Taskfile.yml

# TASK_X_REMOTE_TASKFILES=1 task remote:lint
# - cmd: steps that will be run sequentially.
# - deps: tasks that will be run in parallel.
---
version: "3"
vars:
  # Variables that have to be defined first as they are used in other variables.
  OS_TYPE_MAC: Darwin
  # Variables that are sorted alphabetically and are used in the tasks.
  BUILD_TAGS: component,e2e,integration
  COVERPROFILE: profile.cov
  GCI: "{{.GOBIN}}/gci"
  GCI_SECTIONS: '{{.GCI_SECTIONS | default "-s standard -s default"}}'
  GCI_VERSION: 0.13.5
  GOBIN:
    sh: |
      if [ -z "${GOBIN}" ]; then
        if [ -n "${GITHUB_ACTIONS}" ]; then
          echo /home/runner/go/bin
          exit 0
        fi

        echo "GOBIN has not been not set. Ensure that it has been set on the system."
        exit 1
      fi
  GOFUMPT_VERSION: v0.7.0
  GOLANGCI_LINT_VERSION: 1.61.0
  GOLANG_PARALLEL_TESTS:
    sh: |
      if [ "$(uname -s)" = "{{.OS_TYPE_MAC}}" ]; then
        sysctl -n hw.ncpu
      else
        nproc
      fi
  GOVULNCHECK_VERSION: v1.1.3
  GQLGENC_VERSION: v0.25.4
  HELM_VERSION: v3.16.2
  MOCKERY_BIN: "{{.GOPATH}}/bin/mockery"
  MOCKERY_MAJOR_VERSION: v2
  MOCKERY_VERSION: "{{.MOCKERY_MAJOR_VERSION}}.46.0"
  OPA_FMT: "{{.GOBIN}}/opa fmt ."
  OPA_VERSION: v0.70.0
  OS_COMMAND: uname
  OS_COMMAND_TYPE:
    sh: "{{.OS_COMMAND}} -s"
  OS_COMMAND_TYPE_ARCHITECTURE:
    sh: "{{.OS_COMMAND}} -m"
  REGAL: "{{.GOBIN}}/regal"
  REGAL_VERSION: 0.29.2
  SED_INSERT_ADDITION:
    sh: |
      if [ "{{.OS_COMMAND}}" = "{{.OS_TYPE_MAC}}" ]; then
        echo "\"\""
      fi
  YQ_MAJOR_VERSION: v4
  YQ_VERSION: "{{.YQ_MAJOR_VERSION}}.44.3"

tasks:
  build-golang-download-modules:
    desc: download go modules
    silent: true
    cmds:
      - |
        go mod tidy
  coverage:
    desc: check code coverage
    silent: true
    cmds:
      - task: test
        vars:
          TEST_EXTRA_ARGS: >-
            -coverpkg=$(go list --tags={{.TEST_TAGS}} ./... | grep -v '{{.CODE_COVERAGE_FILE_EXCLUSIONS}}' | tr '\n' ',')
            -coverprofile={{.COVERPROFILE}}
          TEST_TAGS: integration
      - |
        code_coverage_output=$(go tool cover -func {{.COVERPROFILE}})
        code_coverage_actual=$(echo "${code_coverage_output}" |\
          grep total: |\
          awk '{print $3}' |\
          sed 's/%//')

        echo "CODE_COVERAGE_FILE_EXCLUSIONS: {{.CODE_COVERAGE_FILE_EXCLUSIONS}}"
        echo "Code coverage overview:"
        echo "${code_coverage_output}"

        if (( $(echo "{{.CODE_COVERAGE_EXPECTED}} > ${code_coverage_actual}" | bc -l) )); then
          echo "The actual code coverage: '${code_coverage_actual}' is too low. Expected: '{{.CODE_COVERAGE_EXPECTED}}'. Resolve the issue by writing more unit and/or integration tests."
          exit 1
        elif (( $(echo "${code_coverage_actual} > {{.CODE_COVERAGE_EXPECTED}}" | bc -l) )); then
          echo "The actual code coverage: '${code_coverage_actual}' exceeds the expected coverage. Please adjust the threshold that is defined in the .github/workflows/golang.yml workflow from '{{.CODE_COVERAGE_EXPECTED}}' to '${code_coverage_actual}'."
          exit 1
        fi
  coverage-visual:
    desc: show code coverage
    silent: true
    cmds:
      - task: test
        vars:
          TEST_EXTRA_ARGS: >-
            -coverpkg=$(go list --tags={{.TEST_TAGS}} ./... | grep -v '{{.CODE_COVERAGE_FILE_EXCLUSIONS}}' | tr '\n' ',')
            -coverprofile={{.COVERPROFILE}}
          TEST_TAGS: integration
      - |
        go tool cover \
          -func={{.COVERPROFILE}} > \
          functioncoverage.out
        go tool cover \
          -html={{.COVERPROFILE}} \
          -o coverage.html
        open ./coverage.html
  format:
    desc: format go files
    silent: true
    cmds:
      - task: gofumpt
      - task: gci-write
      - go mod tidy
  gofumpt-install:
    silent: true
    cmds:
      - |
        if ! gofumpt --version | grep -q "{{.GOFUMPT_VERSION}}"; then
          go install mvdan.cc/gofumpt@{{.GOFUMPT_VERSION}}
        fi
  gofumpt:
    desc: format go files with gofumpt
    silent: true
    cmds:
      - task: gofumpt-install
      - gofumpt -w .
  helm-install:
    silent: true
    cmds:
      - |
        if ! helm version | grep -q "{{.HELM_VERSION}}"; then
          curl \
            -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 |\
            bash -s -- --version {{.HELM_VERSION}}
        fi
  gci-install:
    silent: true
    cmds:
      - |
        if ! {{.GCI}} --version | grep -q "gci version {{.GCI_VERSION}}"; then
          go install github.com/daixiang0/gci@v{{.GCI_VERSION}}
        fi
  gci:
    desc: check for incorrect import order with gci
    silent: true
    cmds:
      - task: gci-install
      - |
        if {{.GCI}} list --skip-generated {{.GCI_SECTIONS}} . | grep "\.go$"; then
          echo "One or more golang files detected with: 'incorrect import order':"
          echo " * Observe: '{{.GCI}} diff --skip-generated .'"
          echo " * Resolve: '{{.GCI}} write --skip-generated .'"
          exit 1
        fi
  gci-write:
    desc: fix incorrect import order with gci
    silent: true
    cmds:
      - task: gci-install
      - "{{.GCI}} write --skip-generated {{.GCI_SECTIONS}} ."
  golang-log:
    cmds:
      - |
        echo "GOBIN: {{.GOBIN}}"
        echo "GOLANG_PARALLEL_TESTS: {{.GOLANG_PARALLEL_TESTS}}"
  golangci-lint-install:
    silent: true
    cmds:
      - |
        if ! golangci-lint --version | grep -q "has version {{.GOLANGCI_LINT_VERSION}}"; then
          curl \
            -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh |\
            sh -s -- -b $(go env GOPATH)/bin v{{.GOLANGCI_LINT_VERSION}}
        fi
  golangci-lint-run:
    silent: true
    cmds:
      - task: golang-log
      - |
        golangci-lint run \
          --build-tags {{.BUILD_TAGS}} \
          --concurrency {{.GOLANG_PARALLEL_TESTS}} \
          --out-format=colored-line-number \
          --timeout 2m30s \
          --verbose
  golangci-lint:
    desc: run golangci-lint
    silent: true
    cmds:
      - task: golangci-lint-install
      - task: golangci-lint-run
  golangci-lint-run-without-cache:
    desc: run golangci-lint without cache
    silent: true
    cmds:
      - task: golangci-lint-install
      - golangci-lint cache clean
      - task: golangci-lint-run
  govulncheck-install:
    silent: true
    cmds:
      - |
        if ! govulncheck --version | grep -q {{.GOVULNCHECK_VERSION}}; then
          go install golang.org/x/vuln/cmd/govulncheck@{{.GOVULNCHECK_VERSION}}
        fi
  govulncheck:
    desc: check for vulnerabilities with govulncheck
    silent: true
    cmds:
      - task: govulncheck-install
      - |
        govulncheck -tags {{.BUILD_TAGS}} ./...
  gqlgenc-install:
    silent: true
    cmds:
      - |
        if ! gqlgenc version | grep -q {{.GQLGENC_VERSION}}; then
          go install github.com/Yamashou/gqlgenc@{{.GQLGENC_VERSION}}
        fi
  lint:
    desc: run golangci-lint (alias for golangci-lint)
    silent: true
    cmds:
      - task: golangci-lint
  lint-with-gci:
    desc: run gci and golangci-lint
    silent: true
    deps:
      - task: gci
      - task: golangci-lint
  mock-generate:
    desc: generate mocks
    silent: true
    cmds:
      - |
        if ! {{.MOCKERY_BIN}} --version | grep "{{.MOCKERY_VERSION}}"; then
          go install github.com/vektra/mockery/{{.MOCKERY_MAJOR_VERSION}}@{{.MOCKERY_VERSION}}
        fi
        echo "{{.MOCK_GENERATE_DIR}} {{.MOCK_GENERATE_INTERFACE_NAME}}"
        {{.MOCKERY_BIN}} \
          --dir {{.MOCK_GENERATE_DIR}} \
          --name {{.MOCK_GENERATE_INTERFACE_NAME}} \
          --output {{.MOCK_GENERATE_DIR}}/mocks \
          --tags {{.BUILD_TAGS}}
  opa-fmt:
    desc: check formatting rego files using opa
    silent: true
    cmds:
      - task: opa-install
      - "{{.OPA_FMT}}"
  opa-fmt-write:
    desc: apply formatting rego files using opa
    silent: true
    cmds:
      - task: opa-install
      - "{{.OPA_FMT}} --write"
  opa-install:
    silent: true
    cmds:
      - |
        if ! opa version | grep -q {{.OPA_VERSION}}; then
          go install github.com/open-policy-agent/opa@{{.OPA_VERSION}}
        fi
  opa-run:
    silent: true
    cmds:
      - |
        opa_cmd="opa test . --ignore \"*.json\""

        for dir in $(find . -type f -name '*.rego' -exec dirname {} \; | sort -u); do
          echo "Running ${opa_cmd} in directory: $dir"
          (cd "$dir" && ${opa_cmd} -v --explain={{.QUERY_EXPLANATION}})

          opa_code_coverage_overview=$(cd "$dir" && ${opa_cmd} -c)
          echo "OPA code coverage overview:"
          echo "${opa_code_coverage_overview}"

          opa_code_coverage_actual=$(echo "${opa_code_coverage_overview}" | jq .coverage)
          echo "opa_code_coverage_actual: ${opa_code_coverage_actual}"

          int_number=$(echo "$opa_code_coverage_actual" | bc)
          echo "int_number: ${int_number}"

          echo "opa_code_coverage_actual: ${opa_code_coverage_actual}"
          opa_code_coverage_actual_significance_of_two=$(echo $opa_code_coverage_actual | bc -l | xargs printf "%.2f")
          echo "opa_code_coverage_actual_significance_of_two: ${opa_code_coverage_actual_significance_of_two}"

          if (( $(echo "{{.OPA_CODE_COVERAGE_EXPECTED}} > ${opa_code_coverage_actual_significance_of_two}" | bc -l) )); then
            echo "The actual OPA code coverage: '${opa_code_coverage_actual_significance_of_two}' is too low. Expected: '{{.OPA_CODE_COVERAGE_EXPECTED}}'. Resolve the issue by writing more OPA unit tests."
            exit 1
          elif (( $(echo "${opa_code_coverage_actual_significance_of_two} > {{.OPA_CODE_COVERAGE_EXPECTED}}" | bc -l) )); then
            echo "The actual OPA code coverage: '${opa_code_coverage_actual_significance_of_two}' exceeds the expected coverage. Please adjust the threshold that is defined in the applicable GitHub workflow from '{{.OPA_CODE_COVERAGE_EXPECTED}}' to '${opa_code_coverage_actual_significance_of_two}'."
            exit 1
          fi
        done
    vars:
      QUERY_EXPLANATION: '{{.QUERY_EXPLANATION | default "fails"}}'
  opa:
    desc: |
      Install and run OPA. Issue: 'task remote:opa QUERY_EXPLANATION=full' to
      follow the complete policy evaluation.
    silent: true
    cmds:
      - task: opa-install
      - task: opa-run
  regal-install:
    silent: true
    cmds:
      - |
        if ! regal version | grep -q {{.REGAL_VERSION}}; then
          # regal version installed using `go install` does not include
          # version, see: https://github.com/StyraInc/regal/issues/1275
          curl -L -o {{.REGAL}} https://github.com/StyraInc/regal/releases/download/v{{.REGAL_VERSION}}/regal_{{.OS_COMMAND_TYPE}}_{{.OS_COMMAND_TYPE_ARCHITECTURE}}
          chmod +x {{.REGAL}}
        fi
  regal-run:
    silent: true
    cmds:
      - |
        if ! regal lint .; then
          echo "regal linting failed. Run: 'task remote:opa-fmt-write' to fix the issue"
          exit 1
        fi
  regal:
    desc: run regal
    silent: true
    cmds:
      - task: regal-install
      - task: regal-run
  test:
    desc: run unit tests
    silent: true
    cmds:
      - task: golang-log
      - |
        go test \
          -p {{.GOLANG_PARALLEL_TESTS}} \
          -race \
          -short \
          --tags={{.TEST_TAGS}} \
          -v \
          ./... \
          {{.TEST_EXTRA_ARGS}}
  test-component:
    desc: run component tests
    silent: true
    cmds:
      - task: test
        vars:
          TEST_TAGS: component
  test-e2e:
    desc: run end-to-end tests
    silent: true
    cmds:
      - task: test
        vars:
          TEST_TAGS: e2e
  test-integration:
    desc: run integration tests
    silent: true
    cmds:
      - task: test
        vars:
          TEST_TAGS: integration
  yq-install:
    silent: true
    cmds:
      - |
        if ! yq --version | grep -q "version {{.YQ_VERSION}}"; then
          go install \
            github.com/mikefarah/yq/{{.YQ_MAJOR_VERSION}}@{{.YQ_VERSION}}
        fi