Taskfile.yml

---
# https://taskfile.dev

version: '3'

set:
  - nounset
  - errexit
  - pipefail

includes:
  bash:
    taskfile: ./goat/Task/bash/Taskfile.yml
    internal: true
    optional: true
    vars:
      IMAGE_NAME: seiso/goat
      PROJECT_SLUG: goat
      PYTHON_VERSION: 3.11
      VERSION: '{{.VERSION}}'

  base:
    taskfile: ./goat/Task/Taskfile.yml
    internal: true
    optional: true

vars:
  # This unfortunately needs to be duplicated, pending https://github.com/go-task/task/issues/1295
  IMAGE_NAME: seiso/goat
  PROJECT_SLUG: goat
  PYTHON_VERSION: 3.11
  INPUT_DISABLE_MYPY: true
  INPUT_EXCLUDE: '^/{{.PROJECT_SLUG}}/(goat|Task)/.*'
  SUPPORTED_PLATFORMS: 'linux/amd64,linux/arm64'
  VERSION:
    sh: cat '{{.ROOT_DIR}}/VERSION'
  LOCAL_PLATFORM:
    # Inspired by https://github.com/containerd/containerd/blob/e0912c068b131b33798ae45fd447a1624a6faf0a/platforms/database.go#L76
    sh: |
      os="linux"
      arch="$(uname -m)"

      case ${arch} in
        # AMD64
        x86_64)  echo "${os}/amd64" ;;
        amd64)   echo "${os}/amd64" ;;

        # ARM64 special case due to https://hub.docker.com/_/python platforms
        aarch64) echo "${os}/arm64" ;;
        arm64)   echo "${os}/arm64" ;;
      esac

silent: true

tasks:
  init-pipenv:
    desc: Initializes the pipenv virtual environment if Pipfile.lock changes
    internal: true
    sources:
      - Pipfile.lock
    preconditions:
      - which pipenv || python -m pip install --upgrade pipenv
    cmds:
      - pipenv install --deploy --ignore-pipfile --dev

  init-submodules:
    desc: >
      Initializes git submodules; paved road projects include the Seiso goat 🐐
      for its shared configs, etc.
    internal: true
    status:
      # Only update submodules if you are in a git repository; quote to avoid yaml intrepretering the ! as a node tag
      # https://yaml.org/spec/1.2.2/#691-node-tags
      - '! test -d .git'
    cmds:
      - git submodule update --init

  init-pre-commit:
    desc: Install the pre-commit hooks
    internal: true
    sources:
      - .pre-commit-config.yaml
    status:
      # Only install the pre-commit hooks if you are in a git repository; quote to avoid yaml intrepretering the ! as a node tag
      # https://yaml.org/spec/1.2.2/#691-node-tags
      - '! test -d .git'
    cmds:
      # Don't run this in pipelines
      - '{{if ne .GITHUB_ACTIONS "true"}}pipenv run pre-commit install{{end}}'

  init-install-tools:
    desc: Install required tools
    internal: true
    cmds:
      - task: base:mac-brew-install
        vars:
          TOOLS: syft,grype
      - task: base:runner-curl-install
        vars:
          INSTALL_URL: https://raw.githubusercontent.com/anchore/syft/main/install.sh
          TOOL: syft
      - task: base:runner-curl-install
        vars:
          INSTALL_URL: https://raw.githubusercontent.com/anchore/grype/main/install.sh
          TOOL: grype

  init:
    desc: Initialize the repo for local use; intended to be run after git clone
    cmds:
      - task: init-pipenv
      - task: init-submodules
      - task: init-pre-commit
      - task: init-install-tools

  lint:
    desc: Run the linter(s); paved road projects use the Seiso goat 🐐
    cmds:
      - task: bash:lint
        vars:
          INPUT_DISABLE_MYPY: '{{.INPUT_DISABLE_MYPY}}'
          INPUT_EXCLUDE: '{{.INPUT_EXCLUDE}}'
          INPUT_LOG_LEVEL: '{{.CLI_ARGS}}'

  build:
    desc: Build the docker image; set PLATFORM env var for cross-platform builds
    cmds:
      - task: bash:build
        vars:
          PLATFORM: '{{.PLATFORM | default .LOCAL_PLATFORM}}'

  test:
    desc: Run the project tests
    env:
      INPUT_DISABLE_MYPY: '{{.INPUT_DISABLE_MYPY}}'
      INPUT_EXCLUDE: '{{.INPUT_EXCLUDE}}'
      INPUT_LOG_LEVEL: "{{.CLI_ARGS}}"
    vars:
      PLATFORM: '{{if eq .PLATFORM "all"}}{{.SUPPORTED_PLATFORMS}}{{else if .PLATFORM}}{{.PLATFORM}}{{else}}{{.LOCAL_PLATFORM}}{{end}}'
    # If a cross-platform image is provided via in the PLATFORM var, exit 1 here which bypasses tests
    status:
      - '{{if eq .PLATFORM .LOCAL_PLATFORM}}exit 1{{end}}'
    cmds:
      - echo "Baaaaaaaaaaah! (Running the goat)"
      - task: bash:validate
      - |
        if [[ "${GITHUB_ACTIONS:-false}" == "true" ]]; then
          repo="${GITHUB_WORKSPACE}"
          docker run --rm --env-file <(env | grep ^GITHUB_) \
                          --env-file <(env | grep ^INPUT_) \
                          --env-file <(env | grep ^OPENAI_) \
                          -v "${repo}:/goat" \
                          -v "${HOME}:${HOME}" \
                          seiso/goat:latest
        else
          docker run --rm --env-file <(env | grep ^GITHUB_) \
                          --env-file <(env | grep ^INPUT_) \
                          --env-file <(env | grep ^OPENAI_) \
                          -v "{{.ROOT_DIR}}:/goat" \
                          seiso/goat:latest
        fi

  clean:
    desc: Clean up build artifacts, cache files/directories, temp files, etc.
    cmds:
      - task: bash:clean
      - rm -rf {{.ROOT_DIR}}/node_modules

  release:
    desc: Cut a project release
    cmds:
      - task: bash:release

  publish:
    desc: Publish the project artifacts; docker images, compiled binaries, etc.
    cmds:
      # We call into the bash:publish instead of across to build to simplify centralized policy assessments (i.e. "is the project using a goat-provided task?")
      - task: bash:publish
        vars:
          PLATFORM: '{{.PLATFORM | default .LOCAL_PLATFORM}}'

  update:
    desc: Update the project dev and runtime dependencies, and pre-commit hash
    cmds:
      - task: bash:update

  sbom:
    desc: Generate project SBOMs
    cmds:
      - task: bash:sbom

  vulnscan:
    desc: Vuln scan the SBOM
    cmds:
      - task: bash:vulnscan