Declare deno task execute-with-permissions task specifying all the permissions actually needed and alias all other tasks through that

Also add `migrate-db` task to the Deno configuration and use that in the
`Makefile`, so that the Makefile is fully optional, and swap the meanings of
the `start` and `preview` tasks, so that `start` is for production while
`preview` is for development.

Dockerfile

@@ -20,4 +20,4 @@ USER deno
 # Compile the main app so that it doesn't need to be compiled each startup/entry.
 RUN deno cache --reload main.ts
 
-CMD ["run", "--allow-all", "main.ts"]
+CMD ["task", "start"]

Makefile

@@ -1,8 +1,8 @@
 SHELL := /bin/bash
 
-.PHONY: start
-start:
-	deno task start
+.PHONY: preview
+preview:
+	deno task preview
 
 .PHONY: format
 format:
@@ -19,7 +19,7 @@ build:
 
 .PHONY: migrate-db
 migrate-db:
-	deno run --allow-net --allow-read --allow-env migrate-db.ts
+	deno task migrate-db
 
 .PHONY: exec-db
 exec-db:

README.md

@@ -72,7 +72,7 @@ These are the amazing entities or individuals who are sponsoring this project fo
 ```sh
 docker compose -f docker-compose.dev.yml up # (optional) runs docker with postgres, locally
 make migrate-db # runs any missing database migrations
-make start # runs the app
+make preview # runs the app in development mode
 make format # (optional) formats the code (if you're interested in contributing)
 make test # (optional) runs tests (if you're interested in contributing)
 ```

deno.json

@@ -1,13 +1,17 @@
 {
   "lock": true,
   "tasks": {
+    "execute-with-permissions": "deno run --allow-env --allow-net --allow-sys=networkInterfaces,hostname --allow-read=. --allow-write=data-files",
     "check": "deno fmt --check && deno lint && deno check .",
     "cli": "echo \"import '\\$fresh/src/dev/cli.ts'\" | deno run --unstable -A -",
     "manifest": "deno task cli manifest $(pwd)",
-    "start": "deno run -A --watch=static/,routes/,lib/,components/,islands/ dev.ts",
-    "build": "deno run -A dev.ts build",
-    "preview": "deno run -A main.ts",
-    "test": "deno test -A --check"
+
+    "build": "deno task execute-with-permissions ./dev.ts build",
+    "preview": "deno task execute-with-permissions --watch=static/,routes/,lib/,components/,islands/ ./dev.ts",
+    "test": "deno test -A --check",
+
+    "migrate-db": "deno task execute-with-permissions ./migrate-db.ts",
+    "start": "deno task execute-with-permissions ./main.ts"
   },
   "fmt": {
     "useTabs": false,