bborn · bborn · Mar 3, 2026 · Mar 3, 2026 · Mar 3, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main, master]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
@@ -20,7 +23,7 @@ jobs:
           go-version: '1.24'
 
       - name: Run tests
-        run: go test -v -p 1 -count=1 ./...
+        run: go test -v -race -p 1 -count=1 -coverprofile=coverage.out ./...
 
   lint:
     name: Lint
@@ -39,6 +42,24 @@ jobs:
         with:
           version: v2.1.6
 
+  vulncheck:
+    name: Vulnerability Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.24'
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run govulncheck
+        run: govulncheck ./...
+
   build:
     name: Build
     runs-on: ubuntu-latest

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -10,43 +10,23 @@ permissions:
 
 jobs:
   release:
-    name: Build and Release
+    name: Release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version: '1.24'
 
-      - name: Get version from tag
-        id: version
-        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
-
-      - name: Build binaries
-        run: |
-          mkdir -p dist
-          VERSION=${{ steps.version.outputs.VERSION }}
-          LDFLAGS="-s -w -X main.version=${VERSION}"
-
-          # Build ty CLI for all platforms
-          GOOS=darwin GOARCH=amd64 go build -ldflags="${LDFLAGS}" -o dist/ty-darwin-amd64 ./cmd/task
-          GOOS=darwin GOARCH=arm64 go build -ldflags="${LDFLAGS}" -o dist/ty-darwin-arm64 ./cmd/task
-          GOOS=linux GOARCH=amd64 go build -ldflags="${LDFLAGS}" -o dist/ty-linux-amd64 ./cmd/task
-          GOOS=linux GOARCH=arm64 go build -ldflags="${LDFLAGS}" -o dist/ty-linux-arm64 ./cmd/task
-
-          # Build taskd daemon for Linux only
-          GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o dist/taskd-linux-amd64 ./cmd/taskd
-          GOOS=linux GOARCH=arm64 go build -ldflags="-s -w" -o dist/taskd-linux-arm64 ./cmd/taskd
-
-      - name: Create Release
-        uses: softprops/action-gh-release@v2
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
         with:
-          files: dist/*
-          generate_release_notes: true
-          draft: false
-          prerelease: ${{ contains(github.ref, '-rc') || contains(github.ref, '-beta') || contains(github.ref, '-alpha') }}
+          version: "~> v2"
+          args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitignore b/.gitignore
@@ -30,9 +30,12 @@ bin/
 *.out
 .task-worktrees
 
-# Build output
+# Build / release output
 /task
 /taskd
+dist/
+coverage.out
+coverage.html
 
 # Database
 *.db

diff --git a/.golangci.yml b/.golangci.yml
@@ -1,5 +1,11 @@
 version: "2"
 linters:
+  enable:
+    - gosec
+    - misspell
+    - bodyclose
+    - unconvert
+    - errname
   disable:
     - errcheck
   settings:
@@ -17,6 +23,16 @@ linters:
       - common-false-positives
       - legacy
       - std-error-handling
+    rules:
+      - linters: [gosec]
+        text: "G204:"
+      - linters: [gosec]
+        text: "G115:"
+      - linters: [gosec]
+        text: "G306:"
+      - linters: [staticcheck]
+        text: "SA5011"
+        path: "_test\\.go"
     paths:
       - third_party$
       - builtin$
@@ -25,6 +41,12 @@ issues:
   max-issues-per-linter: 0
   max-same-issues: 0
 formatters:
+  enable:
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/bborn/workflow
   exclusions:
     generated: lax
     paths:

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
@@ -0,0 +1,58 @@
+version: 2
+
+builds:
+  - id: ty
+    main: ./cmd/task
+    binary: ty
+    ldflags:
+      - -s -w -X main.version={{.Version}}
+    goos:
+      - darwin
+      - linux
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    ignore:
+      - goos: windows
+        goarch: arm64
+
+  - id: taskd
+    main: ./cmd/taskd
+    binary: taskd
+    # taskd is a daemon — no Windows build
+    ldflags:
+      - -s -w -X main.version={{.Version}}
+    goos:
+      - darwin
+      - linux
+    goarch:
+      - amd64
+      - arm64
+
+archives:
+  - id: ty
+    builds:
+      - ty
+    format: tar.gz
+    format_overrides:
+      - goos: windows
+        format: zip
+    name_template: "ty_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+
+  - id: taskd
+    builds:
+      - taskd
+    format: tar.gz
+    name_template: "taskd_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+
+checksum:
+  name_template: "checksums.txt"
+
+changelog:
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+      - "^ci:"
+      - "^Merge"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -0,0 +1,46 @@
+# Contributing to Task You
+
+Thanks for your interest in contributing!
+
+## Development Setup
+
+```bash
+git clone https://github.com/bborn/taskyou
+cd taskyou
+make build
+```
+
+**Prerequisites:** Go 1.24+ (or use `mise install` to set up automatically).
+
+## Common Make Targets
+
+| Target | Description |
+|--------|-------------|
+| `make build` | Build `ty` and `taskd` binaries |
+| `make test` | Run tests with race detector |
+| `make lint` | Run golangci-lint |
+| `make vet` | Run `go vet` |
+| `make vuln` | Run `govulncheck` |
+| `make audit` | Run vet + vuln + lint + test |
+| `make fmt` | Format code |
+| `make coverage` | Generate HTML coverage report |
+
+## Submitting a Pull Request
+
+1. Fork the repo and create your branch from `main`.
+2. Make your changes.
+3. Run `make audit` to verify everything passes.
+4. Open a pull request with a clear description of the change.
+
+## Code Style
+
+- Follow standard Go conventions (`gofmt`, `goimports`).
+- Keep PRs focused — one logical change per PR.
+- Add tests for new functionality.
+
+## Reporting Bugs
+
+Open an issue at [github.com/bborn/taskyou/issues](https://github.com/bborn/taskyou/issues) with:
+- Steps to reproduce
+- Expected vs actual behavior
+- Go version and OS
diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Bruno Born
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/Makefile b/Makefile
@@ -1,4 +1,6 @@
-.PHONY: build build-no-restart install clean test deploy
+.PHONY: build build-no-restart build-ty build-taskd restart-daemon build-linux \
+       install clean test vet vuln audit coverage run daemon \
+       deploy deploy-service deploy-full status logs connect tag fmt lint
 
 # Configuration
 SERVER ?= root@cloud-claude
@@ -8,18 +10,22 @@ REMOTE_DIR ?= /home/runner
 # Allow overriding the Go binary/toolchain (e.g. GO=go1.24.4 or mise exec -- go)
 GO ?= go
 
+# Version from git tag (e.g. v0.2.3 → 0.2.3), falls back to "dev"
+VERSION ?= $(shell git describe --tags --always 2>/dev/null | sed 's/^v//' || echo dev)
+LDFLAGS := -s -w -X main.version=$(VERSION)
+
 # Build all binaries and (optionally) restart daemon if running
 build: build-ty build-taskd restart-daemon
 
 # Build binaries without touching any running daemon
 build-no-restart: build-ty build-taskd
 
 build-ty:
-	$(GO) build -o bin/ty ./cmd/task
+	$(GO) build -ldflags="$(LDFLAGS)" -o bin/ty ./cmd/task
 	ln -sf ty bin/taskyou
 
 build-taskd:
-	$(GO) build -o bin/taskd ./cmd/taskd
+	$(GO) build -ldflags="$(LDFLAGS)" -o bin/taskd ./cmd/taskd
 
 # Restart daemon if it's running (silent if not). Never fail the build if we lack permissions.
 restart-daemon:
@@ -34,21 +40,38 @@ restart-daemon:
 
 # Build for Linux (server deployment)
 build-linux:
-	GOOS=linux GOARCH=amd64 go build -o bin/taskd-linux ./cmd/taskd
+	GOOS=linux GOARCH=amd64 go build -ldflags="$(LDFLAGS)" -o bin/taskd-linux ./cmd/taskd
 
 # Install to GOBIN (usually ~/go/bin) - installs as 'ty', 'taskyou' (symlink), and 'taskd'
 install:
-	go build -o $(shell go env GOBIN)/ty ./cmd/task
+	go build -ldflags="$(LDFLAGS)" -o $(shell go env GOBIN)/ty ./cmd/task
 	ln -sf ty $(shell go env GOBIN)/taskyou
-	go install ./cmd/taskd
+	go build -ldflags="$(LDFLAGS)" -o $(shell go env GOBIN)/taskd ./cmd/taskd
 
 # Clean build artifacts
 clean:
-	rm -rf bin/
+	rm -rf bin/ dist/
 
-# Run tests
+# Run tests with race detector
 test:
-	go test ./...
+	go test -race ./...
+
+# Run go vet
+vet:
+	go vet ./...
+
+# Run govulncheck
+vuln:
+	govulncheck ./...
+
+# Run all checks: vet, vuln, lint, test
+audit: vet vuln lint test
+
+# Generate HTML coverage report
+coverage:
+	go test -race -coverprofile=coverage.out ./...
+	go tool cover -html=coverage.out -o coverage.html
+	@echo "Coverage report: coverage.html"
 
 # Run the TUI locally (ty command)
 run:
@@ -102,15 +125,6 @@ endif
 	@echo "Done! GitHub Actions will build and publish the release."
 	@echo "View at: https://github.com/bborn/taskyou/releases/tag/$(VERSION)"
 
-# Build for release (all platforms)
-release:
-	GOOS=darwin GOARCH=amd64 go build -ldflags="-s -w" -o bin/ty-darwin-amd64 ./cmd/task
-	GOOS=darwin GOARCH=arm64 go build -ldflags="-s -w" -o bin/ty-darwin-arm64 ./cmd/task
-	GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o bin/ty-linux-amd64 ./cmd/task
-	GOOS=linux GOARCH=arm64 go build -ldflags="-s -w" -o bin/ty-linux-arm64 ./cmd/task
-	GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o bin/taskd-linux-amd64 ./cmd/taskd
-	GOOS=linux GOARCH=arm64 go build -ldflags="-s -w" -o bin/taskd-linux-arm64 ./cmd/taskd
-
 # Format code
 fmt:
 	go fmt ./...

diff --git a/README.md b/README.md
@@ -1,3 +1,7 @@
+[![CI](https://github.com/bborn/taskyou/actions/workflows/ci.yml/badge.svg)](https://github.com/bborn/taskyou/actions/workflows/ci.yml)
+[![Go Reference](https://pkg.go.dev/badge/github.com/bborn/workflow.svg)](https://pkg.go.dev/github.com/bborn/workflow)
+[![Go Report Card](https://goreportcard.com/badge/github.com/bborn/workflow)](https://goreportcard.com/report/github.com/bborn/workflow)
+
 # Task You
 
 A personal task management system with a beautiful terminal UI, SQLite storage, and background task execution via pluggable AI agents (Claude Code, OpenAI Codex, Gemini, Pi, OpenClaw, or OpenCode).