Taskfile.yml

version: '3'

# Task targets for the CryptOS-PKI cryptos-node module.
# Requires on PATH: go, golangci-lint, golic, buf. The Go codegen plugins are
# not taken from PATH: `task tools` installs them at the versions pinned below
# into .bin/, and buf.gen.yaml runs them from there, so every machine
# generates the same bytes.

vars:
  # Bump a pin, then run `task generate` and commit the regenerated tree in the
  # same change.
  PROTOC_GEN_GO_VERSION: v1.34.2
  PROTOC_GEN_GO_GRPC_VERSION: v1.5.1
  # The Go toolchain that builds the plugins is pinned too: protoc-gen-go
  # formats its output with the go/format it was compiled with, so a newer Go
  # can change the generated bytes. Kept at the go directive in go.mod.
  PLUGIN_GO_TOOLCHAIN: go1.26.8
  TOOLS_BIN: '{{.ROOT_DIR}}/.bin'
  # The baseline `buf breaking` compares against. Override it to compare
  # against another ref, for example BREAKING_AGAINST='.git#branch=origin/main'.
  BREAKING_AGAINST: 'https://github.com/CryptOS-PKI/cryptos-node.git#branch=main'

tasks:
  default:
    desc: Show available tasks
    cmds:
      - task --list

  fmt:
    desc: Format Go sources
    cmds:
      - gofmt -w cmd internal

  lint:
    desc: Run golangci-lint
    cmds:
      - golangci-lint run ./...

  vet:
    desc: Run go vet
    cmds:
      - go vet ./...

  test:
    desc: Run unit tests
    cmds:
      - go test ./...

  build:
    desc: Build the init, cryptosctl, and cryptos-install binaries to bin/ (build identity stamped)
    vars:
      # Version/commit/build date for internal/buildinfo; see scripts/buildinfo.sh.
      BUILDINFO:
        sh: bash scripts/buildinfo.sh
    cmds:
      - go build -ldflags "{{.BUILDINFO}}" -o bin/init ./cmd/init
      - go build -ldflags "{{.BUILDINFO}}" -o bin/cryptosctl ./cmd/cryptosctl
      - go build -ldflags "{{.BUILDINFO}}" -o bin/cryptos-install ./cmd/cryptos-install

  proto:fmt:
    desc: Format the node API protos
    cmds:
      - buf format -w

  proto:lint:
    desc: Lint the node API protos and check their formatting
    cmds:
      - buf lint
      - buf format -d --exit-code

  proto:breaking:
    desc: Check the node API protos for breaking changes against main (BREAKING_AGAINST overrides)
    cmds:
      - buf breaking --against '{{.BREAKING_AGAINST}}'

  tools:
    desc: Install the pinned Go codegen plugins into .bin/
    # status reads the Go version and module version stamped into each binary,
    # so a .bin/ left over from an older pin gets reinstalled instead of
    # silently reused.
    status:
      - go version {{.TOOLS_BIN}}/protoc-gen-go {{.TOOLS_BIN}}/protoc-gen-go-grpc | awk '$2 != "{{.PLUGIN_GO_TOOLCHAIN}}" {bad=1} END {exit bad || NR != 2}'
      - go version -m {{.TOOLS_BIN}}/protoc-gen-go | grep -qE '^[[:space:]]+mod[[:space:]]+google.golang.org/protobuf[[:space:]]+{{.PROTOC_GEN_GO_VERSION}}[[:space:]]'
      - go version -m {{.TOOLS_BIN}}/protoc-gen-go-grpc | grep -qE '^[[:space:]]+mod[[:space:]]+google.golang.org/grpc/cmd/protoc-gen-go-grpc[[:space:]]+{{.PROTOC_GEN_GO_GRPC_VERSION}}[[:space:]]'
    # GOBIN and GOTOOLCHAIN are set on each command, not in an env: block,
    # because Task lets an exported shell variable win over env:.
    cmds:
      - GOBIN='{{.TOOLS_BIN}}' GOTOOLCHAIN={{.PLUGIN_GO_TOOLCHAIN}} go install google.golang.org/protobuf/cmd/protoc-gen-go@{{.PROTOC_GEN_GO_VERSION}}
      - GOBIN='{{.TOOLS_BIN}}' GOTOOLCHAIN={{.PLUGIN_GO_TOOLCHAIN}} go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@{{.PROTOC_GEN_GO_GRPC_VERSION}}

  generate:
    desc: Generate the Go stubs under gen/go from the protos with the pinned plugins
    deps: [tools]
    cmds:
      - buf generate

  generate:verify:
    desc: Generate and assert the committed gen/ tree is current
    # git status rather than git diff, so a generated file that is new counts
    # as stale too instead of passing as untracked.
    cmds:
      - task: generate
      - |
        stale="$(git status --porcelain gen/)"
        if [ -n "$stale" ]; then
          echo "Generated output is out of date. Run 'task generate' and commit the result." >&2
          echo "$stale" >&2
          git --no-pager diff gen/ >&2
          exit 1
        fi

  tidy:
    desc: Tidy the Go module
    cmds:
      - go mod tidy

  license:
    desc: Verify every source file carries the Apache 2.0 license header and LICENSE is the verbatim Apache 2.0 text (CI; never writes).
    cmds:
      - go install github.com/Bugs5382/golic/cmd/golic@v1.2.0
      - golic inject -t apache2 -c "The CryptOS Authors." --license-file --dry -x
  license:fix:
    desc: Inject the Apache 2.0 header into any source file missing it and rewrite LICENSE to the verbatim Apache 2.0 text.
    cmds:
      - go install github.com/Bugs5382/golic/cmd/golic@v1.2.0
      - golic inject -t apache2 -c "The CryptOS Authors." --license-file

  ci:
    desc: Full local validation chain (fmt + proto lint + generate-and-verify + lint + vet + test + build)
    cmds:
      - task: fmt
      - task: proto:lint
      - task: generate:verify
      - task: lint
      - task: vet
      - task: test
      - task: build

  e2e:kind:
    desc: "[Linux] cert-manager in a kind cluster enrols over ACME with an in-process Intermediate (needs docker; skips without it)"
    cmds:
      - bash test/kind/run.sh