Taskfile.yml

version: '3'

# Task targets for the CryptOS-PKI api/ module.
# Requires on PATH: go, buf, npx. The Go codegen plugins are not taken from PATH:
# `task tools` installs them at the versions pinned below into .bin/, and
# buf.gen.yaml runs them from there, so every machine generates the same bytes.
# The TypeScript plugin (@bufbuild/protoc-gen-es) runs via `npx -y`, pinned by version
# in buf.gen.yaml; no local npm install needed, but `buf generate` requires network
# access to fetch it on first run (npx caches after that). Connect-ES v2's unified
# protoc-gen-es also emits the Connect service definitions -- there is no separate
# connect-es codegen plugin in the v2 line.

vars:
  # Bump a pin, then run `task generate` and commit the regenerated tree in the
  # same change. protoc-gen-connect-go tracks the connectrpc.com/connect runtime
  # in go.mod.
  PROTOC_GEN_GO_VERSION: v1.34.2
  PROTOC_GEN_GO_GRPC_VERSION: v1.5.1
  PROTOC_GEN_CONNECT_GO_VERSION: v1.20.0
  # The Go toolchain that builds the plugins is pinned too. protoc-gen-go
  # formats its output with the go/format it was compiled with, and a Go 1.27
  # build drops the bare `//` line that earlier builds put before each oneof's
  # list of wrapper types, so the same plugin version gave different bytes on
  # different machines. Kept at the go directive in go.mod.
  PLUGIN_GO_TOOLCHAIN: go1.26.8
  TOOLS_BIN: '{{.ROOT_DIR}}/.bin'

tasks:
  default:
    desc: Show available tasks
    cmds:
      - task --list

  fmt:
    desc: Format proto files
    cmds:
      - buf format -w

  lint:
    desc: Lint proto files
    cmds:
      - buf lint
      - buf format -d

  tools:
    desc: Install the pinned Go codegen plugins into .bin/
    # status reads the Go version and module version stamped into each binary,
    # so a .bin/ left over from an older pin gets reinstalled instead of
    # silently reused.
    status:
      - go version {{.TOOLS_BIN}}/protoc-gen-go {{.TOOLS_BIN}}/protoc-gen-go-grpc {{.TOOLS_BIN}}/protoc-gen-connect-go | awk '$2 != "{{.PLUGIN_GO_TOOLCHAIN}}" {bad=1} END {exit bad || NR != 3}'
      - go version -m {{.TOOLS_BIN}}/protoc-gen-go | grep -qE '^[[:space:]]+mod[[:space:]]+google.golang.org/protobuf[[:space:]]+{{.PROTOC_GEN_GO_VERSION}}[[:space:]]'
      - go version -m {{.TOOLS_BIN}}/protoc-gen-go-grpc | grep -qE '^[[:space:]]+mod[[:space:]]+google.golang.org/grpc/cmd/protoc-gen-go-grpc[[:space:]]+{{.PROTOC_GEN_GO_GRPC_VERSION}}[[:space:]]'
      - go version -m {{.TOOLS_BIN}}/protoc-gen-connect-go | grep -qE '^[[:space:]]+mod[[:space:]]+connectrpc.com/connect[[:space:]]+{{.PROTOC_GEN_CONNECT_GO_VERSION}}[[:space:]]'
    # GOBIN and GOTOOLCHAIN are set on each command, not in an env: block,
    # because Task lets an exported shell variable win over env:, and a
    # GOTOOLCHAIN in the shell would otherwise build the plugins with the
    # wrong Go.
    cmds:
      - GOBIN='{{.TOOLS_BIN}}' GOTOOLCHAIN={{.PLUGIN_GO_TOOLCHAIN}} go install google.golang.org/protobuf/cmd/protoc-gen-go@{{.PROTOC_GEN_GO_VERSION}}
      - GOBIN='{{.TOOLS_BIN}}' GOTOOLCHAIN={{.PLUGIN_GO_TOOLCHAIN}} go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@{{.PROTOC_GEN_GO_GRPC_VERSION}}
      - GOBIN='{{.TOOLS_BIN}}' GOTOOLCHAIN={{.PLUGIN_GO_TOOLCHAIN}} go install connectrpc.com/connect/cmd/protoc-gen-connect-go@{{.PROTOC_GEN_CONNECT_GO_VERSION}}

  generate:
    desc: Generate Go and TypeScript stubs from protos with the pinned plugins
    deps: [tools]
    cmds:
      - buf generate

  generate:verify:
    desc: Generate and assert the working tree is clean
    # Covers every directory buf.gen.yaml writes to, not just go/. Asserting on
    # go/ alone let the TypeScript output drift out of sync with the proto for
    # a whole release cycle (#70).
    #
    # git status rather than git diff, so a generated file that is new (a fresh
    # proto, a plugin that starts emitting another file) counts as stale too
    # instead of passing as untracked.
    cmds:
      - task: generate
      - |
        stale="$(git status --porcelain go/ gen/)"
        if [ -n "$stale" ]; then
          echo "Generated output is out of date. Run 'task generate' and commit the result." >&2
          echo "$stale" >&2
          git --no-pager diff go/ gen/ >&2
          exit 1
        fi

  license:
    desc: Verify every source file carries the Apache 2.0 license header and LICENSE is the verbatim Apache 2.0 text (CI; never writes).
    cmds:
      - go install github.com/Bugs5382/golic/cmd/golic@v1.2.0
      - golic inject -t apache2 -c "The CryptOS Authors." --license-file --dry -x
  license:fix:
    desc: Inject the Apache 2.0 header into any source file missing it and rewrite LICENSE to the verbatim Apache 2.0 text.
    cmds:
      - go install github.com/Bugs5382/golic/cmd/golic@v1.2.0
      - golic inject -t apache2 -c "The CryptOS Authors." --license-file

  test:
    desc: Run Go tests
    cmds:
      - go test ./go/...

  tidy:
    desc: Tidy the Go module
    cmds:
      - go mod tidy

  ci:
    desc: Full local validation chain (fmt + lint + generate-and-verify + test)
    cmds:
      - task: fmt
      - task: lint
      - task: generate:verify
      - task: test
    # Note: a strict license:check gate isn't part of `task ci` because
    # `buf format` reindents block comments in a way `golic --dry`
    # doesn't recognize as equivalent. Headers are visually confirmed and
    # `task license` is the canonical re-injection step.