Taskfile.yml

version: '3'

env:
  VERSION: "4.0.1"
  DATE: 
    sh: date "+%Y.%m.%d"
  DCFILES: "-f dc-nginx.yaml -f dc-postgresql.yaml -f dc-redis.yaml -f dc-registry.yaml -f dc-exporter.yaml -f dc-jaeger.yaml -f dc-kubeview.yaml"

tasks:
  default:
    desc: "Print Help"
    cmds:
      - "task --list-all"

  install-deps:
    desc: "Install development dependencies"
    cmds:
      - curl -sSL https://install.python-poetry.org | python3 -
      - brew install helm
      - brew install helm-docs
      - brew install chart-releaser
      - brew install trivy
      - brew install cosign
      - brew install skopeo
      - brew install oras
      - brew install fluxcd/tap/flux

  docker-up:
    desc: "Start dev containers"
    dir: 'deploy/docker-compose'
    cmds:
      - docker compose {{.DCFILES}} up -d

  docker-images:
    desc: "Copy docker images"
    dir: '/tmp'
    cmds:
      # - skopeo login --tls-verify=false 127.0.0.1:4000
      # - skopeo login docker.io
      - skopeo copy --dest-tls-verify=false --override-os=linux docker://docker.io/library/python:3.12-rc-alpine docker://127.0.0.1:4000/python:3.12-rc-alpine
      - skopeo copy --dest-tls-verify=false --override-os=linux docker://docker.io/devopstales/registry-imega-test:1.0 docker://127.0.0.1:4000/registry-imega-test:1.0
      - skopeo copy --dest-tls-verify=false --override-os=linux docker://docker.io/devopstales/registry-imega-test:2.0 docker://127.0.0.1:4000/registry-imega-test:2.0
      - skopeo copy --dest-tls-verify=false --override-os=linux docker://docker.io/devopstales/registry-imega-test:3.0 docker://127.0.0.1:4000/registry-imega-test:3.0
      - docker pull devopstales/registry-imega-test:3.0
      - docker tag devopstales/registry-imega-test:3.0 127.0.0.1:4000/registry-imega-test:test
      - docker push 127.0.0.1:4000/registry-imega-test:test
      - cosign sign --key $HOME/.gnupg/cosign.key 127.0.0.1:4000/registry-imega-test:test -y 2>/dev/null
      # - oras login --plain-http 127.0.0.1:4000
      - oras copy --to-plain-http ghcr.io/aquasecurity/trivy-db:2 127.0.0.1:4000/trivy-db:2
      - oras copy --to-plain-http ghcr.io/aquasecurity/trivy-java-db:1 127.0.0.1:4000/trivy-java-db:1
      - helm pull oci://registry-1.docker.io/bitnamicharts/redis --version 17.9.5
      - helm push redis-17.9.5.tgz OCI://127.0.0.1:4000/helm-charts
      - rm -f redis-17.9.5.tgz
      - trivy i --format cosign-vuln 127.0.0.1:4000/registry-imega-test:1.0 > image.sbom
      - cosign attach sbom --sbom image.sbom 127.0.0.1:4000/registry-imega-test:1.0
      - rm -f image.sbom
      - git clone https://github.com/stefanprodan/podinfo.git /tmp/podinfo
      - |
        flux push artifact oci://127.0.0.1:4000/podinfo:$(git -C /tmp/podinfo rev-parse --short HEAD) \
        	--path="/tmp/podinfo/kustomize" \
        	--source="$(git -C /tmp/podinfo config --get remote.origin.url)" \
        	--revision="$(git -C /tmp/podinfo branch --show-current)@sha1:$(git rev-parse HEAD)"

  docker-down:
    desc: "Stop dev containers"
    dir: 'deploy/docker-compose'
    cmds:
      - docker compose {{.DCFILES}} down

  kubedash-requirements:
    desc: "Generate Kubedash requirements"
    dir: 'src/kubedash'
    cmds:
      - poetry export --without-hashes -f requirements.txt > requirements.txt

  kubedash-safety:
    desc: "Safety chack Kubedash requirements"
    dir: 'src/kubedash'
    cmds:
      - poetry export --without-hashes -f requirements.txt | safety check --stdin

  kubedash-audit:
    desc: "Run tests for Kubedash"
    dir: 'src/kubedash'
    cmds:
      - poetry run pip-audit

  kubedash-scan:
    desc: "Scan Kubedash for vulnerabilities"
    dir: 'src/kubedash'
    cmds:
      - trivy -q fs . --scanners vuln

  kubedash-lint:
    desc: "Lint Kubedash"
    dir: 'src/kubedash'
    cmds:
      - poetry run isort .
      - poetry run flake8 .
      #- poetry run autoflake --remove-all-unused-imports --recursive --remove-unused-variables --in-place .
      - poetry run black --check .

  kubedash-dev-build:
    desc: "Build Kubedash devel docker image"
    cmds:
      - rm -rf docker/kubedash/kubedash
      - cp -r src/kubedash docker/kubedash/kubedash
      - rm -f docker/kubedash/requirements.txt
      - cp docker/kubedash/kubedash/requirements.txt docker/kubedash/requirements.txt
      - rm -f docker/kubedash/gunicorn_conf.py
      - cp docker/kubedash/kubedash/gunicorn_conf.py docker/kubedash/gunicorn_conf.py
      - |
        docker build \
        -f docker/kubedash/Dockerfile \
        --build-arg BUILD_DATE={{.DATE}} \
        --build-arg VERSION={{.VERSION}}-devel \
        -t devopstales/kubedash:{{.VERSION}}-devel \
        docker/kubedash

  kubedash-dev-scan:
    desc: "Scan Kubedash devel docker image for vulnerabilities"
    cmds:
      - trivy -q i devopstales/kubedash:{{.VERSION}}-devel --scanners vuln

  kubedash-dev-sign:
    desc: "Sign Kubedash devel docker image"
    cmds:
      - cosign sign --key $HOME/.gnupg/cosign.key devopstales/kubedash:{{.VERSION}}-devel -y

  kubedash-dev-push:
    desc: "Push Kubedash devel docker image"
    cmds:
      - docker push devopstales/kubedash:{{.VERSION}}-devel

  kubedash-dev-rm:
    desc: "Remove Kubedash devel docker image"
    cmds:
      - docker rmi devopstales/kubedash:{{.VERSION}}-devel

  kubedash-dev:
    desc: "Build, scan, sign and push Kubedash devel docker image"
    cmds:
      - task: kubedash-dev-build
        run: true
      - task: kubedash-dev-scan
        run: true
      - task: kubedash-dev-push
        run: true

  kubedash-prod-build:
    desc: "Build Kubedash docker image"
    cmds:
      - rm -rf docker/kubedash/kubedash
      - cp -r src/kubedash docker/kubedash/kubedash
      - rm -f docker/kubedash/requirements.txt
      - cp docker/kubedash/kubedash/requirements.txt docker/kubedash/requirements.txt
      - rm -f docker/kubedash/gunicorn_conf.py
      - cp docker/kubedash/kubedash/gunicorn_conf.py docker/kubedash/gunicorn_conf.py
      - |
        docker build \
        --build-arg BUILD_DATE={{.DATE}} \
        --build-arg VERSION={{.VERSION}} \
        -t devopstales/kubedash:{{.VERSION}} \
        -t devopstales/kubedash:latest \
        -t ghcr.io/devopstales/kubedash:{{.VERSION}} \
        -t ghcr.io/devopstales/kubedash:latest \
        docker/kubedash

  kubedash-prod-scan:
    desc: "Scan Kubedash Dockerfile for vulnerabilities"
    cmds:
      - trivy -q i --scanners vuln devopstales/kubedash:{{.VERSION}}
      - trivy -q i --format cyclonedx --output sbom.cdx.json --scanners vuln devopstales/kubedash:{{.VERSION}} 

  kubedash-prod-push:
    desc: "Push Kubedash docker image"
    cmds:
      - docker push devopstales/kubedash:{{.VERSION}}
      - docker push devopstales/kubedash:latest
      - docker push ghcr.io/devopstales/kubedash:{{.VERSION}}
      - docker push ghcr.io/devopstales/kubedash:latest
      - |
        oras attach docker.io/devopstales/kubedash:{{.VERSION}} \
        --artifact-type application/vnd.cyclonedx+json \
        --annotation "org.opencontainers.image.description=SBOM for kubedash" \
        --annotation "org.opencontainers.artifact.description=SBOM for kubedash" \
        --annotation "org.opencontainers.artifact.type=sbom" \
        --annotation "org.cyclonedx.bom.version=1.4" \
        --annotation "org.opencontainers.ref.name=kubedash-{{.VERSION}}" \
        --annotation "org.opencontainers.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
        sbom.cdx.json
      - |
        oras attach docker.io/devopstales/kubedash:latest \
        --artifact-type application/vnd.cyclonedx+json \
        --annotation "org.opencontainers.image.description=SBOM for kubedash" \
        --annotation "org.opencontainers.artifact.description=SBOM for kubedash" \
        --annotation "org.opencontainers.artifact.type=sbom" \
        --annotation "org.cyclonedx.bom.version=1.4" \
        --annotation "org.opencontainers.ref.name=kubedash-{{.VERSION}}" \
        --annotation "org.opencontainers.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
        sbom.cdx.json
      - |
        oras attach ghcr.io/devopstales/kubedash:{{.VERSION}} \
        --artifact-type application/vnd.cyclonedx+json \
        --annotation "org.opencontainers.image.description=SBOM for kubedash" \
        --annotation "org.opencontainers.artifact.description=SBOM for kubedash" \
        --annotation "org.opencontainers.artifact.type=sbom" \
        --annotation "org.cyclonedx.bom.version=1.4" \
        --annotation "org.opencontainers.ref.name=kubedash-{{.VERSION}}" \
        --annotation "org.opencontainers.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
        sbom.cdx.json
      - |
        oras attach ghcr.io/devopstales/kubedash:latest \
        --artifact-type application/vnd.cyclonedx+json \
        --annotation "org.opencontainers.image.description=SBOM for kubedash" \
        --annotation "org.opencontainers.artifact.description=SBOM for kubedash" \
        --annotation "org.opencontainers.artifact.type=sbom" \
        --annotation "org.cyclonedx.bom.version=1.4" \
        --annotation "org.opencontainers.ref.name=kubedash-{{.VERSION}}" \
        --annotation "org.opencontainers.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
        sbom.cdx.json
      - rm -f sbom.cdx.json

  kubedash-prod-sign:
    desc: "Sign Kubedash docker image"
    cmds:
      - cosign sign -y --upload=true --key $HOME/.gnupg/cosign.key devopstales/kubedash:{{.VERSION}}
      - cosign sign -y --upload=true --key $HOME/.gnupg/cosign.key devopstales/kubedash:latest
      - cosign sign -y --upload=true --key $HOME/.gnupg/cosign.key ghcr.io/devopstales/kubedash:{{.VERSION}}
      - cosign sign -y --upload=true --key $HOME/.gnupg/cosign.key ghcr.io/devopstales/kubedash:latest

  kubedash-prod-rm:
    desc: "Remove Kubedash docker image"
    cmds:
      - rm sbom.cdx.json
      - docker rmi devopstales/kubedash:{{.VERSION}}
      - docker rmi ghcr.io/devopstales/kubedash:{{.VERSION}}

  kubedash-prod:
    desc: "Build, scan, sign and push Kubedash docker image"
    cmds:
      - task: kubedash-prod-build
        run: true
      - task: kubedash-prod-scan
        run: true
      - task: kubedash-prod-push
        run: true
      - task: kubedash-prod-sign
        run: true
      - task: kubedash-prod-rm
        run: true

  kdlogin-build:
    desc: "Build kubectl-kdlogin"
    dir: 'src/kdlogin'
    cmds:
      - go mod tidy
      - >-
        if command -v gsed >/dev/null 2>&1; then
          gsed -i "s|AppVersion        = .*|AppVersion        = \"{{.VERSION}}\"|" main.go
        else
          sed -i '' "s|AppVersion        = .*|AppVersion        = \"{{.VERSION}}\"|" main.go
        fi
      - rm -rf dist/{windows,linux,osx,release}
      - rm -f dist/choco/*.nupkg
      - env CGO_ENABLED=0 go build -o dist/linux/kubectl-kdlogin main.go
      - env CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -o dist/osx/kubectl-kdlogin main.go
      - env CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -o dist/windows/kubectl-kdlogin.exe main.go
    status:
      - test -f dist/linux/kubectl-kdlogin
      - test -f dist/osx/kubectl-kdlogin
      - test -f dist/windows/kubectl-kdlogin.exe

  kdlogin-scan:
   desc: "Scan kubectl-kdlogin for vulnerabilities"
   dir: 'src/kdlogin'
   cmds:
     - trivy -q fs .

  helm-docs:
   desc: "Generate Helm Chart documentation"
   dir: 'deploy/charts'
   cmds:
    - helm-docs

  helm-build:
    desc: "Build Helm Chart"
    dir: 'deploy/charts'
    cmds:
      - helm dependency update
      - helm package --version {{.VERSION}} --app-version {{.VERSION}} .
      - helm push kubedash-{{.VERSION}}.tgz oci://registry-1.docker.io/devopstales &> push-metadata.txt

  helm-sign:
    desc: "Sign Helm Chart"
    dir: 'deploy/charts'
    cmds:
      - cosign sign-blob -y --key $HOME/.gnupg/cosign.key kubedash-{{.VERSION}}.tgz --bundle kubedash-{{.VERSION}}.tgz.cosign.bundle
      #- CHART_DIGEST=$(grep -oP "(?<=digest: sha256:)[a-z0-9]+" push-metadata.txt)
      #- cosign sign -y --key $HOME/.gnupg/cosign.key push-metadata.txt devopstales/helm-charts/kubedash:$CHART_DIGEST
      - rm -f push-metadata.txt
      - rm -f kubedash-{{.VERSION}}.tgz
      - rm -f kubedash-{{.VERSION}}.tgz.cosign.bundle

  helm-push:
    desc: "Push Helm Chart"
    dir: 'deploy/charts'
    cmds:
      - cr package .
      - git clone -b gh-pages git@github.com:devopstales/helm-charts.git gh-pages-temp
      - cd gh-pages-temp
      - cp ../.cr-release-packages/kubedash-4.0.0.tgz ./
      - git add .
      - git commit -m "Manual update for kubedash-4.0.0"
      - git push origin gh-pages
      - cd ..
      - rm -rf gh-pages-temp .cr-release-packages

  kdlogin-rm:
    desc: "Remove kubectl-kdlogin"
    dir: 'src/kdlogin'
    cmds:
      - rm -rf dist/{windows,linux,osx,release}
      - rm -f dist/choco/*.nupkg

  docs-gen:
    desc: "Generate documentation"
    cmds:
      - rm -rf .venv/
      - python3.11 -m venv .venv
      - .venv/bin/pip install -r docs/build/requirements.txt
      - helm-docs --chart-search-root deploy/charts --output-file configuration.md --template-files configuration.md.gotmpl
      - mv deploy/charts/configuration.md docs/installation/configuration.md
      - .venv/bin/mkdocs build

      #-  .venv/bin/mike deploy --push {{.VERSION}}
      #-  .venv/bin/mike deploy --push --update-aliases {{.VERSION}} latest
      #-  .venv/bin/mike set-default --push latest