feat: add lint validation, task registry, and formatting helpers

.github/workflows/dist.yml

@@ -0,0 +1,45 @@
+name: Dist
+
+on:
+  push:
+    branches: [main, master, develop]
+  workflow_dispatch:
+
+jobs:
+  # Rebuild the embedded task-ui bundle from source and commit it back when it
+  # changed. dist/taskui.js is gitignored build output that task/ui/assets.go
+  # embeds via `//go:embed`, so it must be kept in sync with task/ui/src.
+  # Only runs on push (a real branch to push to); the commit is marked
+  # [skip ci] to avoid re-triggering this workflow.
+  task-ui:
+    name: Rebuild task-ui bundle
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Build and commit task-ui bundle
+        env:
+          GH_TOKEN: ${{ secrets.FLANKBOT }}
+        run: |
+          make task-ui
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add -f task/ui/dist/taskui.js
+          if ! git diff --cached --quiet; then
+            git commit -m "chore(embed): rebuild task-ui bundle [skip ci]"
+            git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
+            git push origin HEAD:${{ github.ref_name }}
+          else
+            echo "task-ui bundle unchanged"
+          fi

.github/workflows/gavel.yml

@@ -0,0 +1,98 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master, develop]
+  pull_request:
+    types: [opened, synchronize, reopened]
+  workflow_dispatch:
+
+env:
+  GO_VERSION: "1.26"
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Gavel test
+        uses: flanksource/gavel@main
+        with:
+          args: test
+          comment-header: gavel-test
+          artifact-name: gavel-test-results
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      # The gavel action always injects `--show-passed`, which `gavel lint`
+      # rejects (only `gavel test` accepts it), so run the binary directly.
+      - name: Install gavel
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          curl -fsSL "https://github.com/flanksource/gavel/releases/download/${GAVEL_VERSION}/gavel_linux_amd64.tar.gz" -o /tmp/gavel.tar.gz
+          tar -xzf /tmp/gavel.tar.gz -C /tmp
+          install -m 0755 /tmp/gavel "$HOME/.local/bin/gavel"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+        env:
+          GAVEL_VERSION: v0.0.39
+
+      - name: Gavel lint
+        run: gavel lint --no-progress --no-color
+
+  openapi:
+    name: OpenAPI Integration
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+
+      - name: Run OpenAPI integration tests
+        run: make test:openapi
+        env:
+          CGO_ENABLED: 1

.gitignore

@@ -65,6 +65,8 @@ test-*
 .cache
 *.db
 clicky
+!lint/testdata/src/github.com/flanksource/clicky/
+!lint/testdata/src/github.com/flanksource/clicky/stub.go
 .task
 *.pdf
 *.html
@@ -96,4 +98,8 @@ ginkgo.report
 examples/uber_demo/uber_demo
 .gavel/
 examples/enitity/webapp/dist/
+# Keep a committed placeholder so the //go:embed webapp/dist in main.go always
+# resolves in CI; `pnpm build` overwrites dist/ with the real hashed bundles.
+!examples/enitity/webapp/dist/
+!examples/enitity/webapp/dist/index.html
 examples/enitity/enitity

ai/cache/cache.go

@@ -13,7 +13,12 @@ import (
 
 	"github.com/flanksource/clicky/task"
 	"github.com/flanksource/commons/logger"
-	_ "github.com/mattn/go-sqlite3"
+	// Pure-Go SQLite driver (registers driver name "sqlite") so clicky builds
+	// without CGO. Use modernc.org/sqlite — the same driver gavel's cache
+	// registers — so a binary linking both registers the "sqlite" driver exactly
+	// once. (glebarez/go-sqlite registers the same name from a different package;
+	// mixing the two panics at init with "Register called twice".)
+	_ "modernc.org/sqlite"
 )
 
 var (
@@ -104,7 +109,7 @@ func New(config Config) (*Cache, error) {
 	}
 
 	// Open database
-	db, err := sql.Open("sqlite3", config.DBPath)
+	db, err := sql.Open("sqlite", config.DBPath)
 	if err != nil {
 		return nil, fmt.Errorf("failed to open database: %w", err)
 	}