Taskfile.yml

---
# https://taskfile.dev

version: '3'

set:
  - nounset
  - errexit
  - pipefail

includes:
  py:
    taskfile: ./goat/Task/python/Taskfile.yml
    internal: true
    optional: true
    vars:
      IMAGE_NAME: '{{ "{{.IMAGE_NAME}}" }}'
      PROJECT_SLUG: '{{ "{{.PROJECT_SLUG}}" }}'
      PYTHON_VERSION: '{{ "{{.PYTHON_VERSION}}" }}'
      VERSION: '{{ "{{.VERSION}}" }}'

  base:
    taskfile: ./goat/Task/Taskfile.yml
    internal: true
    optional: true

vars:
  IMAGE_NAME: seiso/{{ cookiecutter.project_slug }}
  PROJECT_SLUG: {{ cookiecutter.project_slug }}
  PYTHON_VERSION: {{ cookiecutter.python_version }}
  SUPPORTED_PLATFORMS: 'linux/amd64,linux/arm64'
  VERSION:
    # Does not use pipenv to avoid pipenv as a project bootstrapping requirement
    sh: python -c 'from {{ "{{" }}.PROJECT_SLUG{{ "}}" }} import __version__; print(__version__)'
  LOCAL_PLATFORM:
    # Inspired by https://github.com/containerd/containerd/blob/e0912c068b131b33798ae45fd447a1624a6faf0a/platforms/database.go#L76
    sh: |
      os="linux"
      arch="$(uname -m)"

      case ${arch} in
        # AMD64
        x86_64)  echo "${os}/amd64" ;;
        amd64)   echo "${os}/amd64" ;;

        # ARM64
        aarch64) echo "${os}/arm64" ;;
        arm64)   echo "${os}/arm64" ;;
      esac

silent: true

tasks:
  init-pipenv:
    desc: Initializes the pipenv virtual environment if Pipfile.lock changes
    internal: true
    sources:
      - Pipfile.lock
    preconditions:
      - which pipenv || python -m pip install --upgrade pipenv
    cmds:
      - pipenv install --deploy --ignore-pipfile --dev

  init-submodules:
    desc: >
      Initializes git submodules; paved road projects include the Seiso goat 🐐
      for its shared configs, etc.
    internal: true
    status:
      # Only update submodules if you are in a git repository; quote to avoid yaml intrepretering the ! as a node tag
      # https://yaml.org/spec/1.2.2/#691-node-tags
      - '! test -d .git'
    cmds:
      - git submodule update --init

  init-pre-commit:
    desc: Install the pre-commit hooks
    internal: true
    sources:
      - .pre-commit-config.yaml
    status:
      # Only install the pre-commit hooks if you are in a git repository; quote to avoid yaml intrepretering the ! as a node tag
      # https://yaml.org/spec/1.2.2/#691-node-tags
      - '! test -d .git'
    cmds:
      # Don't run this in pipelines
      - '{{ "{{" }}if ne .GITHUB_ACTIONS "true"{{ "}}pipenv run pre-commit install{{else}}echo \"Detected a github actions pipeline; skipping the pre-commit install\"{{end}}" }}'

  init-install-tools:
    desc: Install required tools
    internal: true
    cmds:
      - task: base:mac-brew-install
        vars:
          TOOLS: syft,grype
      - task: base:runner-curl-install
        vars:
          INSTALL_URL: https://raw.githubusercontent.com/anchore/syft/main/install.sh
          TOOL: syft
      - task: base:runner-curl-install
        vars:
          INSTALL_URL: https://raw.githubusercontent.com/anchore/grype/main/install.sh
          TOOL: grype

  init:
    desc: Initialize the repo for local use; intended to be run after git clone
    cmds:
      - task: init-pipenv
      - task: init-submodules
      - task: init-pre-commit
      - task: init-install-tools

  lint:
    desc: Run the linter(s); paved road projects use the Seiso goat 🐐
    cmds:
      - task: py:lint
        vars:
          INPUT_LOG_LEVEL: '{{ "{{.CLI_ARGS}}" }}'

  validate:
    desc: Validate the pre-commit config and hooks files
    cmds:
      - task: py:validate

  build:
    desc: Build the project; docker images, compiled binaries, etc.
    cmds:
      - task: py:build
        vars:
          # Unable to make these global due to https://taskfile.dev/usage/#variables see https://github.com/go-task/task/issues/1295
          PLATFORM: '{{ "{{" }}if eq .PLATFORM "all"{{ "}}{{" }}.SUPPORTED_PLATFORMS{{ "}}{{" }}else if .PLATFORM{{ "}}{{" }}.PLATFORM{{ "}}{{" }}else{{ "}}{{" }}.LOCAL_PLATFORM{{ "}}{{" }}end{{ "}}" }}'

  test:
    desc: Run the project tests
    cmds:
      - task: py:test

  update:
    desc: Update the project dev and runtime dependencies, and other misc components
    cmds:
      - task: py:update

  clean:
    desc: Clean up build artifacts, cache files/directories, temp files, etc.
    cmds:
      - task: py:clean

  release:
    desc: Cut a project release
    cmds:
      - task: py:release

  sbom:
    desc: Generate project SBOMs
    cmds:
      - task: py:sbom

  vulnscan:
    desc: Vuln scan the SBOM
    cmds:
      - task: py:vulnscan

{%- if cookiecutter.dockerhub == 'yes' %}

  publish:
    desc: Publish the project artifacts; docker images, compiled binaries, etc.
    cmds:
      # We call into the py:publish instead of across to build to simplify centralized policy assessments (i.e. "is the project using a goat-provided task?")
      - task: py:publish
        vars:
          PLATFORM: '{{ "{{" }}if eq .PLATFORM "all"{{ "}}{{" }}.SUPPORTED_PLATFORMS{{ "}}{{" }}else if .PLATFORM{{ "}}{{" }}.PLATFORM{{ "}}{{" }}else{{ "}}{{" }}.LOCAL_PLATFORM{{ "}}{{" }}end{{ "}}" }}'
{%- endif %}