# this is needed for tab completions of mise tasks and some other binaries
usage = "3.4.0"
hk = "1.46.0"
pkl = "0.31.1"

[tool_alias]
gt = "npm:@withgraphite/graphite-cli"

[monorepo]
config_roots = ["apps/*", "packages/*"]

# this doesn't use the builtin pnpm provider because it doesn't allow overriding `sources`
[deps.pnpm-custom]
auto = true
sources = [
  "package.json",
  "apps/*/package.json",
  "packages/*/package.json",
  "pnpm-lock.yaml",
  "pnpm-workspace.yaml",
]
outputs = ["node_modules/"]
description = "Install dependencies with pnpm"
run = 'pnpm install'

[env]
HK_MISE = "1"
HK_HIDE_WHEN_DONE = "true"
MISE_EXPERIMENTAL = "1"
_.file = { path = ".env", redact = true }
_.path = [
  "{{config_root}}/node_modules/.bin",
  "{{config_root}}/apps/frontend/node_modules/.bin",
  "{{config_root}}/apps/api/node_modules/.bin",
  "{{config_root}}/apps/preview-gateway/node_modules/.bin",
]

[hooks]
postinstall = ["hk install --mise"]

[shell_alias]
mr = 'mise tasks run '
mi = 'mise install '

[tasks.lint]
quiet = true
alias = "lint"
description = "Lint the entire repo"
usage = '''
arg "[paths]" var=#true help="The paths to lint" default="."

flag "-f --fix" help="Apply safe fixes"
flag "--fix-suggestions" help="Apply auto-fixable suggestions. May change program behaviour"
flag "--fix-dangerously" help="Apply dangerous fixes and suggestions"
flag "-q --quiet" help="Run in quiet mode, which only outputs errors"
flag "--format <FORMAT>" help="The format to output the results in" default="stylish" {
  choices "checkstyle" "default" "github" "gitlab" "json" "junit" "stylish" "unix"
}
'''

# in oxlint, the `--allow all` means to suppress the lint for all rules,
# and the `--deny <rule>` means to emit an error for that rule
run = 'oxlint --config=./oxlint.config.ts --format={{usage.format}} {% if usage.fix %}--fix {% endif %}{% if usage.fix_suggestions %}--fix-suggestions {% endif %}{% if usage.fix_dangerously %}--fix-dangerously {% endif %}{% if usage.quiet %}--quiet {% endif %}{% for path in usage.paths %}{{path}} {% endfor %}'

[tasks.format]
description = "Format the entire repo"
usage = '''
arg "[paths]" var=#true help="The paths to lint" default="."

flag "-c --check" help="Check if the files are formatted"
flag "-l --list-different" help="List files that are different from the expected format"
'''
alias = ["fmt", "format"]
run = 'oxfmt {% if usage.check %}--check {% endif %} {% if usage.list_different %}--list-different {% endif %} {% for path in usage.paths %}{{path}} {% endfor %}'

[tasks.unit]
alias = ["test:unit", "test"]
description = "Run Vitest for this workspace"
usage = '''
arg "[filters]" var=#true help="Test file filters"

flag "-w --watch" negate="--no-watch" help="Re-run tests when files change" default="false"
flag "--coverage" negate="--no-coverage" help="Collect coverage" default="false"
flag "-p --project <name>" help="Vitest project to run"
flag "-u --update" help="Update snapshots"
flag "--ui" help="Enable Vitest UI"
flag "--open" help="Open Vitest UI automatically"
'''

run = 'vitest run --root="." --config="vitest.config.ts" {% if usage.project %} --project="{{usage.project}}" {% endif %} {% if usage.coverage %} --coverage {% endif %} {% if usage.watch %} --watch {% endif %} {% if usage.update %}--update {% endif %} {% if usage.ui %}--ui {% endif %} {% if usage.open %}--open {% endif %} {% for f in usage.filters %}{{f}} {% endfor %}'

[tasks.dev]
alias = 'dev'
description = "Start the frontend and API dev servers"
depends = ["//apps/frontend:dev", "//apps/api:dev"]

[tasks."tunnel:create"]
description = "Create the local cloudflared tunnel and DNS route (run once; requires cloudflared login)"
tools.cloudflared = "2026.5.1"
alias = 'tunnel:create'
run = '''
set -euo pipefail
TUNNEL_NAME="${TUNNEL_NAME:-boulder-best-local}"
TUNNEL_HOSTNAME="${TUNNEL_HOSTNAME:-local.boulder.best}"
TUNNEL_DIR="infra/cloudflared"
CREDENTIALS="$PWD/$TUNNEL_DIR/credentials.json"
CONFIG="$PWD/$TUNNEL_DIR/config.yml"

mkdir -p "$TUNNEL_DIR"
cloudflared tunnel create "$TUNNEL_NAME" || true

if [ -z "${TUNNEL_ID:-}" ]; then
  TUNNEL_ID="$(cloudflared tunnel list -n "$TUNNEL_NAME" -o json | grep -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | head -1)"
fi
test -n "$TUNNEL_ID"

cp "$HOME/.cloudflared/${TUNNEL_ID}.json" "$CREDENTIALS"

cat > "$CONFIG" <<EOF
tunnel: $TUNNEL_NAME
credentials-file: $CREDENTIALS

ingress:
  - hostname: $TUNNEL_HOSTNAME
    service: http://localhost:5173
  - service: http_status:404
EOF

cloudflared tunnel route dns "$TUNNEL_NAME" "$TUNNEL_HOSTNAME" || true
echo "https://$TUNNEL_HOSTNAME — run: mise run dev:tunnel"
'''

[tasks."tunnel:run"]
description = "Run cloudflared for local.boulder.best → Vite :5173"
tools.cloudflared = "2026.5.1"
run = '''
test -f infra/cloudflared/config.yml || {
  echo "Missing infra/cloudflared/config.yml — run: mise run tunnel:create" >&2
  exit 1
}
cloudflared tunnel --config infra/cloudflared/config.yml run
'''

[tasks."dev:tunnel"]
alias = ["dev-tunnel"]
description = "Start frontend, API (tunnel env), and cloudflared (run tunnel:create first)"
depends = [
  "//apps/frontend:dev:tunnel",
  "//apps/api:dev --env tunnel",
  "tunnel:run",
]

[tasks.typecheck]
alias = 'tsc'
description = "Typecheck all workspace projects"
run = "tsc -b"

[tasks.build]
alias = 'build'
description = "Build all workspace projects"
depends = ["//...:build"]

[tasks.checks]
alias = 'checks'
description = "Run all checks for the workspace"
depends = ["lint", "format", "typecheck"]

# Sync repo root `.env` to GitHub Actions and the production API Worker.
# GitHub: CLOUDFLARE_* (incl. CLOUDFLARE_ZONE_ID for R2 custom domain), DATABASE_URL, Sentry.
# Worker: DATABASE_URL, auth/OAuth, R2 keys, SENTRY_DSN_API (secrets:sync:cloudflare).
# Requires GITHUB_TOKEN or `gh auth login` (GitHub) and LOCAL_CLOUDFLARE_API_TOKEN (Cloudflare).

[tasks."secrets:sync"]
description = "Push .env to GitHub Actions (incl. CLOUDFLARE_ZONE_ID) and production API Worker secrets"
depends = ["secrets:sync:github", "secrets:sync:cloudflare"]

[tasks."secrets:sync:github"]
description = "Push GitHub Actions secrets from .env (LOCAL_CLOUDFLARE_API_TOKEN → CLOUDFLARE_API_TOKEN in GH, plus account/zone/DB/Sentry)"
run = 'node scripts/secrets-sync-github.ts'

# Create deploy + R2 S3 credentials via API (CLOUDFLARE_MASTER_TOKEN in .env.secret).
# Prints LOCAL_CLOUDFLARE_API_TOKEN and R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY for .env.

[tasks."cloudflare:token:create"]
description = "Create LOCAL_CLOUDFLARE_API_TOKEN and R2 S3 credentials via API (CLOUDFLARE_MASTER_TOKEN in .env.secret)"
# raw bypasses mise output redaction so one-time token values (incl. R2_ACCOUNT_ID) are visible.
raw = true
run = 'node scripts/cloudflare-create-api-token.ts'
env.'_'.file = { path = ".env.secret", redact = true }

[tasks."secrets:sync:cloudflare"]
description = "Push production API Worker secrets to Cloudflare from .env"
run = 'node scripts/secrets-sync-cloudflare.ts'


[tasks.wrangler-whois-token]
description = "Verify the LOCAL_CLOUDFLARE_API_TOKEN is valid"
env.CLOUDFLARE_API_TOKEN = "{{ env.LOCAL_CLOUDFLARE_API_TOKEN }}"
run = 'wrangler whoami'