Taskfile.yml

# Copyright AGNTCY Contributors (https://github.com/agntcy)
# SPDX-License-Identifier: Apache-2.0

version: '3'

vars:
  ## Version
  RELEASE_VERSION:
    sh: grep 'version:' versions.yaml | awk '{print $2}'
  RELEASE_VERSION_LDFLAG: "-X 'github.com/agntcy/dir/api/version.Version={{ .RELEASE_VERSION }}'"
  COMMIT_SHA:
    sh: git rev-parse --short HEAD
  COMMIT_SHA_LDFLAG: "-X 'github.com/agntcy/dir/api/version.CommitHash={{ .COMMIT_SHA }}'"
  VERSION_LDFLAGS: '{{ .RELEASE_VERSION_LDFLAG }} {{ .COMMIT_SHA_LDFLAG }}'

  ## Image config
  IMAGE_REPO: '{{ .IMAGE_REPO | default "ghcr.io/agntcy" }}'
  IMAGE_TAG: '{{ .IMAGE_TAG | default .COMMIT_SHA }}'
  IMAGE_BAKE_ENV: 'IMAGE_REPO={{.IMAGE_REPO}} IMAGE_TAG={{.IMAGE_TAG}}'
  IMAGE_BAKE_OPTS: '{{ .IMAGE_BAKE_OPTS | default "" }}'
  BAKE_ENV: '{{ .IMAGE_BAKE_ENV }} EXTRA_LDFLAGS="{{.VERSION_LDFLAGS}}"'

  ## Dependency config
  BIN_DIR: '{{ .ROOT_DIR }}/bin'
  DIRCTL_BIN: '{{ .BIN_DIR}}/dirctl'
  HELM_VERSION: '3.16.3'
  HELM_BIN: '{{ .BIN_DIR }}/helm-{{.HELM_VERSION}}'
  KUBECTL_VERSION: '1.31.3'
  KUBECTL_BIN: '{{ .BIN_DIR }}/kubectl-{{.KUBECTL_VERSION}}'
  KIND_VERSION: '0.25.0'
  KIND_BIN: '{{ .BIN_DIR }}/kind-{{.KIND_VERSION}}'
  PROTOC_VERSION: '27.1'
  PROTOC_BIN: '{{ .BIN_DIR }}/protoc-{{.PROTOC_VERSION}}'
  BUFBUILD_VERSION: '1.50.1'
  BUFBUILD_BIN: '{{ .BIN_DIR }}/bufbuild-{{.BUFBUILD_VERSION}}'
  GO_VERSION: '1.24.5'
  MULTIMOD_VERSION: '0.17.0'
  MULTIMOD_BIN: '{{ .BIN_DIR }}/multimod-{{.MULTIMOD_VERSION}}'
  GOLANGCI_LINT_VERSION: '1.64.7'
  GOLANGCI_LINT_BIN: '{{ .BIN_DIR }}/golangci-lint-{{.GOLANGCI_LINT_VERSION}}'
  LICENSEI_VERSION: '0.9.0'
  LICENSEI_BIN: '{{ .BIN_DIR }}/licensei-{{.LICENSEI_VERSION}}'
  UV_VERSION: '0.6.1'
  UV_BIN: '{{ .BIN_DIR }}/uv-{{.UV_VERSION}}'
  UV_PUBLISH_TOKEN: '{{ .UV_PUBLISH_TOKEN | default "" }}'
  COSIGN_VERSION: '2.5.3'
  COSIGN_BIN: '{{ .BIN_DIR }}/cosign-{{.COSIGN_VERSION}}'
  HUB_API_VERSION: 'main'
  HUB_REPO_URL: 'https://github.com/cisco-eti/phoenix-saas-be.git'
  ZOT_VERSION: '2.1.8'

tasks:
  ##
  ## General
  ##
  default:
    cmds:
      - task -l

  gen:
    desc: Generate code for all components
    cmds:
      - task: api:gen
      - task: helm:gen

  check:
    desc: Checks for all code violations
    cmds:
      - task: lint
      - task: license

  build:
    desc: Build images for all components
    deps:
      - task: deps:tidy
      - task: gen
    vars:
      GOARCH: '{{ .GOARCH | default ARCH }}'
    cmds:
      - '{{.BAKE_ENV}} docker buildx bake {{.IMAGE_BAKE_OPTS}} --set *.platform=linux/{{.GOARCH}}'

  build:all:
    desc: Build images for all components for multiple platforms
    cmds:
      - '{{.BAKE_ENV}} docker buildx bake {{.IMAGE_BAKE_OPTS}} --set *.platform=linux/amd64,linux/arm64'

  pull:
    desc: Pull images for all components
    cmds:
      - |
        images=$({{.BAKE_ENV}} docker buildx bake default --print | jq -r '.target | with_entries(.value |= .tags[0]) | to_entries[] | .value')
        echo "$images" | while read image; do
          echo "Pulling image: $image"
          docker pull $image
        done

  push:
    desc: Build and push images for all components
    prompt:
      - Are you sure you want to push the images to remote registry?
    cmds:
      - '{{.BAKE_ENV}} docker buildx bake {{.IMAGE_BAKE_OPTS}} --set=*.output=type=registry'

  release:verify:
    desc: Verify release readiness
    deps:
      - task: deps:multimod-bin
    cmds:
      - '{{ .MULTIMOD_BIN }} verify'

  release:prepare:
    desc: Prepare release
    deps:
      - task: deps:multimod-bin
    cmds:
      - '{{ .MULTIMOD_BIN }} prerelease --all-module-sets --skip-go-mod-tidy=true --commit-to-different-branch=false'

  ##
  ## API
  ##
  api:gen:
    desc: Generates API stubs
    dir: ./proto
    deps:
      - task: deps:protoc
      - task: deps:bufbuild
    # NOTE(ramizpolic): This allows Taskfile YAML parsing to accept '{' as a starting command token.
    # In translation, this is interpreted as a regular multi-line shell script.
    cmd: |
      {{.BUFBUILD_BIN}} dep update
      {{.BUFBUILD_BIN}} generate

  api:clean:
    desc: Clean generated API stubs
    deps:
      - api:clean:go

  api:clean:go:
    desc: Clean generated golang API stubs
    dir: ./api
    cmds:
      - find . \( -name "*.pb.go" \) -type f -delete

  api:test:
    desc: Unit test API code
    vars:
      EXTRA_ARGS: '{{ .EXTRA_ARGS | default "" }}'
    cmds:
      - EXTRA_ARGS="{{.EXTRA_ARGS}}" task api:test:go

  api:test:go:
    desc: Unit test Go API code
    vars:
      EXTRA_ARGS: '{{ .EXTRA_ARGS | default "" }}'
    dir: ./api
    cmds:
      - go -C . test ./... {{.EXTRA_ARGS}}

  ##
  ## CLI
  ##
  cli:compile:
    desc: Compile CLI binaries
    dir: ./cli
    vars:
      GOOS: '{{ .GOOS | default OS }}'
      GOARCH: '{{ .GOARCH | default ARCH }}'
      BINARY_NAME: '{{ .BINARY_NAME | default "dirctl" }}'
      OUT_BINARY: '{{ if eq OS "windows" }}{{ .ROOT_DIR }}\\bin\\{{ .BINARY_NAME }}.exe{{ else }}{{ .ROOT_DIR }}/bin/{{ .BINARY_NAME }}{{ end }}'
      LDFLAGS: '-s -w -extldflags -static {{ .VERSION_LDFLAGS }}'
    cmds:
      - CGO_ENABLED=0 GOOS={{.GOOS}} GOARCH={{.GOARCH}} go build -ldflags="{{ .LDFLAGS }}" -o "{{.OUT_BINARY}}" cli.go

  cli:compile:all:
    desc: Compile CLI client binaries for multiple platforms
    aliases: [compile]
    cmds:
      - for:
          matrix:
            OS: ['linux', 'darwin', 'windows']
            ARCH: ['amd64', 'arm64']
        cmd: |
          # Skip unsupported combinations (e.g., Windows ARM64)
          if [ "{{.ITEM.OS}}" = "windows" ] && [ "{{.ITEM.ARCH}}" = "arm64" ]; then
            echo "Skipping unsupported platform: {{.ITEM.OS}}/{{.ITEM.ARCH}}"
          else
            GOOS={{.ITEM.OS}} GOARCH={{.ITEM.ARCH}} BINARY_NAME=dirctl-{{.ITEM.OS}}-{{.ITEM.ARCH}} task cli:compile
          fi

  cli:test:
    desc: Unit test CLI code
    dir: ./cli
    cmds:
      - go -C . test ./... {{.EXTRA_ARGS}}

  ##
  ## Client SDK
  ##
  client:test:
    desc: Unit test Client code
    vars:
      EXTRA_ARGS: '{{ .EXTRA_ARGS | default "" }}'
    cmds:
      - EXTRA_ARGS="{{.EXTRA_ARGS}}" task client:test:go

  client:test:go:
    desc: Unit test Go Client code
    dir: ./client
    vars:
      EXTRA_ARGS: '{{ .EXTRA_ARGS | default "" }}'
    cmds:
      - go -C . test ./... {{.EXTRA_ARGS}}

  sdk:deps:common:
    desc: Common dependencies for SDKs
    cmds:
      - task: deps:cosign
      - task: cli:compile
      - task: sdk:deps:javascript

  sdk:deps:cicd:iodc-token-generation:
    desc: Get Fulcio OIDC token for CICD
    requires:
      vars: [CLIENT_ID]
    cmds:
      - |
        OIDC_TOKEN=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
           "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value')

        CLIENT_ID="{{.CLIENT_ID}}"
        PROVIDER_URL="https://token.actions.githubusercontent.com"

        echo "OIDC_PROVIDER_URL=${PROVIDER_URL}"
        echo "CLIENT_ID=${CLIENT_ID}"
        echo "OIDC_TOKEN=${OIDC_TOKEN}"

  sdk:build:all:
    desc: Build all client SDK package
    cmds:
      - task: sdk:build:javascript
      - task: sdk:build:python

  sdk:build:python:
    desc: Build python client SDK package
    dir: ./sdk/dir-py
    deps:
      - task: deps:uv
    cmds:
      - '{{.UV_BIN}} build'

  sdk:build:javascript:
    desc: Build javascript client SDK package
    dir: ./sdk/dir-js
    cmds:
      - npm run build

  sdk:test-env:create:
    desc: Create Kubernetes cluster test environment
    cmds:
      - task: deploy:kubernetes:network
        vars:
          PUBLICATION_SCHEDULER_INTERVAL: 1s
      - task: deploy:kubernetes:network:port-forward

  sdk:test-env:delete:
    desc: Delete Kubernetes cluster test environment
    cmds:
      - task: deploy:kubernetes:network:port-forward:cleanup
      - task: deploy:kubernetes:network:cleanup

  sdk:test-env:spiffe:load-test-image:
    desc: Load the SDK tests into KinD
    cmds:
      - '{{.BAKE_ENV}} docker buildx bake sdks-test {{.IMAGE_BAKE_OPTS}}'
      - '{{.KUBECTL_BIN}} config use-context kind-dir.example'
      - '{{.KIND_BIN}} load docker-image ghcr.io/agntcy/sdks-test:{{.IMAGE_TAG}} --name dir.example'

  sdk:test:all:spiffe:
    desc: Test all client SDK pacakges with spiffe
    dir: ./e2e/sdk
    cmds:
      - '{{.KUBECTL_BIN}} config use-context kind-dir.example'
      - '{{.HELM_BIN}} uninstall sdk-tests --wait --keep-history --ignore-not-found > /dev/null || true'
      - '{{.HELM_BIN}} install --replace --timeout 1m --wait --wait-for-jobs sdk-tests ./chart -f chart/values.yaml --set image.tag={{.IMAGE_TAG}} > /dev/null || true'
      - |
        status=$({{.KUBECTL_BIN}} get job sdks-test -o jsonpath='{.status.conditions[0].type}')
        status_value=$({{.KUBECTL_BIN}} get job sdks-test -o jsonpath='{.status.conditions[0].status}')

        if [[ "$status" == "SuccessCriteriaMet" ]] && [[ "$status_value" == "True" ]]; then
          echo "SDKs test are finished successfully! ✅"
          exit 0
        fi

        if [[ "$status" == "FailureTarget" ]] && [[ "$status_value" == "True" ]]; then
          {{.KUBECTL_BIN}} logs jobs/sdks-test
          echo "SDKs test are failed! ❎"
          exit 1
        fi

        echo "Unknown error happend, check logs! ⚠️"
        exit 1

  sdk:test:all:
    desc: Test all client SDK packages
    ignore_error: true
    cmds:
      - task: sdk:test:javascript
      - task: sdk:test:python

  sdk:test:python:
    desc: Test python client SDK package
    dir: ./sdk/dir-py
    deps:
      - task: deps:uv
    env:
      DIRECTORY_CLIENT_SERVER_ADDRESS: '0.0.0.0:8890'
      DIRECTORY_SERVER_PEER1_ADDRESS: '0.0.0.0:8891'
      DIRECTORY_SERVER_PEER2_ADDRESS: '0.0.0.0:8892'
      KIND_CLUSTER_NAME: 'sdk-py-test'
    cmds:
      - task: sdk:test-env:create
      - defer: { task: sdk:test-env:delete }
      - |
        export DIRCTL_PATH="$(printf "%s" "${DIRCTL_PATH:-{{ .DIRCTL_BIN }}}")"
        export COSIGN_PATH="$(printf "%s" "${COSIGN_PATH:-{{ .COSIGN_BIN }}}")"

        '{{.UV_BIN}}' run pytest

  sdk:test:javascript:
    desc: Test javascript client SDK package
    dir: ./sdk/dir-js
    env:
      DIRECTORY_CLIENT_SERVER_ADDRESS: '0.0.0.0:8890'
      DIRECTORY_SERVER_PEER1_ADDRESS: '0.0.0.0:8891'
      DIRECTORY_SERVER_PEER2_ADDRESS: '0.0.0.0:8892'
      KIND_CLUSTER_NAME: 'sdk-js-test'
    cmds:
      - task: sdk:test-env:create
      - defer: { task: sdk:test-env:delete }
      - |
        export DIRCTL_PATH="$(printf "%s" "${DIRCTL_PATH:-{{ .DIRCTL_BIN }}}")"
        export COSIGN_PATH="$(printf "%s" "${COSIGN_PATH:-{{ .COSIGN_BIN }}}")"

        npm run test

  sdk:deps:javascript:
    desc: Install deps for javascript SDK package
    dir: ./sdk/dir-js
    cmds:
      - npm install

  sdk:release:all:
    desc: Release all client SDK package
    env:
      UV_PUBLISH_TOKEN: '{{ .UV_PUBLISH_TOKEN }}'
      NODE_AUTH_TOKEN: '{{ .NODE_AUTH_TOKEN }}'
    cmds:
      - task: sdk:release:javascript
      - task: sdk:release:python

  sdk:release:python:
    desc: Release python client SDK package
    dir: ./sdk/dir-py
    env:
      UV_PUBLISH_TOKEN: '{{ .UV_PUBLISH_TOKEN }}'
    deps:
      - task: deps:uv
    cmds:
      - '{{.UV_BIN}} publish'

  sdk:release:javascript:
    desc: Release javascript client SDK package
    dir: ./sdk/dir-js
    env:
      NODE_AUTH_TOKEN: '{{ .NODE_AUTH_TOKEN }}'
    cmds:
      - npm publish --scope=@agntcy --access public

  ##
  ## Server
  ##
  server:build:
    desc: Build Directory server image
    cmds:
      - '{{.BAKE_ENV}} docker buildx bake {{.IMAGE_BAKE_OPTS}} dir-apiserver'

  server:start:
    desc: Start Directory server
    dir: server/cmd
    env:
      DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL: 1s
    cmds:
      - defer: { task: server:store:stop }
      - task: server:store:start
      - go run main.go

  server:store:pull:
    desc: Pull local OCI registry server docker image
    vars:
      IMAGE: '{{.IMAGE}}'
    cmds:
      - |
        docker pull {{.IMAGE}}

  server:store:start:
    desc: Start local OCI registry server for storage
    internal: true
    vars:
      IMAGE: ghcr.io/project-zot/zot-linux-{{ARCH}}:{{.ZOT_VERSION}}
    deps:
      - task: server:store:pull
        vars:
          IMAGE: '{{.IMAGE}}'
    cmds:
      - |
        # mount config
        cat > /tmp/config.json <<EOF
        {
          "distSpecVersion": "1.1.1",
          "storage": {
            "rootDirectory": "/tmp/zot"
          },
          "http": {
            "address": "0.0.0.0",
            "port": "5000"
          },
          "log": {
            "level": "debug"
          },
          "extensions": {
            "search": {
              "enable": true
            },
            "trust": {
              "enable": true,
              "cosign": true,
              "notation": false
            }
          }
        }
        EOF

        # run docker with attached volume
        docker run \
              -it \
              --rm -d -p 5000:5000 \
              -v /tmp/config.json:/config.json:ro \
              --name oci-registry {{.IMAGE}} serve /config.json

  server:store:stop:
    desc: Stop local OCI registry node
    internal: true
    cmds:
      - docker stop oci-registry

  server:test:
    desc: Unit test Directory server code
    dir: ./server
    cmds:
      - go -C . test ./... {{.EXTRA_ARGS}}

  server:bench:
    desc: Benchmark Directory server code
    dir: ./server
    cmds:
      - go -C . test -run=^$ -bench=. ./...

  ##
  ## Deploy
  ##
  deploy:kubernetes:setup-cluster:
    desc: Create a kind cluster and load Docker images
    deps:
      - deps:helm
      - deps:kubectl
      - deps:kind
    vars:
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
      KIND_CREATE_OPTS: '{{ .KIND_CREATE_OPTS | default "" }}'
    cmds:
      # Create ephemeral cluster
      - '{{ .KIND_BIN }} create cluster {{ .KIND_CREATE_OPTS }} --name {{ .KIND_CLUSTER_NAME }}'
      - '{{ .KIND_BIN }} export kubeconfig --name {{ .KIND_CLUSTER_NAME }}'

      # Check cluster status
      - '{{ .KUBECTL_BIN }} cluster-info'

      # Import images
      - |
        images=$({{.BAKE_ENV}} docker buildx bake default --print | jq -r '.target | with_entries(.value |= .tags[0]) | to_entries[] | .value')
        echo "$images" | while read image; do
          {{ .KIND_BIN }} load docker-image $image --name {{ .KIND_CLUSTER_NAME }}
        done

  deploy:kubernetes:local:
    aliases: [deploy:local]
    desc: Deploy a local Directory server in Kubernetes
    deps:
      - deploy:kubernetes:setup-cluster
    vars:
      # Kind args
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
      KIND_CREATE_OPTS: '{{ .KIND_CREATE_OPTS | default "" }}'
      # Helm args
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-server" }}'
      HELM_CHART_PATH: '{{ .ROOT_DIR }}/install/charts/dir'
      HELM_VALUES_PATH: '{{ .ROOT_DIR }}/install/charts/dir/values.yaml'
    cmds:
      # TODO: make logic idempotent so that running functional tests does not change previous contexts

      # Create zot configuration using helper task
      - task: deploy:zot:config
        vars:
          ZOT_CONFIG_DIR: /opt/zot-config

      # Deploy chart
      - |
        {{ .HELM_BIN }} dependency build {{ .HELM_CHART_PATH }}
        {{ .HELM_BIN }} upgrade dir \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set apiserver.image.tag="{{ .IMAGE_TAG }}" \
          {{ if .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
          --namespace {{ .HELM_NAMESPACE }} \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  deploy:kubernetes:context:
    desc: Switch context to given Kubernetes cluster
    vars:
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
    cmds:
      - '{{ .KIND_BIN }} export kubeconfig --name {{ .KIND_CLUSTER_NAME }}'

  deploy:kubernetes:dir:
    desc: Deploy DIR helm chart
    vars:
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-server" }}'
      HELM_CHART_PATH: '{{ .ROOT_DIR }}/install/charts/dir'
      HELM_VALUES_PATH: '{{ .ROOT_DIR }}/install/charts/dir/values.yaml'
      HELM_EXTRA_ARGS: '{{ .HELM_EXTRA_ARGS | default "" }}'
    cmds:
      - task: deploy:zot:config
        vars:
          ZOT_CONFIG_DIR: /opt/zot-config
      - |
        {{ .HELM_BIN }} upgrade --install dir \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set apiserver.image.tag="{{ .IMAGE_TAG }}" \
          {{ if .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
          {{ .HELM_EXTRA_ARGS }} \
          --namespace {{ .HELM_NAMESPACE }} \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  deploy:kubernetes:dirctl:
    desc: Deploy DIRCTL helm chart
    vars:
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-client" }}'
      HELM_CHART_PATH: '{{ .ROOT_DIR }}/install/charts/dirctl'
      HELM_VALUES_PATH: '{{ .ROOT_DIR }}/install/charts/dirctl/values.yaml'
      HELM_EXTRA_ARGS: '{{ .HELM_EXTRA_ARGS | default "" }}'
    cmds:
      - |
        {{ .HELM_BIN }} upgrade --install dirctl \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set image.tag="{{ .IMAGE_TAG }}" \
          {{ .HELM_EXTRA_ARGS }} \
          --namespace {{ .HELM_NAMESPACE }} \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  deploy:kubernetes:spire:
    desc: Deploy SPIRE helm chart
    vars:
      TRUST_DOMAIN: '{{ .TRUST_DOMAIN | default "example.org" }}'
      SERVICE_TYPE: '{{ .SERVICE_TYPE | default "LoadBalancer" }}'
      BUNDLE_PATH: '{{ .BUNDLE_PATH | default "/tmp/spire-bundle.spiffe" }}'
    cmds:
      - |
        {{ .HELM_BIN }} upgrade --install spire-crds spire-crds \
          --repo https://spiffe.github.io/helm-charts-hardened/ \
          --namespace spire-crds \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

      - |
        {{ .HELM_BIN }} upgrade --install spire spire \
          --repo https://spiffe.github.io/helm-charts-hardened/ \
          --set global.spire.trustDomain="{{ .TRUST_DOMAIN }}" \
          --set spire-server.service.type="{{ .SERVICE_TYPE }}" \
          --set spire-server.federation.enabled="true" \
          --set spire-server.controllerManager.watchClassless="true" \
          --namespace spire \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

      - |
        {{ .KUBECTL_BIN }} get configmap -n spire spire-bundle -o json | jq '.data."bundle.spiffe"' -r > {{ .BUNDLE_PATH }}

  deploy:kubernetes:local:port-forward:
    aliases: [deploy:local:port-forward]
    desc: Set up port-forwarding for the local deployment
    vars:
      # Helm args
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-server" }}'
    cmds:
      # Port-forward dependency services
      - |
        {{ .KUBECTL_BIN }} port-forward service/dir-apiserver 8888:8888 -n {{ .HELM_NAMESPACE }} &

      # Delay to ensure services are online
      - sleep 10

  deploy:kubernetes:local:port-forward:cleanup:
    aliases: [deploy:local:port-forward:cleanup]
    desc: Cleanup port-forwarding processes
    cmds:
      # Kill any existing port-forward processes for the dir-apiserver service
      - kill -9 $(ps aux | grep port-forward | grep dir-apiserver | awk '{print $2}') || true

  deploy:kubernetes:local:cleanup:
    aliases: [deploy:local:cleanup, deploy:kubernetes:cleanup]
    desc: Cleanup Kubernetes environment for local deployment
    deps:
      - deps:kind
    vars:
      # Kind args
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
    cmds:
      - '{{ .KIND_BIN }} delete cluster --name {{ .KIND_CLUSTER_NAME }}'

  deploy:kubernetes:network:bootstrap:
    internal: true
    desc: Deploy a bootstrap Directory server in Kubernetes
    deps:
      - deploy:kubernetes:setup-cluster
      - deps:dirctl-bin
    vars:
      # Helm args
      HELM_CHART_PATH: '{{ .ROOT_DIR }}/install/charts/dir'
      HELM_VALUES_PATH: '{{ .ROOT_DIR }}/install/charts/dir/values.yaml'
    cmds:
      # Generate private key if it doesn't exist
      - |
        test -f /tmp/node.privkey || {{ .BIN_DIR }}/dirctl network init --output /tmp/node.privkey

      # Generate the bootstrap peer ID and export it to the environment file
      - |
        bootstrap_peerid=$({{ .BIN_DIR }}/dirctl network info /tmp/node.privkey)
        echo "PEER ID: ${bootstrap_peerid}"
        echo BOOTSTRAP_PEER_ID="${bootstrap_peerid}" > .env

      # Create zot configuration using helper task for bootstrap
      - task: deploy:zot:config
        vars:
          ZOT_CONFIG_DIR: /opt/zot-config-bootstrap

      # Deploy the bootstrap server using Helm
      - |
        {{ .HELM_BIN }} dependency build {{ .HELM_CHART_PATH }}
        {{ .HELM_BIN }} upgrade agntcy-dir \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set apiserver.image.tag="{{ .IMAGE_TAG }}" \
            {{ if .PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
          --set apiserver.privKey="$(cat /tmp/node.privkey)" \
          --set apiserver.config.routing.key_path="/etc/agntcy/dir/node.privkey" \
          --set apiserver.config.routing.listen_address="/ip4/0.0.0.0/tcp/8999" \
          --set apiserver.config.routing.directory_api_address="agntcy-dir-apiserver.bootstrap.svc.cluster.local:8888" \
          --set apiserver.config.store.oci.registry_address="agntcy-dir-zot.bootstrap.svc.cluster.local:5000" \
          --set-json 'apiserver.extraVolumes=[{"name":"zot-config-storage","hostPath":{"path":"/opt/zot-config-bootstrap","type":"DirectoryOrCreate"}}]' \
          --set-json 'apiserver.zot.extraVolumes=[{"name":"zot-config-storage","hostPath":{"path":"/opt/zot-config-bootstrap","type":"DirectoryOrCreate"}}]' \
          --namespace "bootstrap" \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  deploy:kubernetes:network:
    aliases: [deploy:network]
    desc: Deploy a network of Directory servers in Kubernetes (1 bootstrap + 3 peers)
    vars:
      HELM_CHART_PATH: '{{ .ROOT_DIR }}/install/charts/dir'
      HELM_VALUES_PATH: '{{ .ROOT_DIR }}/install/charts/dir/values.yaml'
    cmds:
      # Deploy bootstrap with explicit var passing (not as dependency)
      - task: deploy:kubernetes:network:bootstrap
        vars:
          PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL }}'
      # Create zot configuration for each peer using helper task
      - for:
          matrix:
            PEER: ['peer1', 'peer2', 'peer3']
        task: deploy:zot:config
        vars:
          ZOT_CONFIG_DIR: /opt/zot-config-{{ .ITEM.PEER }}

      # Deploy the peer servers using Helm
      - for:
          matrix:
            PEER: ['peer1', 'peer2', 'peer3']
        cmd: |
          export $(cat .env)
          {{ .HELM_BIN }} upgrade agntcy-dir \
            {{ .HELM_CHART_PATH }} \
            -f {{ .HELM_VALUES_PATH }} \
            --set apiserver.image.tag="{{ .IMAGE_TAG }}" \
            {{ if .PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
            --set apiserver.config.store.oci.registry_address="agntcy-dir-zot.{{ .ITEM.PEER }}.svc.cluster.local:5000" \
            --set apiserver.config.routing.bootstrap_peers[0]="/dns4/agntcy-dir-apiserver-routing.bootstrap.svc.cluster.local/tcp/8999/p2p/${BOOTSTRAP_PEER_ID}" \
            --set apiserver.config.routing.directory_api_address="agntcy-dir-apiserver.{{ .ITEM.PEER }}.svc.cluster.local:8888" \
            --set-json 'apiserver.extraVolumes=[{"name":"zot-config-storage","hostPath":{"path":"/opt/zot-config-{{ .ITEM.PEER }}","type":"DirectoryOrCreate"}}]' \
            --set-json 'apiserver.zot.extraVolumes=[{"name":"zot-config-storage","hostPath":{"path":"/opt/zot-config-{{ .ITEM.PEER }}","type":"DirectoryOrCreate"}}]' \
            --namespace "{{ .ITEM.PEER }}" \
            --create-namespace \
            --install \
            --wait \
            --wait-for-jobs \
            --timeout "15m"

  deploy:kubernetes:network:port-forward:
    aliases: [deploy:network:port-forward]
    desc: Set up port-forwarding for the peers
    cmds:
      # Port-forward dependency services
      - '{{ .KUBECTL_BIN }} port-forward svc/agntcy-dir-apiserver -n peer1 8890:8888 &'
      - '{{ .KUBECTL_BIN }} port-forward svc/agntcy-dir-apiserver -n peer2 8891:8888 &'
      - '{{ .KUBECTL_BIN }} port-forward svc/agntcy-dir-apiserver -n peer3 8892:8888 &'

      # Delay to ensure services are online
      - sleep 10

  deploy:kubernetes:network:port-forward:cleanup:
    aliases: [deploy:network:port-forward:cleanup]
    desc: Cleanup port-forwarding processes
    cmds:
      # Kill any existing port-forward processes for the agntcy-dir-apiserver service
      - kill -9 $(ps aux | grep port-forward | grep agntcy-dir-apiserver | awk '{print $2}') || true

  deploy:kubernetes:network:cleanup:
    aliases: [deploy:network:cleanup]
    desc: Cleanup Kubernetes environment for network deployment
    vars:
      # Kind args
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
    cmds:
      # Delete helm releases
      - for:
          matrix:
            PEER: ['bootstrap', 'peer1', 'peer2', 'peer3']
        cmd: |
          {{ .HELM_BIN }} delete --namespace {{ .ITEM.PEER }} agntcy-dir

      - '{{ .KIND_BIN }} delete cluster --name {{ .KIND_CLUSTER_NAME }}'

  deploy:zot:config:
    internal: true
    desc: Create zot configuration directory and file
    vars:
      ZOT_CONFIG_DIR: '{{ .ZOT_CONFIG_DIR | default "/opt/zot-config" }}'
    cmds:
      # Create host directory for zot configuration hot reload
      - |
        if ! {{ .KUBECTL_BIN }} get nodes -o jsonpath='{.items[0].metadata.name}' | xargs -I {} \
        docker exec {} mkdir -p {{ .ZOT_CONFIG_DIR }}; then
          echo "Failed to create zot config directory: {{ .ZOT_CONFIG_DIR }}"
          exit 1
        fi

      # Create zot configuration file with proper permissions
      - |
        if ! {{ .KUBECTL_BIN }} get nodes -o jsonpath='{.items[0].metadata.name}' | xargs -I {} \
        docker exec {} sh -c 'cat > {{ .ZOT_CONFIG_DIR }}/config.json << "EOF"
        {
          "distSpecVersion": "1.1.1",
          "storage": {
            "rootDirectory": "/var/lib/registry"
          },
          "http": {
            "address": "0.0.0.0",
            "port": "5000"
          },
          "log": {
            "level": "info"
          },
          "extensions": {
            "search": {
              "enable": true
            },
            "trust": {
              "enable": true,
              "cosign": true,
              "notation": false
            }
          }
        }
        EOF
        chmod 666 {{ .ZOT_CONFIG_DIR }}/config.json
        chmod 777 {{ .ZOT_CONFIG_DIR }}'; then
          echo "Failed to create zot config file: {{ .ZOT_CONFIG_DIR }}/config.json"
          exit 1
        fi

  ##
  ## Test
  ##
  test:unit:
    desc: Run unit tests on codebase
    aliases: [test]
    deps: # run in parallel
      - cli:test
      - api:test
      - client:test
      - server:test
    cmds:
      - echo "Success"

  test:unit:cover:
    desc: Run all unit tests with coverage and generate reports
    deps:
      - task: cli:test
        vars:
          EXTRA_ARGS: '-coverprofile {{.ROOT_DIR}}/coverage-dir-cli.out -json > {{.ROOT_DIR}}/test-report-dir-cli.json'
      - task: api:test
        vars:
          EXTRA_ARGS: '-coverprofile {{.ROOT_DIR}}/coverage-dir-api.out -json > {{.ROOT_DIR}}/test-report-dir-api.json'
      - task: client:test
        vars:
          EXTRA_ARGS: '-coverprofile {{.ROOT_DIR}}/coverage-dir-client.out -json > {{.ROOT_DIR}}/test-report-dir-client.json'
      - task: server:test
        vars:
          EXTRA_ARGS: '-coverprofile {{.ROOT_DIR}}/coverage-dir-server.out -json > {{.ROOT_DIR}}/test-report-dir-server.json'

  test:unit:coverage:html:
    desc: Extended per-module coverage run with summaries & HTML (non-regression)
    cmds:
      - |
        set -euo pipefail
        echo "[coverage] Cleaning previous coverage artifacts"
        rm -f coverage-*.out coverage-summary.txt test-report-*.json coverage-*.html || true
      - |
        set -euo pipefail
        modules="api client server cli"
        for m in $modules; do
          if [ -d "$m" ]; then
            echo "[coverage] Testing module: $m"
            (
              cd "$m"
              if go test ./... -covermode=atomic -coverprofile "../coverage-$m.out" -json 2>&1 | tee "../test-report-$m.json" >/dev/null; then
                echo "[coverage] Completed: $m"
              else
                status=$?
                echo "[coverage][warn] Tests failed in $m (exit $status); continuing"
              fi
              if [ ! -s "../coverage-$m.out" ]; then
                echo "mode: atomic" > "../coverage-$m.out"
              fi
            )
          fi
        done
      - |
        set -euo pipefail
        echo "[coverage] Generating per-module summaries"
        : > coverage-summary.txt
        modules="api client server cli"
        for m in $modules; do
          if [ -f "coverage-$m.out" ]; then
            if (cd "$m" && go tool cover -func=../coverage-$m.out > ../coverage-$m.func.txt 2>/dev/null); then
              tail -n1 coverage-$m.func.txt | sed "s/^total:/[$m] total:/" >> coverage-summary.txt || true
            else
              echo "[$m] total: (error generating summary)" >> coverage-summary.txt
            fi
          fi
        done
        echo "[coverage] Summary:"; cat coverage-summary.txt
      - |
        set -euo pipefail
        echo "[coverage] Generating HTML reports"
        modules="api client server cli"
        for m in $modules; do
          if [ -f "coverage-$m.out" ] && [ -d "$m" ]; then
            (cd "$m" && go tool cover -html=../coverage-$m.out -o ../coverage-$m.html || true)
          fi
        done
        echo "[coverage] Generated HTML files:"; ls -1 coverage-*.html 2>/dev/null | sed 's/^/  - /' || echo "  (none)"

  bench:
    desc: Run bench tests on codebase
    cmds: # run in sequence
      - task: server:bench
      - echo "Done"

  test:e2e:
    desc: Run end-to-end tests for local deployment and network deployment
    aliases: [e2e]
    cmds:
      - task: test:e2e:local
      - task: test:e2e:network

  test:e2e:local:cli:
    desc: Run only local CLI tests (with dedicated infrastructure)
    aliases: [e2e:local:cli]
    vars:
      PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL | default "1s" }}'
    env:
      DIRECTORY_E2E_DEPLOYMENT_MODE: 'local'
    cmds:
      - defer: { task: deploy:kubernetes:local:cleanup }
      - defer: { task: deploy:kubernetes:local:port-forward:cleanup }
      - task: deploy:kubernetes:local
        vars:
          DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL }}'
      - task: deploy:kubernetes:local:port-forward
      - 'go test -C ./e2e/local . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v'

  test:e2e:client:
    desc: Run only client library tests (with dedicated infrastructure)
    aliases: [e2e:client]
    vars:
      PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL | default "1s" }}'
    env:
      DIRECTORY_E2E_DEPLOYMENT_MODE: 'local'
    cmds:
      - defer: { task: deploy:kubernetes:local:cleanup }
      - defer: { task: deploy:kubernetes:local:port-forward:cleanup }
      - task: deploy:kubernetes:local
        vars:
          DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL }}'
      - task: deploy:kubernetes:local:port-forward
      - 'go test -C ./e2e/client . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v'

  test:e2e:local:
    desc: Run end-to-end tests for local deployment (Client library + CLI tests)
    aliases: [e2e:local]
    vars:
      PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL | default "1s" }}'
    env:
      DIRECTORY_E2E_DEPLOYMENT_MODE: 'local'
    cmds:
      - defer: { task: deploy:kubernetes:local:cleanup }
      - defer: { task: deploy:kubernetes:local:port-forward:cleanup }
      # Bootstrap infrastructure once for both test suites
      - task: deploy:kubernetes:local
        vars:
          DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL }}'
      - task: deploy:kubernetes:local:port-forward
      # Run client library tests first (faster feedback)
      - 'go test -C ./e2e/client . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v'
      # Run local CLI tests second (same infrastructure)
      - 'go test -C ./e2e/local . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v'

  test:e2e:network:
    desc: Run end-to-end tests for network deployment (Multi-peer CLI tests)
    aliases: [e2e:network]
    vars:
      PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL | default "1s" }}'
    env:
      DIRECTORY_E2E_DEPLOYMENT_MODE: 'network'
    cmds:
      - defer: { task: deploy:kubernetes:network:cleanup }
      - defer: { task: deploy:kubernetes:network:port-forward:cleanup }
      # Bootstrap
      # NOTE: Run as a dedicated task instead of dependency, otherwise the port forwarding won't work
      - task: deploy:kubernetes:network
        vars:
          PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL }}'
      - task: deploy:kubernetes:network:port-forward
      # Run network tests with proper isolation and cleanup
      - 'go test -C ./e2e/network . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v'

  # TODO: move spire out from here
  # TODO: change to Ingress services instead of LoadBalancer
  test:spire:
    desc: Test SPIRE federation setup between DIR and DIRCTL clusters
    vars:
      DIR_TRUST_DOMAIN: '{{ .DIR_TRUST_DOMAIN | default "dir.example" }}'
      DIRCTL_TRUST_DOMAIN: '{{ .DIRCTL_TRUST_DOMAIN | default "dirctl.example" }}'
    cmds:
      # Setup DIR cluster
      - task: deploy:kubernetes:setup-cluster
        vars:
          KIND_CLUSTER_NAME: '{{ .DIR_TRUST_DOMAIN }}'

      # Start cloud provider for LoadBalancer support
      - |
        echo "Starting Kind cloud provider for LoadBalancer support..."
        go run sigs.k8s.io/cloud-provider-kind@latest > /dev/null 2>&1 &
        echo "Cloud provider started in background"

      # Deploy SPIRE on DIR cluster
      - task: deploy:kubernetes:spire
        vars:
          TRUST_DOMAIN: '{{ .DIR_TRUST_DOMAIN }}'
          BUNDLE_PATH: /tmp/{{ .DIR_TRUST_DOMAIN }}.spiffe

      # Setup DIRCTL cluster
      - task: deploy:kubernetes:setup-cluster
        vars:
          KIND_CLUSTER_NAME: '{{ .DIRCTL_TRUST_DOMAIN }}'

      # Start cloud provider for LoadBalancer support
      - |
        echo "Starting Kind cloud provider for LoadBalancer support..."
        go run sigs.k8s.io/cloud-provider-kind@latest > /dev/null 2>&1 &
        echo "Cloud provider started in background"

      # Deploy SPIRE on DIRCTL cluster
      - task: deploy:kubernetes:spire
        vars:
          TRUST_DOMAIN: '{{ .DIRCTL_TRUST_DOMAIN }}'
          BUNDLE_PATH: /tmp/{{ .DIRCTL_TRUST_DOMAIN }}.spiffe

      # Get DIR cluster service addresses
      - task: deploy:kubernetes:context
        vars:
          KIND_CLUSTER_NAME: '{{ .DIR_TRUST_DOMAIN }}'
      - |
        echo "Getting DIR cluster service addresses..."
        DIR_BUNDLE_IP=$(kubectl get service -n spire spire-server -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null || echo "127.0.0.1")
        echo "DIR_BUNDLE_ADDRESS=${DIR_BUNDLE_IP}:8443" >> /tmp/spire-addresses.env

      # Get DIRCTL cluster service addresses
      - task: deploy:kubernetes:context
        vars:
          KIND_CLUSTER_NAME: '{{ .DIRCTL_TRUST_DOMAIN }}'
      - |
        echo "Getting DIRCTL cluster service addresses..."
        DIRCTL_BUNDLE_IP=$(kubectl get service -n spire spire-server -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null || echo "127.0.0.1")
        echo "DIRCTL_BUNDLE_ADDRESS=${DIRCTL_BUNDLE_IP}:8443" >> /tmp/spire-addresses.env

      # Create DIR server federation config
      - |
        source /tmp/spire-addresses.env
        echo "Creating DIR server federation config..."
        cat > /tmp/server-federation.yaml << EOF
        apiserver:
          service:
            type: LoadBalancer
          spire:
            enabled: true
            trustDomain: {{ .DIR_TRUST_DOMAIN }}
            federation:
              - trustDomain: {{ .DIRCTL_TRUST_DOMAIN }}
                bundleEndpointURL: https://${DIRCTL_BUNDLE_ADDRESS}
                bundleEndpointProfile:
                  type: https_spiffe
                  endpointSPIFFEID: spiffe://{{ .DIRCTL_TRUST_DOMAIN }}/spire/server
                trustDomainBundle: |-
                  $(cat /tmp/{{ .DIRCTL_TRUST_DOMAIN }}.spiffe)
        EOF

      # Deploy DIR server with federation
      - task: deploy:kubernetes:context
        vars:
          KIND_CLUSTER_NAME: '{{ .DIR_TRUST_DOMAIN }}'
      - task: deploy:kubernetes:dir
        vars:
          KIND_CLUSTER_NAME: '{{ .DIR_TRUST_DOMAIN }}'
          HELM_EXTRA_ARGS: '-f /tmp/server-federation.yaml'

      # Get DIR API server address
      - task: deploy:kubernetes:context
        vars:
          KIND_CLUSTER_NAME: '{{ .DIR_TRUST_DOMAIN }}'
      - |
        echo "Getting DIR API server address..."
        DIR_API_IP=$(kubectl get service -n dir-server dir-apiserver -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null || echo "127.0.0.1")
        echo "DIR_SERVER_ADDRESS=${DIR_API_IP}:8888" >> /tmp/spire-addresses.env

      # Create DIRCTL client federation config (for dirctl in dir.example)
      - |
        source /tmp/spire-addresses.env
        echo "Creating DIRCTL client federation config for dir.example..."
        cat > /tmp/client-federation-dir-example.yaml << EOF
        env:
          - name: DIRECTORY_CLIENT_SERVER_ADDRESS
            value: ${DIR_SERVER_ADDRESS}
        spire:
          enabled: true
          trustDomain: {{ .DIR_TRUST_DOMAIN }}
        EOF

      # Deploy DIRCTL client in dir.example trust domain (same cluster as dir)
      - task: deploy:kubernetes:context
        vars:
          KIND_CLUSTER_NAME: '{{ .DIR_TRUST_DOMAIN }}'
      - task: deploy:kubernetes:dirctl
        vars:
          KIND_CLUSTER_NAME: '{{ .DIR_TRUST_DOMAIN }}'
          HELM_NAMESPACE: 'dir-client'
          HELM_EXTRA_ARGS: '-f /tmp/client-federation-dir-example.yaml'

      # Create DIRCTL client federation config (for dirctl.example cluster)
      - |
        source /tmp/spire-addresses.env
        echo "Creating DIRCTL client federation config..."
        cat > /tmp/client-federation.yaml << EOF
        env:
          - name: DIRECTORY_CLIENT_SERVER_ADDRESS
            value: ${DIR_SERVER_ADDRESS}
        spire:
          enabled: true
          trustDomain: {{ .DIRCTL_TRUST_DOMAIN }}
          federation:
            - trustDomain: {{ .DIR_TRUST_DOMAIN }}
              bundleEndpointURL: https://${DIR_BUNDLE_ADDRESS}
              bundleEndpointProfile:
                type: https_spiffe
                endpointSPIFFEID: spiffe://{{ .DIR_TRUST_DOMAIN }}/spire/server
              trustDomainBundle: |-
                $(cat /tmp/{{ .DIR_TRUST_DOMAIN }}.spiffe)
        EOF

      # Deploy DIRCTL client with federation (in dirctl.example cluster)
      - task: deploy:kubernetes:context
        vars:
          KIND_CLUSTER_NAME: '{{ .DIRCTL_TRUST_DOMAIN }}'
      - task: deploy:kubernetes:dirctl
        vars:
          KIND_CLUSTER_NAME: '{{ .DIRCTL_TRUST_DOMAIN }}'
          HELM_EXTRA_ARGS: '-f /tmp/client-federation.yaml'

      # Display completion status
      - |
        source /tmp/spire-addresses.env
        echo "=============================================="
        echo "SPIRE federation test deployment complete!"
        echo "=============================================="
        echo "DIR Server: ${DIR_SERVER_ADDRESS}"
        echo "DIR Bundle: ${DIR_BUNDLE_ADDRESS}"
        echo "DIRCTL Bundle: ${DIRCTL_BUNDLE_ADDRESS}"
        echo ""
        echo "Trust domains setup:"
        echo "  DIR: {{ .DIR_TRUST_DOMAIN }}"
        echo "  DIRCTL Internal: {{ .DIR_TRUST_DOMAIN }}"
        echo "  DIRCTL External: {{ .DIRCTL_TRUST_DOMAIN }}"
        echo ""
        echo "To verify deployment:"
        echo "  kubectl --context kind-{{ .DIR_TRUST_DOMAIN }} get pods -n dir-server"
        echo "  kubectl --context kind-{{ .DIR_TRUST_DOMAIN }} logs -n dir-client -l app.kubernetes.io/name=dirctl"
        echo "  kubectl --context kind-{{ .DIRCTL_TRUST_DOMAIN }} logs -n dir-client -l app.kubernetes.io/name=dirctl"
        echo ""
        echo "To cleanup:"
        echo "  task test:spire:cleanup"

  test:spire:cleanup:
    desc: Cleanup SPIRE federation test clusters
    vars:
      DIR_TRUST_DOMAIN: '{{ .DIR_TRUST_DOMAIN | default "dir.example" }}'
      DIRCTL_TRUST_DOMAIN: '{{ .DIRCTL_TRUST_DOMAIN | default "dirctl.example" }}'
    cmds:
      - echo "Cleaning up DIR cluster ({{ .DIR_TRUST_DOMAIN }})..."
      - task: deploy:kubernetes:cleanup
        vars:
          KIND_CLUSTER_NAME: '{{ .DIR_TRUST_DOMAIN }}'
      - echo "Cleaning up DIRCTL cluster ({{ .DIRCTL_TRUST_DOMAIN }})..."
      - task: deploy:kubernetes:cleanup
        vars:
          KIND_CLUSTER_NAME: '{{ .DIRCTL_TRUST_DOMAIN }}'
      - echo "Cleanup complete!"

  ##
  ## Linters
  ##
  lint:go:
    desc: Run Golang linters
    deps:
      - task: deps:golangci-lint
    vars:
      FIX: '{{ .FIX | default "false" }}'
      FIX_FLAG: '{{if eq .FIX "true"}}--fix{{end}}'
      GO_MOD_DIR:
        sh: find . -name go.mod -not -path "./tmp*" -exec dirname {} \;
    cmds:
      - for: { var: GO_MOD_DIR }
        cmd: |
          echo "Running golangci-lint in {{.ITEM}}"
          cd {{.ITEM}}
          {{.GOLANGCI_LINT_BIN}} run --config {{.ROOT_DIR}}/.golangci.yml {{.FIX_FLAG}}

  lint:buf:
    desc: Run Buf linters
    deps:
      - task: deps:protoc
      - task: deps:bufbuild
    dir: ./api
    cmds:
      - '{{.BUFBUILD_BIN}} lint'

  lint:
    desc: Run all linters
    deps:
      - lint:go
      - lint:buf

  ##
  ## License
  ##
  license:
    desc: Check licenses
    deps:
      - task: deps:licensei
    vars:
      GO_MOD_DIR:
        sh: find . -name go.mod -exec dirname {} \;
    cmds:
      - for: { var: GO_MOD_DIR }
        cmd: echo "Running licensei in {{.ITEM}}" && cd {{.ITEM}} && {{ .LICENSEI_BIN }} check --config {{.ROOT_DIR}}/.licensei.toml

  license:cache:
    desc: Check licenses
    deps:
      - task: deps:licensei
    vars:
      GO_MOD_DIR:
        sh: find . -name go.mod -exec dirname {} \;
    cmds:
      - for: { var: GO_MOD_DIR }
        cmd: echo "Running licensei in {{.ITEM}}" && cd {{.ITEM}} && {{ .LICENSEI_BIN }} cache --config {{.ROOT_DIR}}/.licensei.toml

  ##
  ## Various proof-of-concept tasks
  ##
  poc:integration:
    desc: Run integration against VS Code and Continue proof-of-concept.
    dir: ./docs/research/integrations
    prompt:
      - |
        Are you sure you want to run integration proof-of-concept?
        This will overwrite your local workspace VSCode and Continue configuration.
    vars:
      RECORD_FILE: '{{ .RECORD_FILE | default "docs/research/integrations/demo.record.json" }}'
    cmd: |
      # Prepare Python environment
      python3 -m venv venv
      . ./venv/bin/activate
      python3 -m pip install pyyaml

      # Run script
      python3 ./importer.py \
        -record={{.ROOT_DIR}}/{{.RECORD_FILE}} \
        -vscode_path={{.ROOT_DIR}}/.vscode \
        -continue_path={{.ROOT_DIR}}/.continue/assistants

      # Print env requirements
      cat .env.example

  poc:mcp-to-oasf:
    desc: Import MCP-to-OASF Exporter Agent into the current workspace.
    cmds:
      - task: poc:integration
        vars:
          RECORD_FILE: 'docs/research/integrations/mcp-to-oasf-agent/extractor.record.json'

  ##
  ## Dependencies
  ##
  deps:
    desc: Install dependencies
    cmds:
      - task: deps:helm
      - task: deps:kubectl
      - task: deps:kind
      - task: deps:protoc
      - task: deps:bufbuild
      - task: deps:uv
      - task: deps:cosign

  deps:bin-dir:
    desc: Create bin directory
    internal: true
    run: once
    cmd: mkdir -p {{.BIN_DIR}}
    status:
      - test -d {{.BIN_DIR}}

  deps:dirctl-bin:
    desc: Compile dirctl binary
    internal: true
    run: once
    cmds:
      - task: cli:compile
    status:
      - test -f {{.BIN_DIR}}/dirctl

  deps:helm:
    desc: Ensure supported Helm version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which curl
      - which tar
    cmds:
      - cmd: echo "Downloading Helm v{{.HELM_VERSION}}..."
      - cmd: curl -sSfL 'https://get.helm.sh/helm-v{{.HELM_VERSION}}-{{OS}}-{{ARCH}}.tar.gz' --output - | tar xzvOf - '{{OS}}-{{ARCH}}/helm' > {{.HELM_BIN}}
      - cmd: chmod +x {{.HELM_BIN}}
    status:
      - test -x {{.HELM_BIN}}

  deps:kubectl:
    desc: Ensure supported kubectl version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which curl
    cmds:
      - cmd: echo "Downloading Kubectl v{{.KUBECTL_VERSION}}..."
      - cmd: curl -L "https://dl.k8s.io/release/v{{.KUBECTL_VERSION}}/bin/{{OS}}/{{ARCH}}/kubectl" -o {{.KUBECTL_BIN}}
      - cmd: chmod +x {{.KUBECTL_BIN}}
    status:
      - test -x {{.KUBECTL_BIN}}

  deps:kind:
    desc: Ensure supported kind version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which go
    cmds:
      - cmd: echo "Downloading Kind v{{.KIND_VERSION}}..."
      - cmd: GOBIN={{.BIN_DIR}} go install sigs.k8s.io/kind@v{{.KIND_VERSION}}
      - cmd: mv {{.BIN_DIR}}/kind {{.KIND_BIN}}
    status:
      - test -x {{.KIND_BIN}}

  deps:protoc:
    desc: Ensure supported Protoc version and plugins are installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which go
      - which curl
      - which unzip
    vars:
      ARCH_TYPE: '{{ if eq ARCH "arm64" }}aarch_64{{ else if eq ARCH "amd64" }}x86_64{{else if eq ARCH "s390x"}}x390_64{{ else }}{{ARCH}}{{ end }}'
      OS_VARIANT: '{{ if eq OS "darwin" }}osx-universal_binary{{ else if eq OS "windows" }}win64{{else}}linux-{{.ARCH_TYPE}}{{ end }}'
    cmds:
      - cmd: echo "Downloading Protoc v{{.PROTOC_VERSION}}..."
      - cmd: |
          curl -sL https://github.com/protocolbuffers/protobuf/releases/download/v{{.PROTOC_VERSION}}/protoc-{{.PROTOC_VERSION}}-{{.OS_VARIANT}}.zip -o {{.BIN_DIR}}/tmp.zip
          unzip -j {{.BIN_DIR}}/tmp.zip "bin/protoc" -d {{.BIN_DIR}}
          mv {{.BIN_DIR}}/protoc {{.PROTOC_BIN}}
          rm {{.BIN_DIR}}/tmp.zip
      - cmd: chmod +x {{.PROTOC_BIN}}
      - cmd: echo "Downloading go plugins for protoc..."
      - cmd: go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
      - cmd: go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
      - cmd: go install github.com/NathanBaulch/protoc-gen-cobra@latest
    status:
      - test -x {{.PROTOC_BIN}}

  deps:bufbuild:
    desc: Ensure supported bufbuild version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which curl
    vars:
      ARCH_TYPE: '{{ if eq ARCH "amd64" }}x86_64{{ else }}{{ARCH}}{{ end }}'
    cmds:
      - cmd: echo "Downloading BufBuild v{{.BUFBUILD_VERSION}}..."
      - cmd: |
          curl -L "https://github.com/bufbuild/buf/releases/download/v{{.BUFBUILD_VERSION}}/buf-{{OS}}-{{.ARCH_TYPE}}" -o {{.BUFBUILD_BIN}}
      - cmd: chmod +x {{.BUFBUILD_BIN}}
    status:
      - test -x {{.BUFBUILD_BIN}}

  deps:tidy:
    desc: Ensure dependencies are up-to-date
    vars:
      GO_MOD_DIR:
        sh: find . -name go.mod -exec dirname {} \;
    cmds:
      - for: { var: GO_MOD_DIR }
        cmd: go -C {{.ITEM}} mod tidy -go={{.GO_VERSION}}

  deps:multimod-bin:
    desc: Build the multimod binary
    internal: true
    deps:
      - deps:bin-dir
    vars:
      MULTIMOD_REPO_DIR: '{{ .BIN_DIR }}/opentelemetry-go-build-tools'
    cmds:
      - git clone https://github.com/open-telemetry/opentelemetry-go-build-tools --branch multimod/v{{.MULTIMOD_VERSION}} {{.MULTIMOD_REPO_DIR}}
      - go build -C {{.MULTIMOD_REPO_DIR}}/multimod -o {{.MULTIMOD_BIN}} main.go
      - rm -rf {{.MULTIMOD_REPO_DIR}}
    status:
      - test -x {{.MULTIMOD_BIN}}

  deps:golangci-lint:
    desc: Install golangci-lint
    internal: true
    deps:
      - deps:bin-dir
    cmds:
      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s v{{.GOLANGCI_LINT_VERSION}}
      - mv {{.BIN_DIR}}/golangci-lint {{.GOLANGCI_LINT_BIN}}
      - chmod +x {{.GOLANGCI_LINT_BIN}}
    status:
      - test -x {{.GOLANGCI_LINT_BIN}}

  deps:licensei:
    desc: Install licensei
    internal: true
    deps:
      - deps:bin-dir
    cmds:
      - curl -sfL https://raw.githubusercontent.com/goph/licensei/master/install.sh | bash -s v{{.LICENSEI_VERSION}}
      - mv {{.BIN_DIR}}/licensei {{.LICENSEI_BIN}}
      - chmod +x {{.LICENSEI_BIN}}
    status:
      - test -x {{.LICENSEI_BIN}}

  deps:uv:
    desc: Install uv
    internal: true
    deps:
      - deps:bin-dir
    env:
      UV_INSTALL_DIR: '{{ .BIN_DIR }}'
    cmds:
      - curl -sfL https://astral.sh/uv/{{.UV_VERSION}}/install.sh | sh
      - mv {{.BIN_DIR}}/uv {{.UV_BIN}}
      - chmod +x {{.UV_BIN}}
      - rm {{.BIN_DIR}}/uvx
    status:
      - test -x {{.BIN_DIR}}/uv

  deps:cosign:
    desc: Install sigstore cosign
    dir: '{{ .BIN_DIR }}'
    internal: true
    cmds:
      - curl -sfL https://github.com/sigstore/cosign/releases/download/v{{.COSIGN_VERSION}}/cosign-{{OS}}-{{ARCH}} -o cosign-{{.COSIGN_VERSION}}
      - chmod +x cosign-{{.COSIGN_VERSION}}
    status:
      - test -x cosign-{{.COSIGN_VERSION}}

  ##
  ## Helm
  ##
  helm:gen:
    desc: Update Helm dependencies for chart and subcharts
    internal: true
    deps:
      - deps:helm
    vars:
      HELM_ALL_CHART_PATHS:
        sh: find . -name Chart.yaml -exec dirname {} \;
    cmds:
      # Add Helm repo
      - '{{ .HELM_BIN }} repo add project-zot http://zotregistry.dev/helm-charts'
      - '{{ .HELM_BIN }} repo add spiffe https://spiffe.github.io/helm-charts-hardened'

      # Update dependencies
      - for: { var: HELM_ALL_CHART_PATHS }
        cmd: 'cd {{ .ITEM }} && {{ .HELM_BIN }} dependency update'