Taskfile.deps.yml

# Copyright AGNTCY Contributors (https://github.com/agntcy)
# SPDX-License-Identifier: Apache-2.0

version: "3"

tasks:
  default:
    cmd: echo "Run the main Taskfile instead of this one."

  ##
  ## Setup
  ##

  deps:
    desc: Install dependencies
    cmds:
      - task: deps:dirctl
      - task: deps:helm
      - task: deps:kubectl
      - task: deps:kind
      - task: deps:protoc
      - task: deps:bufbuild
      - task: deps:uv
      - task: deps:cosign
      - task: deps:trivy
      - task: deps:golangci-lint
      - task: deps:licensei
      - task: deps:multimod-bin
      - task: deps:renovate
      - task: deps:yq
      - task: deps:pre-commit
      - task: deps:cleanup

  deps:bin-dir:
    desc: Create bin directory
    run: once
    cmd: mkdir -p {{.BIN_DIR}}
    status:
      - test -d {{.BIN_DIR}}

  deps:controller-gen:
    desc: Ensure controller-gen is installed
    internal: true
    preconditions:
      - which go
    cmds:
      - cmd: go install {{.CONTROLLER_GEN_BIN}}
    status:
      - which controller-gen

  deps:cleanup:
    desc: Remove binaries in BIN_DIR except those currently used by the Taskfile
    preconditions:
      - test -d {{.BIN_DIR}}
    cmd: |
      kept="{{.BIN_DIR}}/Taskfile.yml
      {{.DIRCTL_BIN}}
      {{.HELM_BIN}}
      {{.KUBECTL_BIN}}
      {{.KIND_BIN}}
      {{.PROTOC_BIN}}
      {{.BUFBUILD_BIN}}
      {{.MULTIMOD_BIN}}
      {{.YQ_BIN}}
      {{.GOLANGCI_LINT_BIN}}
      {{.LICENSEI_BIN}}
      {{.UV_BIN}}
      {{.COSIGN_BIN}}
      {{.PRE_COMMIT_PYZ}}
      {{.TRIVY_BIN}}"

      echo "Clean up unused/outdated binaries in {{.BIN_DIR}}"

      for f in {{.BIN_DIR}}/*; do
        [ -f "$f" ] || continue
        echo "$kept" | grep -qFx "$f" && continue
        rm -f "$f" && echo "Removed unused $f"
      done

  ##
  ## Tool installers
  ##

  deps:dirctl:
    desc: Compile dirctl binary
    internal: true
    run: once
    cmds:
      - task: cli:compile
    status:
      - test -f {{.DIRCTL_BIN}}

  deps:helm:
    desc: Ensure supported Helm version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which curl
      - which tar
    cmds:
      - cmd: echo "Downloading Helm v{{.HELM_VERSION}}..."
      - cmd: curl -sSfL 'https://get.helm.sh/helm-v{{.HELM_VERSION}}-{{OS}}-{{ARCH}}.tar.gz' --output - | tar xzvOf - '{{OS}}-{{ARCH}}/helm' > {{.HELM_BIN}}
      - cmd: chmod +x {{.HELM_BIN}}
    status:
      - test -x {{.HELM_BIN}}

  deps:kubectl:
    desc: Ensure supported kubectl version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which curl
    cmds:
      - cmd: echo "Downloading Kubectl v{{.KUBECTL_VERSION}}..."
      - cmd: curl -L "https://dl.k8s.io/release/v{{.KUBECTL_VERSION}}/bin/{{OS}}/{{ARCH}}/kubectl" -o {{.KUBECTL_BIN}}
      - cmd: chmod +x {{.KUBECTL_BIN}}
    status:
      - test -x {{.KUBECTL_BIN}}

  deps:kind:
    desc: Ensure supported kind version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which go
    cmds:
      - cmd: echo "Downloading Kind v{{.KIND_VERSION}}..."
      - cmd: GOBIN={{.BIN_DIR}} go install sigs.k8s.io/kind@v{{.KIND_VERSION}}
      - cmd: mv {{.BIN_DIR}}/kind {{.KIND_BIN}}
    status:
      - test -x {{.KIND_BIN}}

  deps:protoc:
    desc: Ensure supported Protoc version and plugins are installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which go
      - which curl
      - which unzip
    vars:
      ARCH_TYPE: '{{ if eq ARCH "arm64" }}aarch_64{{ else if eq ARCH "amd64" }}x86_64{{else if eq ARCH "s390x"}}x390_64{{ else }}{{ARCH}}{{ end }}'
      OS_VARIANT: '{{ if eq OS "darwin" }}osx-universal_binary{{ else if eq OS "windows" }}win64{{else}}linux-{{.ARCH_TYPE}}{{ end }}'
    cmds:
      - cmd: echo "Downloading Protoc v{{.PROTOC_VERSION}}..."
      - cmd: |
          curl -sL https://github.com/protocolbuffers/protobuf/releases/download/v{{.PROTOC_VERSION}}/protoc-{{.PROTOC_VERSION}}-{{.OS_VARIANT}}.zip -o {{.BIN_DIR}}/tmp.zip
          unzip -j {{.BIN_DIR}}/tmp.zip "bin/protoc" -d {{.BIN_DIR}}
          mv {{.BIN_DIR}}/protoc {{.PROTOC_BIN}}
          rm {{.BIN_DIR}}/tmp.zip
      - cmd: chmod +x {{.PROTOC_BIN}}
      - cmd: echo "Downloading go plugins for protoc..."
      - cmd: go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
      - cmd: go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
      - cmd: go install github.com/NathanBaulch/protoc-gen-cobra@latest
    status:
      - test -x {{.PROTOC_BIN}}

  deps:bufbuild:
    desc: Ensure supported bufbuild version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which curl
    vars:
      ARCH_TYPE: '{{ if eq ARCH "amd64" }}x86_64{{ else }}{{ARCH}}{{ end }}'
    cmds:
      - cmd: echo "Downloading BufBuild v{{.BUFBUILD_VERSION}}..."
      - cmd: |
          curl -L "https://github.com/bufbuild/buf/releases/download/v{{.BUFBUILD_VERSION}}/buf-{{OS}}-{{.ARCH_TYPE}}" -o {{.BUFBUILD_BIN}}
      - cmd: chmod +x {{.BUFBUILD_BIN}}
    status:
      - test -x {{.BUFBUILD_BIN}}

  deps:golangci-lint:
    desc: Install golangci-lint
    internal: true
    deps:
      - deps:bin-dir
    cmds:
      - curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b {{.BIN_DIR}} v{{.GOLANGCI_LINT_VERSION}}
      - mv {{.BIN_DIR}}/golangci-lint {{.GOLANGCI_LINT_BIN}}
      - chmod +x {{.GOLANGCI_LINT_BIN}}
    status:
      - test -x {{.GOLANGCI_LINT_BIN}}

  deps:licensei:
    desc: Install licensei
    internal: true
    deps:
      - deps:bin-dir
    cmds:
      - curl -sfL https://raw.githubusercontent.com/goph/licensei/master/install.sh | sh -s -- -b {{.BIN_DIR}} v{{.LICENSEI_VERSION}}
      - mv {{.BIN_DIR}}/licensei {{.LICENSEI_BIN}}
      - chmod +x {{.LICENSEI_BIN}}
    status:
      - test -x {{.LICENSEI_BIN}}

  deps:multimod-bin:
    desc: Build the multimod binary
    internal: true
    deps:
      - deps:bin-dir
    vars:
      MULTIMOD_REPO_DIR: "{{ .BIN_DIR }}/opentelemetry-go-build-tools"
    cmds:
      - git clone https://github.com/open-telemetry/opentelemetry-go-build-tools --branch multimod/v{{.MULTIMOD_VERSION}} {{.MULTIMOD_REPO_DIR}}
      - go build -C {{.MULTIMOD_REPO_DIR}}/multimod -o {{.MULTIMOD_BIN}} main.go
      - rm -rf {{.MULTIMOD_REPO_DIR}}
    status:
      - test -x {{.MULTIMOD_BIN}}

  deps:yq:
    desc: Install yq
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which go
    cmds:
      - GOBIN={{.BIN_DIR}} go install github.com/mikefarah/yq/v4@v{{.YQ_VERSION}}
      - mv {{.BIN_DIR}}/yq {{.YQ_BIN}}
      - chmod +x {{.YQ_BIN}}
    status:
      - test -x {{.YQ_BIN}}

  deps:uv:
    desc: Install uv
    internal: true
    deps:
      - deps:bin-dir
    env:
      UV_INSTALL_DIR: "{{ .BIN_DIR }}"
    cmds:
      - curl -sfL https://astral.sh/uv/{{.UV_VERSION}}/install.sh | sh
      - mv {{.BIN_DIR}}/uv {{.UV_BIN}}
      - chmod +x {{.UV_BIN}}
      - rm {{.BIN_DIR}}/uvx
    status:
      - test -x {{.UV_BIN}}

  deps:cosign:
    desc: Install sigstore cosign
    internal: true
    cmds:
      - curl -sfL https://github.com/sigstore/cosign/releases/download/v{{.COSIGN_VERSION}}/cosign-{{OS}}-{{ARCH}} -o {{.BIN_DIR}}/cosign-{{.COSIGN_VERSION}}
      - chmod +x {{.BIN_DIR}}/cosign-{{.COSIGN_VERSION}}
    status:
      - test -x {{.COSIGN_BIN}}

  deps:trivy:
    desc: Install trivy
    internal: true
    deps:
      - deps:bin-dir
    vars:
      TRIVY_OS:
        sh: uname -s | sed 's/Darwin/macOS/' | sed 's/Linux/Linux/'
      TRIVY_ARCH:
        sh: uname -m | sed 's/x86_64/64bit/' | sed 's/aarch64/ARM64/' | sed 's/arm64/ARM64/'
    cmds:
      - cmd: echo "Installing trivy v{{.TRIVY_VERSION}}..."
      - cmd: |
          curl -sfL https://github.com/aquasecurity/trivy/releases/download/v{{.TRIVY_VERSION}}/trivy_{{.TRIVY_VERSION}}_{{.TRIVY_OS}}-{{.TRIVY_ARCH}}.tar.gz | \
          tar -xzf - -C {{.BIN_DIR}} trivy && \
          mv {{.BIN_DIR}}/trivy {{.TRIVY_BIN}}
    status:
      - test -x {{.TRIVY_BIN}}

  deps:htpasswd:
    desc: Install htpasswd
    internal: true
    cmds:
      - npm install -g htpasswd

  deps:renovate:
    desc: Install Renovate
    internal: true
    cmd: npm install -g renovate@{{.RENOVATE_VERSION}}
    status:
      - npm list -g renovate

  deps:pre-commit:
    desc: Install pre-commit
    run: once
    vars:
      GIT_HOOKS_PATH:
        sh: git config core.hooksPath || echo ""
    # pre-commit doesn't work if core.hooksPath is set
    if: '{{ eq .GIT_HOOKS_PATH "" }}'
    cmds:
      - curl -sL "https://github.com/pre-commit/pre-commit/releases/download/v{{.PRE_COMMIT_VERSION}}/pre-commit-{{.PRE_COMMIT_VERSION}}.pyz" -o {{.PRE_COMMIT_PYZ}}
      - python3 {{.PRE_COMMIT_PYZ}} install
    status:
      - test -f {{.PRE_COMMIT_PYZ}}

  deps:ginkgo:
    desc: Install ginkgo
    run: once
    cmds:
      - GOBIN="{{ .BIN_DIR }}" go install github.com/onsi/ginkgo/v2/ginkgo@v{{ .GINKGO_VERSION }}
      - mv "{{ .BIN_DIR }}/ginkgo" "{{ .GINKGO_BIN }}"
    status:
      - test -f "{{ .GINKGO_BIN }}"

  ##
  ## Dependency management
  ##

  deps:tidy:
    desc: Ensure dependencies are up-to-date
    cmds:
      - for: { var: GO_MODULES }
        cmd: go -C {{.ITEM}} mod tidy -go={{.GO_VERSION}}

  deps:update:
    desc: Update dependencies
    cmds:
      - for: { var: GO_MODULES }
        cmd: |
          echo "Updating dependencies in {{.ITEM}}" && \
          go -C {{.ITEM}} get -u ./... && \
          go -C {{.ITEM}} mod tidy -go={{.GO_VERSION}}

  deps:renovate:sync:
    desc: Sync dependencies with Renovate
    summary: |
      For extra CLI flags pass RENOVATE_OPTS (e.g. task deps:renovate:sync RENOVATE_OPTS='--dry-run').
      Default platform is local so local runs do not touch remote project data.
      Github Action CI sets RENOVATE_PLATFORM to github.
      This step is only analytical without GITHUB TOKEN and will not update PRs or project data.
    deps:
      - deps:renovate
    dir: "{{.ROOT_DIR}}"
    vars:
      RENOVATE_OPTS_DEFAULT: >-
        --persist-repo-data 'true'
        --allowed-post-upgrade-commands '[".*"]'
        --post-upgrade-tasks '{"commands": ["task helm:gen", "task deps:tidy"], "executionMode": "branch"}'
      RENOVATE_OPTS: "{{ .RENOVATE_OPTS | default .RENOVATE_OPTS_DEFAULT }}"
      RENOVATE_PLATFORM_EFFECTIVE:
        sh: printf '%s' "${RENOVATE_PLATFORM:-local}"
    cmds:
      - renovate {{.RENOVATE_OPTS}} --platform "{{.RENOVATE_PLATFORM_EFFECTIVE}}"

  ##
  ## Security scanning
  ##

  deps:vuln:
    desc: Run vulnerability check on all Go modules
    deps:
      - deps:trivy
    cmd: |
      {{.TRIVY_BIN}} clean --scan-cache
      {{.TRIVY_BIN}} fs --scanners vuln --severity CRITICAL,HIGH,MEDIUM --ignore-unfixed {{.ROOT_DIR}}

  deps:vuln:images:
    desc: Run vulnerability check on container images
    deps:
      - deps:trivy
    cmds:
      - cmd: |
          {{.TRIVY_BIN}} clean --scan-cache
      - for: { var: VULN_SCAN_IMAGES }
        cmd: |
          echo "Scanning {{.ITEM}}..."
          {{.TRIVY_BIN}} image --scanners vuln --severity CRITICAL,HIGH,MEDIUM --ignore-unfixed {{.ITEM}}

  deps:vuln:images:list:
    desc: Output vulnerability-scan image refs (one per line) for CI matrix
    cmds:
      - for: { var: VULN_SCAN_IMAGES }
        cmd: echo "{{.ITEM}}"

  ##
  ## License
  ##

  license:
    desc: Check licenses
    deps:
      - task: deps:licensei
    cmds:
      - for: { var: GO_MODULES }
        cmd: echo "Running licensei in {{.ITEM}}" && cd {{.ITEM}} && {{ .LICENSEI_BIN }} check --config {{.ROOT_DIR}}/.licensei.toml

  license:cache:
    desc: Check licenses
    deps:
      - task: deps:licensei
    cmds:
      - for: { var: GO_MODULES }
        cmd: echo "Running licensei in {{.ITEM}}" && cd {{.ITEM}} && {{ .LICENSEI_BIN }} cache --config {{.ROOT_DIR}}/.licensei.toml

  ##
  ## Importer tools
  ##

  deps:mcp-scanner:
    desc: Install mcp-scanner CLI via uv
    deps:
      - task: deps:uv
    cmds:
      - cmd: echo "Installing mcp-scanner"
      - cmd: >-
          {{.UV_BIN}} tool install --python 3.13 cisco-ai-mcp-scanner=={{.MCP_SCANNER_VERSION}}

  deps:skill-scanner:
    desc: Install skill-scanner CLI via uv
    deps:
      - task: deps:uv
    cmds:
      - cmd: echo "Installing skill-scanner"
      - cmd: >-
          {{.UV_BIN}} tool install --python 3.13 cisco-ai-skill-scanner=={{.SKILL_SCANNER_VERSION}}

  deps:a2a-scanner:
    desc: Install a2a-scanner CLI via uv
    deps:
      - task: deps:uv
    cmds:
      - cmd: echo "Installing a2a-scanner"
      - cmd: >-
          {{.UV_BIN}} tool install --python 3.13 cisco-ai-a2a-scanner=={{.A2A_SCANNER_VERSION}}

  deps:scanners:
    desc: Install all security scanner CLIs (mcp-scanner, skill-scanner, and a2a-scanner) via uv
    cmds:
      - task: deps:mcp-scanner
      - task: deps:skill-scanner
      - task: deps:a2a-scanner