Taskfile.yaml

version: "3"

includes:
  cli:
    taskfile: ./cli/Taskfile.yaml
    dir: ./cli
  docker:
    taskfile: ./docker/Taskfile.yaml
    dir: ./docker
    aliases: [compose]
  fga:
    taskfile: ./fga/Taskfile.yaml
    dir: ./fga
  db:
    taskfile: ./db/Taskfile.yaml
    dir: ./db
    aliases: [atlas]
  config:
    taskfile: ./jsonschema/Taskfile.yaml
  catalog:
    taskfile: ./pkg/catalog/Taskfile.yaml
    dir: ./pkg/catalog
  bats:
    taskfile: ./.buildkite/tests/Taskfile.yaml


env:
  ATLAS_POSTGRES_DB_URI: "postgres:17-alpine"
  TEST_DB_URL: "docker://postgres:17-alpine"
  TEST_DB_CONTAINER_EXPIRY: "5" # in minutes
  TEST_FGA_URL: "localhost:8080"
  ENV: config
  # go build
  GOFLAGS: -buildvcs=false
  # for test container settings
  RYUK_CONNECTION_TIMEOUT: "5m"
  RYUK_VERBOSE: "true"
  COMPOSE_PROJECT_NAME: openlane
  # CLI demo environment variables
  ADMIN_USER_EMAIL: "admin@admin.theopenlane.io"
  GO_INLINE_FLAG: "-gcflags=all=-l"

tasks:
  default:
    silent: true
    cmds:
      - task --list

  generate:ci:
    desc: a combination of the ent, graph, and gqlgen tasks which are required to fully generate the necessary graph, server, resolvers, client, etc.
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    cmds:
      - go generate ./...
      - task: tidy

  regenerate:
    desc: regenerate all codegen artifacts from scratch, removing checksums to force regeneration
    cmds:
      - task: generate:removechecksums
      - task: generate:checksums

  generate:checksums:
    desc: Generate with checksum tracking for CI optimization
    aliases: [generate]
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    deps:
      - task: generate:core
      - task: generate:catalog:smart
    cmds:
      - task: generate:openapi:smart
      - task: tidy

  generate:core:
    desc: Run ent and graphql code generation (serial dependency chain)
    internal: true
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    cmds:
      - task: generate:ent:smart
      - task: generate:graphql:smart

  generate:ent:smart:
    aliases: ['generate:ent']
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    sources:
      - internal/ent/schema/**/*.go
      - internal/ent/generate/**/*.go
      - internal/ent/mixin/**/*.go
      - internal/ent/templates/**/*
    generates:
      - internal/ent/generated/**/*.go
      - internal/graphapi/schema/ent.graphql
      - internal/graphapi/schema/history/ent.graphql
    method: checksum
    cmds:
      - go generate internal/ent/generate/generate.go

  generate:graphql:smart:
    aliases: ['generate:gql']
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    sources:
      - internal/graphapi/generate/**/*.go
      - internal/graphapi/schema/**/*.graphql
      - internal/graphapi/query/**/*.graphql
      - internal/ent/generated/**/*.go
    generates:
      - internal/graphapi/generated/**/*.go
      - internal/graphapi/model/gen_models.go
      - internal/graphapi/*.resolvers.go
      - internal/graphapi/testclient/graphqlclient.go
      - internal/graphapi/testclient/models.go
      - internal/httpserve/handlers/csv/sample_*.csv
    method: checksum
    cmds:
      - go generate internal/graphapi/generate/generate.go

  generate:catalog:smart:
    desc: Generate catalog code from YAML definitions
    aliases: ['generate:catalog']
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    sources:
      - pkg/catalog/**/*.go
      - pkg/catalog/**/*.yaml
      - common/models/catalog.go
    generates:
      - pkg/catalog/gencatalog/*.go
      - pkg/catalog/**/*.json
      - common/models/orgmodule_gen.go
    method: checksum
    cmds:
      - go generate pkg/catalog/generate.go

  generate:openapi:smart:
    desc: Generate OpenAPI specification with checksum tracking
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    sources:
      - internal/httpserve/**/*.go
      - common/openapi/*.go
    generates:
      - internal/httpserve/specs/openlane.openapi.json
      - internal/httpserve/specs/openlane.openapi.yaml
    method: checksum
    cmds:
      - go generate internal/httpserve/specs/generate/generate.go

  generate:removechecksums:
    silent: true
    desc: Remove all individual schema checksum files to force regeneration
    cmds:
      - rm -f internal/ent/checksum/.schema_checksum # ent schema checksum
      - rm -f internal/ent/checksum/.history_schema_checksum # ent history schema checksum
      - rm -f internal/graphapi/checksum/.schema_checksum # gqlgen schema checksum
      - rm -f internal/graphapi/checksum/.history_schema_checksum # gqlgen history schema checksum
      - rm -f internal/graphapi/clientschema/checksum/.schema_checksum # gqlgen client schema checksum
      - rm -f internal/graphapi/historyschema/checksum/.history_schema_checksum # gqlgen history schema checksum
      - rm -f internal/graphapi/testclient/checksum/.client_checksum # gqlgen test client checksum
      - rm -rf .task/checksum/* # all taskfile checksums
      - echo "Removed all schema checksum files"

  # Buildkite automation tasks
  buildkite:draft-pr:
    desc: Create draft PR for config changes
    cmds:
      - sh -c "apk add --no-cache bash >/dev/null 2>&1 && bash .buildkite/draft-pr-automation.sh"
    preconditions:
      - sh: '[[ -n "${BUILDKITE_PULL_REQUEST:-}" && "${BUILDKITE_PULL_REQUEST}" != "false" ]]'
        msg: "Only runs in PR context"

  buildkite:helm-update:
    desc: Update helm chart from config changes
    cmds:
      - sh -c "apk add --no-cache bash >/dev/null 2>&1 && bash .buildkite/helm-automation.sh"
    preconditions:
      - sh: '[[ "${BUILDKITE_BRANCH:-}" == "main" ]]'
        msg: "Only runs on main branch"

  buildkite:link-prs:
    desc: Link PRs after draft creation
    deps: ['buildkite:draft-pr']
    cmds:
      - sh -c "apk add --no-cache bash >/dev/null 2>&1 && bash .buildkite/link-pr-automation.sh"
    preconditions:
      - sh: '[[ -n "${BUILDKITE_PULL_REQUEST:-}" && "${BUILDKITE_PULL_REQUEST}" != "false" ]]'
        msg: "Only runs in PR context"

  buildkite:post-merge:
    desc: Finalize config PRs after merge
    deps: ['buildkite:helm-update']
    cmds:
      - sh -c "apk add --no-cache bash >/dev/null 2>&1 && bash .buildkite/post-merge-pr-automation.sh"
    preconditions:
      - sh: '[[ "${BUILDKITE_BRANCH:-}" == "main" ]]'
        msg: "Only runs on main branch"

  buildkite:cleanup:
    desc: Cleanup draft PRs
    deps: ['buildkite:post-merge']
    cmds:
      - sh -c "apk add --no-cache bash >/dev/null 2>&1 && bash .buildkite/cleanup-draft-prs.sh"
    preconditions:
      - sh: '[[ "${BUILDKITE_BRANCH:-}" == "main" ]]'
        msg: "Only runs on main branch"

  buildkite:image-tag:
    desc: Update image tag for release
    cmds:
      - sh -c "apk add --no-cache bash >/dev/null 2>&1 && bash .buildkite/image-tag-automation.sh"
    preconditions:
      - sh: '[[ -n "${BUILDKITE_TAG:-}" ]]'
        msg: "Only runs on tag builds"

  ## Go tasks
  go:lint:
    desc: runs golangci-lint (optionally only on changed files with --changed=true)
    vars:
      CHANGED: '{{.CHANGED | default "false"}}'
    silent: true
    cmds:
      - |
        branch=$(git rev-parse --abbrev-ref HEAD)

        if [ "$branch" = "main" ]; then
          echo "🔎 On main branch — running full linter only..."
          golangci-lint run --config=.golangci.yaml --verbose
          # return the exit code from the linter
          exit $?
        fi

        if [ "{{.CHANGED}}" = "true" ]; then
          changed_files=$(git diff origin/main --name-only --diff-filter=ACMRTUXB | grep '\.go$' || true)

          if [ -n "$changed_files" ]; then
            echo "🔍 Linting changed files only (grouped by directory):"
            echo "$changed_files"

            echo "$changed_files" | xargs -n1 dirname | sort -u | while read -r dir; do
            if [ -d "$dir" ]; then
              echo "➡️  Linting directory: $dir"
              golangci-lint run --config=.golangci.yaml --verbose --fix --show-stats "$dir"
            fi
          done
          else
            echo "✅ No changed Go files to lint."
          fi
        else
          echo "🧹 Linting all Go files..."
          golangci-lint run . --config=.golangci.yaml --verbose
        fi

  go:lint:ci:
    desc: runs golangci-lint, the most annoying opinionated linter ever, for CI
    ## do not use --fix in CI
    cmds:
      - golangci-lint run --config=.golangci.yaml --verbose --concurrency 8 --verbose

  go:lint:ci:graphapi:
    silent: true
    desc: runs golangci-lint only on the graphapi package for CI, excluding generated code
    cmds:
      - golangci-lint run --config=.golangci.yaml --verbose --concurrency 8 $(go list ./... | grep internal/graphapi | grep -v generated | sed 's|github.com/theopenlane/core[^/]*/||' | sed 's|^|./|')

  go:lint:ci:handlers:
    silent: true
    desc: runs golangci-lint only on the httpserve handlers package for CI
    cmds:
      - golangci-lint run --config=.golangci.yaml --verbose --concurrency 8 --verbose ./internal/httpserve/handlers/...

  go:lint:ci:no-api:
    silent: true
    desc: runs golangci-lint on all packages except graphapi and handlers for CI
    cmds:
      - |
        golangci-lint run --config=.golangci.yaml --verbose --concurrency 8 $(
          go list ./... \
          | grep -v /internal/graphapi \
          | grep -v /internal/httpserve/handlers \
          | grep -v generated \
          | grep -v '^github.com/theopenlane/core$' \
          | sed 's|github.com/theopenlane/core[^/]*/||' \
          | sed 's|^|./|'
        )

  go:test:
    desc: runs and outputs results of created go tests
    aliases: ["go:test:psql", "test:psql"]
    env:
      TEST_DB_URL: "docker://postgres:17-alpine"
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    cmds:
      - go test -v ./... -tags test

  go:test:cover:
    desc: runs and outputs results of created go tests with coverage
    aliases: [cover]
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    cmds:
      - go test -v ./... -coverprofile=coverage.out -timeout 20m -tags test

  go:test:coverout:
    desc: runs and outputs results of created go tests with coverage
    aliases: [cover]
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    cmds:
      - task: go:test:cover
      - go tool cover -html=coverage.out

  go:testsum:local:
    silent: true
    desc: runs tests using gotestsum
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    aliases: [testsum]
    cmds:
      - gotestsum --format-hide-empty-pkg --packages "./..." --format-hide-empty-pkg --rerun-fails --hide-summary output -- -p 20 -tags test

  go:testsum:verbose:
    silent: true
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    desc: runs tests using gotestsum
    aliases: [testsum]
    cmds:
      - gotestsum --format standard-verbose --format-hide-empty-pkg --packages "./..." --format-hide-empty-pkg --rerun-fails --hide-summary output -- -p 20 -tags test

  go:testsum:slow:
    silent: true
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    desc: finds slow tests using gotestsum
    aliases: ['testsum:slow']
    cmds:
      - gotestsum tool slowest

  go:testsum:ci:
    desc: runs tests using gotestsum for CI
    silent: true
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    aliases: ['testsum:ci']
    cmds:
      - go run gotest.tools/gotestsum@latest --junitfile junit.xml --junitfile-hide-empty-pkg --packages "./..." --format-hide-empty-pkg --format-icons hivis --rerun-fails=3 --rerun-fails-run-root-test  --hide-summary output -- -p 20 -coverprofile=coverage.out -tags test

  go:testsum:ci:graph:
    desc: runs tests only graph tests using gotestsum for CI
    silent: true
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    aliases: ['testsum:ci:graph']
    cmds:
      - go run gotest.tools/gotestsum@latest --junitfile junit-graph.xml --junitfile-hide-empty-pkg --packages "github.com/theopenlane/core/internal/graphapi/" --format-hide-empty-pkg --format-icons hivis --rerun-fails=3 --rerun-fails-run-root-test  --hide-summary output -- -p 20 -coverprofile=coverage-graph.out -tags test

  go:testsum:ci:handlers:
    desc: runs tests only graph tests using gotestsum for CI
    silent: true
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    aliases: ['testsum:ci:handlers']
    cmds:
      - go run gotest.tools/gotestsum@latest --junitfile junit-handlers.xml --junitfile-hide-empty-pkg --packages "github.com/theopenlane/core/internal/httpserve/handlers" --format-hide-empty-pkg --format-icons hivis --rerun-fails=3 --rerun-fails-run-root-test  --hide-summary output -- -p 20 -coverprofile=coverage-handlers.out -tags test

  go:testsum:ci:no-api:
    desc: runs tests using gotestsum for CI
    silent: true
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    aliases: ['testsum:ci:no-api', 'testsum:ci:no-graph', 'go:testsum:ci:no-graph']
    cmds:
      - go run gotest.tools/gotestsum@latest --junitfile junit-no-api.xml --junitfile-hide-empty-pkg --packages "$(go list ./... | grep -v /internal/graphapi | grep -v /internal/httpserve/handlers)" --format-hide-empty-pkg --format-icons hivis --rerun-fails=3 --rerun-fails-run-root-test  --hide-summary output -- -p 20 -coverprofile=coverage-no-api.out -tags test

  go:testsum:ci:cover:
    desc: pushes test results to buildkite using gotestsum
    silent: true
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    aliases: ['testsum:ci:cover']
    cmds:
      - |
        curl \
        -X POST \
        --fail-with-body \
        -H "Authorization: Token token=\"$ANALYTICS_TOKEN\"" \
        -F "data=@junit.xml" \
        -F "format=junit" \
        -F "run_env[CI]=buildkite" \
        -F "run_env[key]=$BUILDKITE_BUILD_ID" \
        -F "run_env[number]=$BUILDKITE_BUILD_NUMBER" \
        -F "run_env[job_id]=$BUILDKITE_JOB_ID" \
        -F "run_env[branch]=$BUILDKITE_BRANCH" \
        -F "run_env[commit_sha]=$BUILDKITE_COMMIT" \
        -F "run_env[message]=$BUILDKITE_MESSAGE" \
        -F "run_env[url]=$BUILDKITE_BUILD_URL" \
        https://analytics-api.buildkite.com/v1/uploads

  go:testsum:graph:
    desc: runs only the graph tests using gotestsum
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    silent: true
    aliases: ['testsum:graph']
    cmds:
      - gotestsum --packages "github.com/theopenlane/core/internal/graphapi" --format-hide-empty-pkg --rerun-fails --format-icons hivis --hide-summary output -- -p 20 -tags test

  go:testsum:handlers:
    desc: runs only the httpserve handlers tests using gotestsum
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    silent: true
    aliases: ['testsum:graph']
    cmds:
      - gotestsum --packages "github.com/theopenlane/core/internal/httpserve/handlers" --format-hide-empty-pkg --rerun-fails --format-icons hivis --hide-summary output -- -p 20 -tags test

  go:fmt:
    desc: format all go code
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    cmds:
      - go fmt ./...

  go:work:sync:
    silent: true
    desc: Runs go work sync to ensure all modules are in sync, replaces go mod tidy for workspaces
    aliases: [tidy, 'go:tidy']
    cmds:
      - go work sync

  go:build:
    desc: Runs go build for the core server
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    cmds:
      - "{{ .GOOS }} {{ .GOARCH }} go build -o core"

  go:build:ci:
    desc: Runs go build for the core server
    cmds:
      - go build -mod=readonly -a -o bin/core

  go:build-cli:
    aliases: [buildcli]
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    desc: Runs go build for the openlane cli
    cmds:
      - go build -tags cli -o openlane-cli ./cli

  go:build-cli:ci:
    desc: Runs go build for the openlane cli in CI
    cmds:
      - go build -tags cli -mod=readonly -a -o bin/openlane-cli ./cli

  go:all:
    aliases: [go]
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    desc: Runs all go test and lint related tasks
    cmds:
      - task: go:tidy
      - task: go:fmt
      - task: go:lint
      - task: go:test

  # dev tasks
  run-dev:
    dotenv: ["{{.ENV}}/.env-dev"]
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    desc: runs the core server in dev mode with the minimum parts
    cmds:
      - task: compose:redis
      - task: compose:fga
      - task: compose:riverboat
      - task: run-api

  run-dev-full:
    dotenv: ["{{.ENV}}/.env-dev"]
    env:
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    desc: runs the core server in dev mode with riverboat and metrics
    deps: ['go:build-cli']
    cmds:
      - task: compose:redis
      - task: compose:fga
      - task: compose:riverboat
      - task: compose:metrics
      - task: run-api

  run-api:
    dotenv: ["{{.ENV}}/.env-dev"]
    env:
      CORE_AUTHZ_HOSTURL: http://localhost:8080
      GOFLAGS: "{{.GO_INLINE_FLAG}}"
    deps:
      - task: ensure-config-api
    desc: runs the core server in dev mode, assumes all other dependencies are running
    cmds:
      - go run main.go serve --debug --pretty

  oauth-test-ui:
    desc: runs the OAuth integration test UI on port 3004
    cmds:
      - docker compose -f ./docker/docker-compose-oauth-test.yml up -d

  oauth-test-ui:down:
    desc: stops the OAuth integration test UI
    cmds:
      - docker compose -f ./docker/docker-compose-oauth-test.yml down

  pr:
    desc: runs the comprehensive roll-up tasks required to ensure all files are being committed / pushed as a part of opening a PR
    cmds:
      - task: generate
      - task: config:generate
      - task: atlas:create
      - task: go
      - task: fga:test

  ci:
    desc: a task that runs during CI
    cmds:
      - task: generate:ci
      - task: tidy
      - "git config --global --add safe.directory /workdir"
      - |
        status=$(git status --porcelain)
        if [ -n "$status" ]; then
        echo "detected git diff after running generate; please re-run tasks"
        echo "$status"
        exit 1
        fi

  clean:local:
    desc: cleans up core.db and openlane-cli local
    cmds:
      - "rm -f core.db"
      - "rm -f openlane-cli"
      - task: buildcli

  shell:
    desc: open a new shell to launch server as a dep
    cmds:
      - rm -f core.db
      - rm -f openlane-cli
      - osascript -e 'tell app "Terminal" to do script "cd {{.PWD}} && task run-dev"'
    vars:
      PWD:
        sh: pwd

  install:all:
    desc: installs all dependencies for the project
    aliases: [install]
    cmds:
      - task: brew-install
      - task: local-setup

  update-brew:
    desc: Update Homebrew and upgrade all packages
    cmds:
      - brew update && brew upgrade && brew cleanup || true

  local-setup:
    desc: Setup the project dependencies
    cmds:
      - command -v gcloud &> /dev/null || curl https://sdk.cloud.google.com | bash
      - sudo npm install jsonschema2mk --global
      - sudo npm install format-graphql
      - pre-commit install && pre-commit install-hooks
      - pre-commit autoupdate
      - go mod tidy && go get -u ./... &> /dev/null
      - pre-commit run --show-diff-on-failure --color=always --all-files
      - task: rover:install

  precommit-full:
    desc: Lint the project against all files
    cmds:
      - pre-commit install && pre-commit install-hooks
      - pre-commit autoupdate
      - pre-commit run --show-diff-on-failure --color=always --all-files

  brew-install:
    desc: Install workstation dependencies with Brew
    cmds:
      - task: update-brew
      - echo "Installing {{.DEPS}} via homebrew..."
      - brew install {{.DEPS}} {{.CLI_ARGS}}
      - echo "Installed {{.DEPS}} via homebrew!"
    deps:
      - task: brew-installed
    status:
      - "[ -f $(brew --prefix)/bin/{{.DEPS}} ]"
    vars:
      DEPS: >-
        age helm kubernetes-cli yq jq gomplate golangci-lint openfga/tap/fga pre-commit ariga/tap/atlas rover theopenlane/tap/openlane #magic___^_^___line

  brew-installed:
    silent: true
    desc: check if Homebrew is installed
    cmds:
      - '[ -x "$(command -v brew)" ] || (echo "Homebrew is not installed, please install it from https://brew.sh" && exit 1)'

  go:dist:
    desc: Downloads a Golang distribution
    silent: true
    vars:
      GO_VERSION:
        sh: curl -sk "https://go.dev/VERSION?m=text" | head -n 1 |  sed 's/go//g'
      GO_URL: https://go.dev/dl/go{{.GO_VERSION}}.darwin-arm64.tar.gz
    cmds:
      - test -d /usr/local/go-{{.GO_VERSION}} || curl -L -o go{{.GO_VERSION}}.darwin-arm64.tar.gz {{.GO_URL}} && sudo tar -C /usr/local -xzf go{{.GO_VERSION}}.darwin-arm64.tar.gz
    status:
      - test -d /usr/local/go-{{.GO_VERSION}}

  rover:
    aliases:
      - docker:rover # adding for backwards compatibility
    desc: launches an interactive browser to navigate the configured graph schema
    cmds:
      - 'open "http://localhost:4000"'
      - rover dev --skip-update-check --skip-update -u http://localhost:17608/query -s schema.graphql -n core --elv2-license=accept

  rover:update:
    desc: updates rover, if updates are available, and launches an interactive browser to navigate the configured graph schema
    cmds:
      - 'open "http://localhost:4000"'
      - rover dev -u http://localhost:17608/query -s schema.graphql -n core --elv2-license=accept

  rover:install:
    desc: installs the rover plugins for supergraph and router
    cmds:
      - rover install --plugin supergraph@v2.8.2
      - rover install --plugin router@v1.50.0

  ensure-config-api:
    desc: Ensure local config files exist
    silent: true
    cmds:
      - |
        if [ ! -f config/.config.yaml ]; then
          echo "📄 config/.config.yaml not found, copying from config-dev.example.yaml"
          cp config/config-dev.example.yaml config/.config.yaml
        else
          echo "✅ config/.config.yaml already exists"
        fi

  generate:openapi:
    desc: Generate OpenAPI spec file
    cmds:
      - go run ./internal/httpserve/specs/generate/main.go