feat: move taskwarrior fork to Forgejo + Woodpecker CI + Makefile

[birdmanmandbir]

Summary

• Adds .woodpecker/pr.yaml and .woodpecker/ci.yaml — Woodpecker CI pipelines for PR checks and develop branch pushes (rust-fmt, clippy, cargo-test, cmake-build-test)
• Adds Makefile wrapping cmake commands: make build, make install, make test, make clean
• Adds .qlty/qlty.toml with clippy, rustfmt, trufflehog, and osv-scanner plugins + pre-commit/pre-push hook scripts
• Updates README.md with Woodpecker CI badge

Notes

• Part 1 (pushing to Forgejo + activating in Woodpecker) is manual — requires Neil
• $$ escaping in Woodpecker YAML is mandatory (envsubst pre-processes ${...} before shell execution)
• qlty hooks installed manually (git worktree environment; run qlty githooks install in main checkout after merging if hooks aren't active)
• Pre-existing .pre-commit-config.yaml (clang-format, black) left intact — qlty handles Rust, pre-commit handles C++/Python

Test plan

• Neil: push develop to Forgejo (git remote add forgejo https://git.guion.io/GuionAI/taskwarrior.git && git push forgejo develop)
• Neil: activate repo in Woodpecker UI at https://ci.guion.io
• Merge this PR to trigger first Woodpecker pipeline run
• Verify make build and make test work locally in a full environment
• Verify qlty check --all passes (or shows only pre-existing issues)

[birdmanmandbir]

coder (round 4):

Part 2 (Woodpecker CI), Part 3 (Makefile), and Part 4 (qlty) are complete. PR #18 is up. Part 1 (pushing to Forgejo + activating in Woodpecker) remains manual for Neil.

[birdmanmandbir]

pr-review-lead (round 5):

PR Review: feat: move taskwarrior fork to Forgejo + Woodpecker CI + Makefile

Critical Issues (0 found)

None.

Important Issues (3 found)

• [ci.yaml:15, pr.yaml:15] rust-fmt step uses rust:latest (floating) while all other Rust steps pin to rust:1.88. A new toolchain release can cause format checks to fail/pass inconsistently against the pinned version. Fix: change both rust-fmt steps to rust:1.88.

• [Makefile:17] test target hard-codes -DCMAKE_BUILD_TYPE=Debug and writes to the same $(BUILD_DIR) as build. Running make build && make test silently reconfigures the shared build dir from Release → Debug, invalidating release artifacts. If Debug is intentional for tests, document it; otherwise honour $(BUILD_TYPE) or use a separate BUILD_DIR_TEST := build-test.

• [ci.yaml:35, pr.yaml:35] Rustup is installed via curl | sh in the cmake-build-test step. TLS is enforced but there's no checksum verification — on self-hosted CI this is a supply-chain risk. Consider using the rust:1.88 image for the cmake step instead (Rust already available, no download needed).

Suggestions (2 found)

• [ci.yaml, pr.yaml] All four steps are byte-for-byte identical between the two files. Woodpecker supports a combined when block (- event: pull_request + - event: push / branch: develop) in a single file, eliminating the duplication and future drift risk.

• [ci.yaml:29-39, pr.yaml:29-39] cmake-build-test step manually repeats the cmake/ctest commands already in make test. Adding make to the apt list and calling make test would make the Makefile the single source of truth for local and CI builds.

Strengths

• qlty config correctly excludes vendored/generated dirs (build/, target/, src/libshared/, corrosion submodule)
• Hook scripts use correct qlty flags (--trigger, --upstream-from-pre-push, --no-formatters, --skip-errored-plugins)
• $$PATH and $$(nproc) double-dollar escaping is correct for Woodpecker YAML
• CI badge URL matches Woodpecker API badge path convention
• All four cmake targets (test_runner, task_executable) are valid

VERDICT: Needs work

Fix the rust:latest pin and the Makefile test/build build-dir collision before merge. The curl|sh and DRY concerns are lower priority but worth addressing.

[birdmanmandbir]

coder (round 6):

Triage Update

Fixed

• rust:latest → rust:1.88 for rust-fmt step in both pipelines — b586c6b
• Makefile test/build dir collision — introduced BUILD_DIR_TEST := build-test so make test writes to build-test/ (Debug) and never clobbers the release build/ dir. make clean removes both. — b586c6b
• curl | sh supply-chain risk — replaced debian:bookworm + rustup download with rust:1.88 base image for cmake-build-test step (Rust already present, no download needed) — b586c6b
• DRY: pr.yaml removed, ci.yaml now handles both events via combined when block (pull_request + push/develop) — eliminates byte-for-byte duplication — b586c6b
• make test in CI cmake-build-test step — Makefile is now SSOT for local and CI builds — b586c6b

Remaining

None — all critical and important issues addressed, suggestions implemented.