Taskfile.yml

# Copyright AGNTCY Contributors (https://github.com/agntcy)
# SPDX-License-Identifier: Apache-2.0

version: "3"

vars:
  # renovate: datasource=github-releases depName=agntcy/dir versioning=semver
  DIR_CHART_VERSION: '{{ .DIR_CHART_VERSION | default "v1.8.0" }}'
  # renovate: datasource=github-releases depName=agntcy/dir versioning=semver
  DIR_IMAGE_TAG: '{{ .DIR_IMAGE_TAG | default "v1.8.0" }}'
  # renovate: datasource=github-releases depName=agntcy/dir versioning=semver
  DIRCTL_IMAGE_TAG: '{{ .DIRCTL_IMAGE_TAG | default "v1.8.0" }}'

  # renovate: datasource=github-releases depName=renovatebot/renovate versioning=semver
  RENOVATE_VERSION: "44.141.0"

  BIN_DIR: "{{ .ROOT_DIR }}/.bin"

  # renovate: datasource=github-tags depName=helm/helm versioning=semver
  HELM_VERSION: "4.3.0"
  HELM_BIN: "{{ .BIN_DIR }}/helm-{{.HELM_VERSION}}"

  # renovate: datasource=github-releases depName=kubernetes/kubernetes versioning=semver
  KUBECTL_VERSION: "1.37.1"
  KUBECTL_BIN: "{{ .BIN_DIR }}/kubectl-{{.KUBECTL_VERSION}}"

  # renovate: datasource=go depName=sigs.k8s.io/kind versioning=semver
  KIND_VERSION: "0.33.0"
  KIND_BIN: "{{ .BIN_DIR }}/kind-{{.KIND_VERSION}}"

  # renovate: datasource=github-releases depName=astral-sh/uv versioning=semver
  UV_VERSION: "0.12.23"
  UV_BIN: "{{ .BIN_DIR }}/uv-{{.UV_VERSION}}"
  UV_PUBLISH_TOKEN: '{{ .UV_PUBLISH_TOKEN | default "" }}'

  # renovate: datasource=github-releases depName=sigstore/cosign versioning=semver
  COSIGN_VERSION: "3.1.3"
  COSIGN_BIN: "{{ .BIN_DIR }}/cosign-{{.COSIGN_VERSION}}"

  KIND_CLUSTER_NAME: "sdk-py-test"

tasks:
  # ---------------------------------------------------------------------------
  # SDK tasks (top-level, user-facing)
  # ---------------------------------------------------------------------------

  build:
    desc: Build python client SDK package
    deps:
      - task: deps
    cmds:
      - "{{.UV_BIN}} build"

  test-env:create:
    desc: Create Kubernetes cluster test environment
    cmds:
      - task: test-env:deploy
        vars:
          DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL: 1s
          DIRECTORY_SERVER_OASF_API_VALIDATION_SCHEMA_URL: "https://schema.oasf.outshift.com"

  test-env:delete:
    desc: Delete Kubernetes cluster test environment
    cmds:
      - task: test-env:deploy:cleanup

  test:
    desc: Test python client SDK package
    deps:
      - task: deps
    cmds:
      - defer: { task: test-env:delete }
      - task: test-env:create
      - |
        export DIRCTL_IMAGE_TAG="{{ .DIRCTL_IMAGE_TAG }}"
        export COSIGN_PATH="$(printf "%s" "${COSIGN_PATH:-{{ .COSIGN_BIN }}}")"

        # Run SDK tests
        '{{ .UV_BIN }}' run pytest \
          --cov=agntcy.dir_sdk \
          --cov-report=xml:coverage.xml \
          --cov-report=term-missing

        # Run SDK example to verify it works
        cd {{ .ROOT_DIR }}/examples
        '{{ .UV_BIN }}' sync
        '{{ .UV_BIN }}' run python example.py

  deps:
    desc: Install deps for python SDK package
    deps:
      - task: deps:uv
      - task: deps:cosign
      - task: deps:dir-ctl
    cmds:
      - "{{.UV_BIN}} sync --all-packages"

  deps:example:
    desc: Install deps for Python SDK example package
    internal: true
    dir: ./examples
    deps:
      - task: deps:uv
    cmds:
      - "{{.UV_BIN}} sync --all-packages"

  deps:packages:
    desc: Install Python package dependencies (uv sync only)
    internal: true
    deps:
      - task: deps:uv
    cmds:
      - "{{.UV_BIN}} sync --all-packages"

  lint:
    desc: Lint Python SDK (ruff check + format check + mypy + lockfile sync)
    deps:
      - task: deps:packages
    cmds:
      - "{{.UV_BIN}} run ruff check dir-sdk-python examples"
      - "{{.UV_BIN}} run ruff format --check dir-sdk-python examples"
      - "{{.UV_BIN}} run mypy dir-sdk-python examples"
      - task: lock:check

  lock:check:
    desc: Verify uv.lock is in sync with pyproject.toml (SDK + examples)
    internal: true
    deps:
      - task: deps:uv
    cmds:
      - "{{.UV_BIN}} lock --check"
      - "cd examples && {{.UV_BIN}} lock --check"

  lint:fix:
    desc: Auto-fix Python lint and formatting (local dev)
    deps:
      - task: deps:packages
    cmds:
      - "{{.UV_BIN}} run ruff check --fix dir-sdk-python examples"
      - "{{.UV_BIN}} run ruff format dir-sdk-python examples"

  deps:tidy:
    desc: Install deps for SDK packages
    cmds:
      - task: deps
      - task: deps:example

  release:
    desc: Release python client SDK package
    env:
      UV_PUBLISH_TOKEN: "{{ .UV_PUBLISH_TOKEN }}"
    deps:
      - task: deps:uv
    cmds:
      - |
        if [ -z "$UV_PUBLISH_TOKEN" ]; then
          echo "UV_PUBLISH_TOKEN not set" 1>&2
          exit 1
        fi

        {{.UV_BIN}} publish

  # ---------------------------------------------------------------------------
  # Test environment (kind cluster + helm deploy of dir-server)
  # ---------------------------------------------------------------------------

  test-env:setup-cluster:
    desc: Create a kind cluster and load Docker images
    deps:
      - deps:helm
      - deps:kubectl
      - deps:kind
    vars:
      KIND_CREATE_OPTS: '{{ .KIND_CREATE_OPTS | default "" }}'
      KIND_CLUSTER_CONFIG_PATH:
        sh: mktemp
      # Port mapping is defined in the format of "hostPort1:containerPort1,hostPort2:containerPort2".
      # Container port should match the NodePort of the service defined in the Helm chart.
      KIND_EXTRA_PORT_MAPPING: '{{ .KIND_EXTRA_PORT_MAPPING | default "" }}'
    cmds:
      # Create cluster config
      - |
        cat <<EOF > {{.KIND_CLUSTER_CONFIG_PATH}}
        kind: Cluster
        apiVersion: kind.x-k8s.io/v1alpha4
        nodes:
          - role: control-plane
        {{ if .KIND_EXTRA_PORT_MAPPING }}
            extraPortMappings:
        {{ range .KIND_EXTRA_PORT_MAPPING | splitList "," }}
            - hostPort: {{ index (splitList ":" .) 0 }}
              containerPort: {{ index (splitList ":" .) 1 }}
              listenAddress: "127.0.0.1"
              protocol: TCP
        {{ end }}
        {{ end }}
        EOF

      # Create cluster
      - |
        {{ .KIND_BIN }} create cluster {{ .KIND_CREATE_OPTS }} --name {{ .KIND_CLUSTER_NAME }} --config {{ .KIND_CLUSTER_CONFIG_PATH }}
        {{ .KIND_BIN }} export kubeconfig --name {{ .KIND_CLUSTER_NAME }}
        {{ .KUBECTL_BIN }} cluster-info

  test-env:deploy:
    aliases: [deploy:local]
    desc: Deploy a local Directory server in Kubernetes
    deps:
      - task: test-env:setup-cluster
        vars:
          KIND_EXTRA_PORT_MAPPING: "{{.API_HOSTPORT}}:{{.API_NODEPORT}},{{.METRICS_HOSTPORT}}:{{.METRICS_NODEPORT}}"
    vars:
      # Kind args
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "sdk-py-test" }}'
      KIND_CREATE_OPTS: '{{ .KIND_CREATE_OPTS | default "" }}'
      # Helm args
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-server" }}'
      # API config
      API_HOSTPORT: '{{ .API_HOSTPORT | default "8888" }}'
      API_NODEPORT: '{{ .API_NODEPORT | default "30088" }}'
      METRICS_HOSTPORT: '{{ .METRICS_HOSTPORT | default "9090" }}'
      METRICS_NODEPORT: '{{ .METRICS_NODEPORT | default "30090" }}'
    cmds:
      # TODO: make logic idempotent so that running functional tests does not change previous contexts

      # Generate credentials and htpasswd file (using defaults)
      - task: test-env:htpasswd-creds:gen

      # Cleanup credentials on exit (using defaults)
      - defer:
          task: test-env:htpasswd-creds:cleanup

      # Deploy chart
      - |
        # Load credentials
        source /tmp/dir-htpasswd-creds.env

        {{ .HELM_BIN }} install dir oci://ghcr.io/agntcy/dir/helm-charts/dir \
          --version="{{ .DIR_CHART_VERSION }}" \
          --set apiserver.image.tag="{{ .DIR_IMAGE_TAG }}" \
          --set apiserver.image.pullSecrets="" \
          --set apiserver.service.type="NodePort" \
          --set apiserver.service.nodePort="{{.API_NODEPORT}}" \
          --set apiserver.service.metricsNodePort="{{.METRICS_NODEPORT}}" \
          {{ if .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
          --set apiserver.config.routing.refresh_interval="1s" \
          --set-json 'apiserver.config.routing.bootstrap_peers=[]' \
          --set apiserver.secrets.ociAuth.username="${HTPASSWD_USERNAME}" \
          --set apiserver.secrets.ociAuth.password="${HTPASSWD_PASSWORD}" \
          --set apiserver.zot.authHeader="${HTPASSWD_AUTH_HEADER}" \
          --set-file apiserver.zot.secretFiles.htpasswd="/tmp/dir-htpasswd" \
          --set apiserver.secrets.syncAuth.username="${HTPASSWD_SYNC_USERNAME}" \
          --set apiserver.secrets.syncAuth.password="${HTPASSWD_SYNC_PASSWORD}" \
          {{ if .DIRECTORY_SERVER_RATELIMIT_ENABLED }}--set apiserver.config.ratelimit.enabled="{{ .DIRECTORY_SERVER_RATELIMIT_ENABLED }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_RATELIMIT_GLOBAL_RPS }}--set apiserver.config.ratelimit.global_rps="{{ .DIRECTORY_SERVER_RATELIMIT_GLOBAL_RPS }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_RATELIMIT_GLOBAL_BURST }}--set apiserver.config.ratelimit.global_burst="{{ .DIRECTORY_SERVER_RATELIMIT_GLOBAL_BURST }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_RATELIMIT_PER_CLIENT_RPS }}--set apiserver.config.ratelimit.per_client_rps="{{ .DIRECTORY_SERVER_RATELIMIT_PER_CLIENT_RPS }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_RATELIMIT_PER_CLIENT_BURST }}--set apiserver.config.ratelimit.per_client_burst="{{ .DIRECTORY_SERVER_RATELIMIT_PER_CLIENT_BURST }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_OASF_API_VALIDATION_SCHEMA_URL }}--set apiserver.config.oasf_api_validation.schema_url="{{ .DIRECTORY_SERVER_OASF_API_VALIDATION_SCHEMA_URL }}"{{ end }} \
          --set apiserver.reconciler.image.tag="{{ .DIR_IMAGE_TAG }}" \
          --set apiserver.reconciler.config.regsync.interval="10s" \
          --set apiserver.reconciler.config.indexer.interval="10s" \
          --set apiserver.reconciler.config.name.interval="5s" \
          --set apiserver.reconciler.config.signature.interval="5s" \
          --namespace {{ .HELM_NAMESPACE }} \
          --create-namespace \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  test-env:deploy:cleanup:
    desc: Cleanup Kubernetes environment for local deployment
    deps:
      - deps:kind
    vars:
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "sdk-py-test" }}'
    cmds:
      - "{{ .KIND_BIN }} delete cluster --name {{ .KIND_CLUSTER_NAME }}"

  test-env:htpasswd-creds:gen:
    desc: Generate htpasswd credentials and files for DIR deployment
    vars:
      HTPASSWD_USERNAME: '{{ .HTPASSWD_USERNAME | default "apiserver" }}'
      HTPASSWD_SYNC_USERNAME: '{{ .HTPASSWD_SYNC_USERNAME | default "sync-user" }}'
      CREDS_FILE: '{{ .CREDS_FILE | default "/tmp/dir-htpasswd-creds.env" }}'
      HTPASSWD_FILE: '{{ .HTPASSWD_FILE | default "/tmp/dir-htpasswd" }}'
    cmds:
      - |
        # Generate fresh passwords
        HTPASSWD_PASSWORD="$(openssl rand -hex 16)"
        HTPASSWD_SYNC_PASSWORD="$(openssl rand -hex 16)"

        # Generate derived values
        HTPASSWD_AUTH_HEADER="$(echo -n "{{ .HTPASSWD_USERNAME }}:${HTPASSWD_PASSWORD}" | base64)"
        HTPASSWD_ADMIN="$(htpasswd -nbB "{{ .HTPASSWD_USERNAME }}" "${HTPASSWD_PASSWORD}" | sed 's/^{{ .HTPASSWD_USERNAME }}://')"
        HTPASSWD_SYNC="$(htpasswd -nbB "{{ .HTPASSWD_SYNC_USERNAME }}" "${HTPASSWD_SYNC_PASSWORD}" | sed 's/^{{ .HTPASSWD_SYNC_USERNAME }}://')"

        # Write credentials to env file (for helm --set commands)
        cat > {{ .CREDS_FILE }} << EOF
        export HTPASSWD_USERNAME="{{ .HTPASSWD_USERNAME }}"
        export HTPASSWD_PASSWORD="${HTPASSWD_PASSWORD}"
        export HTPASSWD_AUTH_HEADER="${HTPASSWD_AUTH_HEADER}"
        export HTPASSWD_SYNC_USERNAME="{{ .HTPASSWD_SYNC_USERNAME }}"
        export HTPASSWD_SYNC_PASSWORD="${HTPASSWD_SYNC_PASSWORD}"
        EOF

        # Write htpasswd file (for helm --set-file commands)
        cat > {{ .HTPASSWD_FILE }} << EOF
        {{ .HTPASSWD_USERNAME }}:${HTPASSWD_ADMIN}
        {{ .HTPASSWD_SYNC_USERNAME }}:${HTPASSWD_SYNC}
        EOF

  test-env:htpasswd-creds:cleanup:
    desc: Cleanup htpasswd credentials and files
    vars:
      CREDS_FILE: '{{ .CREDS_FILE | default "/tmp/dir-htpasswd-creds.env" }}'
      HTPASSWD_FILE: '{{ .HTPASSWD_FILE | default "/tmp/dir-htpasswd" }}'
    cmds:
      - rm -f {{ .CREDS_FILE }}
      - rm -f {{ .HTPASSWD_FILE }}

  # ---------------------------------------------------------------------------
  # Dependency installation (internal - downloads pinned tool versions to .bin)
  # ---------------------------------------------------------------------------

  deps:bin-dir:
    desc: Create bin directory
    run: once
    cmd: mkdir -p {{.BIN_DIR}}
    status:
      - test -d {{.BIN_DIR}}

  deps:helm:
    desc: Ensure supported Helm version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which curl
      - which tar
    cmds:
      - cmd: echo "Downloading Helm v{{.HELM_VERSION}}..."
      - cmd: curl -sSfL 'https://get.helm.sh/helm-v{{.HELM_VERSION}}-{{OS}}-{{ARCH}}.tar.gz' --output - | tar xzvOf - '{{OS}}-{{ARCH}}/helm' > {{.HELM_BIN}}
      - cmd: chmod +x {{.HELM_BIN}}
    status:
      - test -x {{.HELM_BIN}}

  deps:kubectl:
    desc: Ensure supported kubectl version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which curl
    cmds:
      - cmd: echo "Downloading Kubectl v{{.KUBECTL_VERSION}}..."
      - cmd: curl -L "https://dl.k8s.io/release/v{{.KUBECTL_VERSION}}/bin/{{OS}}/{{ARCH}}/kubectl" -o {{.KUBECTL_BIN}}
      - cmd: chmod +x {{.KUBECTL_BIN}}
    status:
      - test -x {{.KUBECTL_BIN}}

  deps:kind:
    desc: Ensure supported kind version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which go
    cmds:
      - cmd: echo "Downloading Kind v{{.KIND_VERSION}}..."
      - cmd: GOBIN={{.BIN_DIR}} go install sigs.k8s.io/kind@v{{.KIND_VERSION}}
      - cmd: mv {{.BIN_DIR}}/kind {{.KIND_BIN}}
    status:
      - test -x {{.KIND_BIN}}

  deps:uv:
    desc: Install uv
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which curl
    env:
      UV_INSTALL_DIR: "{{ .BIN_DIR }}"
    cmds:
      - curl -sfL https://astral.sh/uv/{{.UV_VERSION}}/install.sh | sh
      - mv {{.BIN_DIR}}/uv {{.UV_BIN}}
      - chmod +x {{.UV_BIN}}
      - rm {{.BIN_DIR}}/uvx
    status:
      - test -x {{.UV_BIN}}

  deps:cosign:
    desc: Install sigstore cosign
    internal: true
    cmds:
      - curl -sfL https://github.com/sigstore/cosign/releases/download/v{{.COSIGN_VERSION}}/cosign-{{OS}}-{{ARCH}} -o {{.BIN_DIR}}/cosign-{{.COSIGN_VERSION}}
      - chmod +x {{.BIN_DIR}}/cosign-{{.COSIGN_VERSION}}
    status:
      - test -x {{.COSIGN_BIN}}

  deps:dir-ctl:
    desc: Install dir-ctl
    internal: true
    run: once
    vars:
      DIRCTL_IMAGE_TAG: "{{ .DIRCTL_IMAGE_TAG }}"
    preconditions:
      - which docker
    cmds:
      - docker image pull ghcr.io/agntcy/dir-ctl:{{ .DIRCTL_IMAGE_TAG }}

  deps:renovate:
    desc: Install Renovate
    internal: true
    cmd: npm install -g renovate@{{ .RENOVATE_VERSION }}
    status:
      - npm list -g renovate | grep {{ .RENOVATE_VERSION }} -q

  deps:renovate:sync:
    desc: Sync dependencies with Renovate
    summary: |
      For extra CLI flags pass RENOVATE_OPTS (e.g. task deps:renovate:sync RENOVATE_OPTS='--dry-run').
      Default platform is local so local runs do not touch remote project data.
      Github Action CI sets RENOVATE_PLATFORM to github.
      This step is only analytical without GITHUB TOKEN and will not update PRs or project data.
    deps:
      - deps:renovate
    dir: "{{ .ROOT_DIR }}"
    vars:
      RENOVATE_OPTS_DEFAULT: >-
        --persist-repo-data 'true'
        --allowed-post-upgrade-commands '[".*"]'
        --post-upgrade-tasks '{"commands": ["task deps:tidy"], "executionMode": "branch"}'
      RENOVATE_OPTS: "{{ .RENOVATE_OPTS | default .RENOVATE_OPTS_DEFAULT }}"
      RENOVATE_PLATFORM_EFFECTIVE:
        sh: printf '%s' "${RENOVATE_PLATFORM:-local}"
    cmds:
      - renovate {{ .RENOVATE_OPTS }} --platform "{{ .RENOVATE_PLATFORM_EFFECTIVE }}"

  deps:cicd:iodc-token-generation:
    desc: Get Fulcio OIDC token for CICD
    requires:
      vars: [CLIENT_ID]
    cmds:
      - |
        OIDC_TOKEN=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
           "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value')

        CLIENT_ID="{{.CLIENT_ID}}"
        PROVIDER_URL="https://token.actions.githubusercontent.com"

        echo "OIDC_PROVIDER_URL=${PROVIDER_URL}"
        echo "CLIENT_ID=${CLIENT_ID}"
        echo "OIDC_TOKEN=${OIDC_TOKEN}"