Taskfile.yml

# Copyright AGNTCY Contributors (https://github.com/agntcy)
# SPDX-License-Identifier: Apache-2.0

version: "3"

env:
  GOWORK: off

vars:
  ## Version
  RELEASE_VERSION:
    sh: grep 'version:' versions.yaml | awk '{print $2}'
  RELEASE_VERSION_LDFLAG: "-X 'github.com/agntcy/dir/api/version.Version={{ .RELEASE_VERSION }}'"
  COMMIT_SHA:
    sh: git rev-parse --short HEAD
  COMMIT_SHA_LDFLAG: "-X 'github.com/agntcy/dir/api/version.CommitHash={{ .COMMIT_SHA }}'"
  VERSION_LDFLAGS: "{{ .RELEASE_VERSION_LDFLAG }} {{ .COMMIT_SHA_LDFLAG }}"

  ## Image config
  IMAGE_REPO: '{{ .IMAGE_REPO | default "ghcr.io/agntcy" }}'
  IMAGE_TAG: "{{ .IMAGE_TAG | default .COMMIT_SHA }}"
  IMAGE_BAKE_ENV: "IMAGE_REPO={{.IMAGE_REPO}} IMAGE_TAG={{.IMAGE_TAG}}"
  IMAGE_BAKE_OPTS: '{{ .IMAGE_BAKE_OPTS | default "" }}'
  BAKE_ENV: '{{ .IMAGE_BAKE_ENV }} EXTRA_LDFLAGS="{{.VERSION_LDFLAGS}}"'
  COVERAGE_IMAGE_TAG: "{{ .IMAGE_TAG | default .COMMIT_SHA }}-coverage"
  COVERAGE_IMAGE_BAKE_ENV: "IMAGE_REPO={{.IMAGE_REPO}} IMAGE_TAG={{.COVERAGE_IMAGE_TAG}}"
  COVERAGE_BAKE_ENV: '{{ .COVERAGE_IMAGE_BAKE_ENV }} EXTRA_LDFLAGS="{{.VERSION_LDFLAGS}}"'
  COVERAGE_PKGS: '{{ .COVERAGE_PKGS | default "github.com/agntcy/dir/api/...,github.com/agntcy/dir/cli/...,github.com/agntcy/dir/client/...,github.com/agntcy/dir/importer/...,github.com/agntcy/dir/utils/..." }}'

  ## Dependency config
  BIN_DIR: "{{ .ROOT_DIR }}/bin"
  DIRCTL_BIN: "{{ .BIN_DIR}}/dirctl"
  HELM_VERSION: "4.0.5"
  HELM_BIN: "{{ .BIN_DIR }}/helm-{{.HELM_VERSION}}"
  KUBECTL_VERSION: "1.35.0"
  KUBECTL_BIN: "{{ .BIN_DIR }}/kubectl-{{.KUBECTL_VERSION}}"
  KIND_VERSION: "0.31.0"
  KIND_BIN: "{{ .BIN_DIR }}/kind-{{.KIND_VERSION}}"
  PROTOC_VERSION: "33.4"
  PROTOC_BIN: "{{ .BIN_DIR }}/protoc-{{.PROTOC_VERSION}}"
  BUFBUILD_VERSION: "1.63.0"
  BUFBUILD_BIN: "{{ .BIN_DIR }}/bufbuild-{{.BUFBUILD_VERSION}}"
  GO_VERSION: "1.25.6"
  MULTIMOD_VERSION: "0.28.1"
  MULTIMOD_BIN: "{{ .BIN_DIR }}/multimod-{{.MULTIMOD_VERSION}}"
  GOLANGCI_LINT_VERSION: "2.8.0"
  GOLANGCI_LINT_BIN: "{{ .BIN_DIR }}/golangci-lint-{{.GOLANGCI_LINT_VERSION}}"
  LICENSEI_VERSION: "0.9.0"
  LICENSEI_BIN: "{{ .BIN_DIR }}/licensei-{{.LICENSEI_VERSION}}"
  UV_VERSION: "0.9.26"
  UV_BIN: "{{ .BIN_DIR }}/uv-{{.UV_VERSION}}"
  UV_PUBLISH_TOKEN: '{{ .UV_PUBLISH_TOKEN | default "" }}'
  COSIGN_VERSION: "3.0.4"
  COSIGN_BIN: "{{ .BIN_DIR }}/cosign-{{.COSIGN_VERSION}}"
  HUB_API_VERSION: "main"
  ZOT_VERSION: "2.1.13"
  SPIRE_VERSION: "1.14.1"

  ## Go module discovery
  GO_MOD_DIR:
    sh: find . -name go.mod -not -path "./tmp*" -exec dirname {} \;
  GO_MOD_DIR_UNIT_TEST:
    sh: find . -name go.mod -not -path "./e2e*" -not -path "./tmp*" -exec dirname {} \;

tasks:
  ##
  ## General
  ##
  default:
    cmds:
      - task -l

  gen:
    desc: Generate code for all components
    cmds:
      - task: api:gen
      - task: helm:gen

  check:
    desc: Checks for all code violations
    cmds:
      - task: lint
      - task: license

  build:
    desc: Build images for all components
    deps:
      - task: deps:tidy
      - task: gen
    vars:
      GOARCH: "{{ .GOARCH | default ARCH }}"
      EXTRA_FLAGS: '{{ .EXTRA_FLAGS | default "" }}'
    cmds:
      - "{{.BAKE_ENV}} docker buildx bake {{.IMAGE_BAKE_OPTS}} --set *.platform=linux/{{.GOARCH}} {{.EXTRA_FLAGS}}"

  build:coverage:
    desc: Build images for all components with coverage instrumentation
    cmds:
      - task: build
        vars:
          BAKE_ENV: "{{ .COVERAGE_BAKE_ENV }}"
          # TODO: -coverpkg should be set to include all packages (server, api, utils) in the coverage report
          # but it's not working as expected, so we're using the default coverage package for now
          EXTRA_FLAGS: 'coverage --set *.args.BUILD_OPTS="-cover -covermode=atomic"'

  build:all:
    desc: Build images for all components for multiple platforms
    cmds:
      - "{{.BAKE_ENV}} docker buildx bake {{.IMAGE_BAKE_OPTS}} --set *.platform=linux/amd64,linux/arm64"

  pull:
    desc: Pull images for all components
    cmds:
      - |
        images=$({{.BAKE_ENV}} docker buildx bake default --print | jq -r '.target | with_entries(.value |= .tags[0]) | to_entries[] | .value')
        echo "$images" | while read image; do
          echo "Pulling image: $image"
          docker pull $image
        done

  push:
    desc: Build and push images for all components
    prompt:
      - Are you sure you want to push the images to remote registry?
    cmds:
      - "{{.BAKE_ENV}} docker buildx bake {{.IMAGE_BAKE_OPTS}} --set=*.output=type=registry"

  release:create:
    desc: Prepare release
    deps:
      - task: deps:multimod-bin
      - task: sdk:deps:python
      - task: sdk:deps:javascript
    vars:
      RELEASE_VERSION: "{{ .RELEASE_VERSION }}"
    cmds:
      # Switch to new branch
      - 'if [ "$(git rev-parse --abbrev-ref HEAD)" != "release/{{.RELEASE_VERSION}}" ]; then git checkout -b release/{{.RELEASE_VERSION}}; fi'
      # Update versions.yaml with the new version
      - 'awk ''{gsub(/version: .*/,"version: {{.RELEASE_VERSION}}")}1'' versions.yaml > versions.yaml.tmp'
      - "mv versions.yaml.tmp versions.yaml"
      # Update SDK packages with the new version
      - "cd sdk/dir-py && {{ .UV_BIN }} version {{.RELEASE_VERSION}} && cd -"
      - "cd sdk/dir-js && npm version {{.RELEASE_VERSION}} --allow-same-version --no-git-tag-version && cd -"
      # Add release changes
      - |
        git add .
        git commit -S -m "release(dir): prepare release {{.RELEASE_VERSION}}"
      # Verify Go release
      - |
        {{ .MULTIMOD_BIN }} verify
        {{ .MULTIMOD_BIN }} prerelease --all-module-sets --skip-go-mod-tidy=true --commit-to-different-branch=false
      # Push prepared release
      - task: release:push

  release:push:
    internal: true
    vars:
      RELEASE_VERSION: "{{ .RELEASE_VERSION }}"
    prompt:
      - "Are you sure you want to push the release branch release/{{.RELEASE_VERSION}} to remote repository?"
    cmds:
      - |
        git push --set-upstream origin release/{{.RELEASE_VERSION}} || true

  ##
  ## API
  ##
  api:gen:
    desc: Generates API stubs
    dir: ./proto
    deps:
      - task: deps:protoc
      - task: deps:bufbuild
    # NOTE(ramizpolic): This allows Taskfile YAML parsing to accept '{' as a starting command token.
    # In translation, this is interpreted as a regular multi-line shell script.
    cmds:
      - "{{.BUFBUILD_BIN}} dep update"
      - "{{.BUFBUILD_BIN}} generate"

  api:clean:
    desc: Clean generated API stubs
    deps:
      - api:clean:go
      - api:clean:python
      - api:clean:javascript

  api:clean:go:
    desc: Clean generated golang API stubs
    dir: ./api
    cmds:
      - find . \( -name "*.pb.go" \) -type f -delete

  api:clean:python:
    desc: Clean generated Python API stubs
    dir: ./sdk/dir-py/agntcy
    cmd: rm -drf ./dir

  api:clean:javascript:
    desc: Clean generated JS/TS API stubs
    dir: ./sdk/dir-js/
    cmd: rm -drf ./api

  ##
  ## CLI
  ##
  cli:compile:
    desc: Compile CLI binaries
    dir: ./cli
    vars:
      GOOS: "{{ .GOOS | default OS }}"
      GOARCH: "{{ .GOARCH | default ARCH }}"
      BINARY_NAME: '{{ .BINARY_NAME | default "dirctl" }}'
      OUT_BINARY: '{{ if eq OS "windows" }}{{ .ROOT_DIR }}\\bin\\{{ .BINARY_NAME }}.exe{{ else }}{{ .ROOT_DIR }}/bin/{{ .BINARY_NAME }}{{ end }}'
      LDFLAGS: "-s -w -extldflags -static {{ .VERSION_LDFLAGS }}"
      TRY_SKIP_COMPILE: '{{ .TRY_SKIP_COMPILE | default "false" }}'
    cmds:
      - |
        if [ "{{.TRY_SKIP_COMPILE}}" = "true" ]; then
          if [ -f "{{.OUT_BINARY}}" ]; then
            echo "Binary {{.OUT_BINARY}} already exists, skipping compilation."
            exit 0
          else
            echo "Binary {{.OUT_BINARY}} does not exist, proceeding with compilation."
          fi
        fi

        CGO_ENABLED=0 GOOS={{.GOOS}} GOARCH={{.GOARCH}} go build -ldflags="{{ .LDFLAGS }}" -o "{{.OUT_BINARY}}" cli.go

  cli:compile:all:
    desc: Compile CLI client binaries for multiple platforms
    aliases: [compile]
    cmds:
      - for:
          matrix:
            OS: ["linux", "darwin", "windows"]
            ARCH: ["amd64", "arm64"]
        cmd: |
          # Skip unsupported combinations (e.g., Windows ARM64)
          if [ "{{.ITEM.OS}}" = "windows" ] && [ "{{.ITEM.ARCH}}" = "arm64" ]; then
            echo "Skipping unsupported platform: {{.ITEM.OS}}/{{.ITEM.ARCH}}"
          else
            GOOS={{.ITEM.OS}} GOARCH={{.ITEM.ARCH}} BINARY_NAME=dirctl-{{.ITEM.OS}}-{{.ITEM.ARCH}} task cli:compile
          fi

  ##
  ## MCP Server
  ##
  mcp:build:
    desc: Build the MCP server
    dir: ./mcp
    vars:
      GOOS: "{{ .GOOS | default OS }}"
      GOARCH: "{{ .GOARCH | default ARCH }}"
      OUT_BINARY: "{{ .BIN_DIR }}/mcp-server"
    cmds:
      - mkdir -p {{ .BIN_DIR }}
      - CGO_ENABLED=0 GOOS={{.GOOS}} GOARCH={{.GOARCH}} go build -o "{{.OUT_BINARY}}" main.go

  mcp:build:server:
    desc: Build the Directory Server binary for local MCP use
    dir: ./server/cmd
    vars:
      GOOS: "{{ .GOOS | default OS }}"
      GOARCH: "{{ .GOARCH | default ARCH }}"
      OUT_BINARY: "{{ .BIN_DIR }}/dir-server"
    cmds:
      - mkdir -p {{ .BIN_DIR }}
      - CGO_ENABLED=0 GOOS={{.GOOS}} GOARCH={{.GOARCH}} go build -o "{{.OUT_BINARY}}" main.go

  ##
  ## Client SDK
  ##
  sdk:deps:common:
    desc: Common dependencies for SDKs
    vars:
      TRY_SKIP_COMPILE: "{{ .TRY_SKIP_COMPILE }}"
    cmds:
      - task: deps:cosign
      - task: cli:compile
        vars:
          TRY_SKIP_COMPILE: "{{.TRY_SKIP_COMPILE}}"
      - task: sdk:deps:javascript
      - task: sdk:deps:python

  sdk:deps:cicd:iodc-token-generation:
    desc: Get Fulcio OIDC token for CICD
    requires:
      vars: [CLIENT_ID]
    cmds:
      - |
        OIDC_TOKEN=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
           "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value')

        CLIENT_ID="{{.CLIENT_ID}}"
        PROVIDER_URL="https://token.actions.githubusercontent.com"

        echo "OIDC_PROVIDER_URL=${PROVIDER_URL}"
        echo "CLIENT_ID=${CLIENT_ID}"
        echo "OIDC_TOKEN=${OIDC_TOKEN}"

  sdk:build:all:
    desc: Build all client SDK package
    cmds:
      - task: sdk:build:javascript
      - task: sdk:build:python

  sdk:build:python:
    desc: Build python client SDK package
    dir: ./sdk/dir-py
    deps:
      - task: sdk:deps:python
    cmds:
      - "{{.UV_BIN}} build"

  sdk:build:javascript:
    desc: Build javascript client SDK package
    dir: ./sdk/dir-js
    deps:
      - task: sdk:deps:javascript
    cmds:
      - npm run build

  sdk:test-env:create:
    desc: Create Kubernetes cluster test environment
    cmds:
      - task: deploy:kubernetes:local
        vars:
          DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL: 1s
      - task: deploy:kubernetes:local:port-forward

  sdk:test-env:delete:
    desc: Delete Kubernetes cluster test environment
    cmds:
      - task: deploy:kubernetes:local:port-forward:cleanup
      - task: deploy:kubernetes:local:cleanup

  sdk:test-env:spiffe:load-test-image:
    desc: Load the SDK tests into KinD
    deps:
      - task: api:gen
    vars:
      GOARCH: "{{ .GOARCH | default ARCH }}"
    cmds:
      - "{{.BAKE_ENV}} docker buildx bake sdks-test --set *.platform=linux/{{.GOARCH}} {{.IMAGE_BAKE_OPTS}}"
      - "{{.KUBECTL_BIN}} config use-context kind-dir.example"
      - "{{.KIND_BIN}} load docker-image ghcr.io/agntcy/sdks-test:{{.IMAGE_TAG}} --name dir.example"

  sdk:test:all:spiffe:
    desc: Test all client SDK pacakges with spiffe
    dir: ./e2e/sdk
    cmds:
      - "{{.KUBECTL_BIN}} config use-context kind-dir.example"
      - "{{.HELM_BIN}} uninstall sdk-tests --wait --keep-history --ignore-not-found > /dev/null || true"
      - "{{.HELM_BIN}} install --replace --timeout 3m --wait --wait-for-jobs sdk-tests ./chart -f chart/values.yaml --set image.tag={{.IMAGE_TAG}} > /dev/null || true"
      - |
        status=$({{.KUBECTL_BIN}} get job sdks-test -o jsonpath='{.status.conditions[0].type}')
        status_value=$({{.KUBECTL_BIN}} get job sdks-test -o jsonpath='{.status.conditions[0].status}')

        if [[ "$status" == "SuccessCriteriaMet" ]] && [[ "$status_value" == "True" ]]; then
          echo "SDKs test are finished successfully! ✅"
          exit 0
        fi

        if [[ "$status" == "FailureTarget" ]] && [[ "$status_value" == "True" ]]; then
          {{.KUBECTL_BIN}} logs jobs/sdks-test
          echo "SDKs test are failed! ❎"
          exit 1
        fi

        echo "Unknown error happend, check logs! ⚠️"
        exit 1

  sdk:test:all:
    desc: Test all client SDK packages
    cmds:
      - task: sdk:test:javascript
      - task: sdk:test:python

  sdk:test:python:
    desc: Test python client SDK package
    dir: ./sdk/dir-py
    deps:
      - task: sdk:deps:python
    env:
      KIND_CLUSTER_NAME: "sdk-py-test"
    cmds:
      - task: sdk:test-env:create
      - defer: { task: sdk:test-env:delete }
      - |
        export DIRCTL_PATH="$(printf "%s" "${DIRCTL_PATH:-{{ .DIRCTL_BIN }}}")"
        export COSIGN_PATH="$(printf "%s" "${COSIGN_PATH:-{{ .COSIGN_BIN }}}")"

        # Run SDK tests
        '{{.UV_BIN}}' run pytest

        # Run SDK example to verify it works
        cd {{ .ROOT_DIR }}/sdk/examples/example-py
        '{{.UV_BIN}}' sync
        '{{.UV_BIN}}' run python example.py

  sdk:test:javascript:
    desc: Test javascript client SDK package
    dir: ./sdk/dir-js
    deps:
      - task: sdk:deps:javascript
    env:
      KIND_CLUSTER_NAME: "sdk-js-test"
    cmds:
      - task: sdk:test-env:create
      - defer: { task: sdk:test-env:delete }
      - |
        export DIRCTL_PATH="$(printf "%s" "${DIRCTL_PATH:-{{ .DIRCTL_BIN }}}")"
        export COSIGN_PATH="$(printf "%s" "${COSIGN_PATH:-{{ .COSIGN_BIN }}}")"

        # Run SDK tests
        npm run test

        # Run SDK example to verify it works
        cd {{ .ROOT_DIR }}/sdk/examples/example-js
        npm install
        npm run example

  sdk:deps:python:
    desc: Install deps for python SDK package
    dir: ./sdk/dir-py
    deps:
      - task: deps:bufbuild
      - task: deps:uv
    cmds:
      - task: api:gen
      - "{{.UV_BIN}} sync --all-packages"

  sdk:deps:javascript:
    desc: Install deps for javascript SDK package
    dir: ./sdk/dir-js
    cmds:
      - npm install
      - task: api:gen

  sdk:release:all:
    desc: Release all client SDK package
    env:
      UV_PUBLISH_TOKEN: "{{ .UV_PUBLISH_TOKEN }}"
    cmds:
      - task: sdk:release:javascript
      - task: sdk:release:python

  sdk:release:python:
    desc: Release python client SDK package
    dir: ./sdk/dir-py
    env:
      UV_PUBLISH_TOKEN: "{{ .UV_PUBLISH_TOKEN }}"
    deps:
      - task: deps:uv
    cmds:
      - "{{.UV_BIN}} publish"

  sdk:release:javascript:
    desc: Release javascript client SDK package
    dir: ./sdk/dir-js
    cmd: |
      version=$(npm pkg get version)

      if [[ $version == *"rc"* ]]; then
        npm publish --scope=@agntcy --access public --tag rc-{{.COMMIT_SHA}}
      else
        npm publish --scope=@agntcy --access public
      fi

  ##
  ## Server
  ##
  server:build:
    desc: Build Directory server image
    cmds:
      - "{{.BAKE_ENV}} docker buildx bake {{.IMAGE_BAKE_OPTS}} dir-apiserver"

  server:start:
    desc: Start Directory server
    dir: server/cmd
    env:
      # Local development settings:
      # - Faster publication scheduling for quicker feedback
      # - OASF validation disabled (no external schema dependency)
      DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL: 1s
      DIRECTORY_SERVER_OASF_API_VALIDATION_DISABLE: "true"
    cmds:
      - defer: { task: server:store:stop }
      - task: server:store:start
      - go run main.go

  server:store:pull:
    desc: Pull local OCI registry server docker image
    vars:
      IMAGE: "{{.IMAGE}}"
    cmds:
      - |
        docker pull {{.IMAGE}}

  server:store:start:
    desc: Start local OCI registry server for storage
    internal: true
    vars:
      IMAGE: ghcr.io/project-zot/zot-linux-{{ARCH}}:v{{.ZOT_VERSION}}
    deps:
      - task: server:store:pull
        vars:
          IMAGE: "{{.IMAGE}}"
    cmds:
      - |
        # mount config
        cat > /tmp/config.json <<EOF
        {
          "distSpecVersion": "1.1.1",
          "storage": {
            "rootDirectory": "/tmp/zot"
          },
          "http": {
            "address": "0.0.0.0",
            "port": "5000"
          },
          "log": {
            "level": "debug"
          },
          "extensions": {
            "search": {
              "enable": true
            },
            "trust": {
              "enable": true,
              "cosign": true,
              "notation": false
            }
          }
        }
        EOF

        # run docker with attached volume
        docker run \
              -it \
              --rm -d -p 5000:5000 \
              -v /tmp/config.json:/config.json:ro \
              --name oci-registry {{.IMAGE}} serve /config.json

  server:store:stop:
    desc: Stop local OCI registry node
    internal: true
    cmds:
      - docker stop oci-registry

  server:bench:
    desc: Benchmark Directory server code
    dir: ./server
    cmds:
      - go -C . test -run=^$ -bench=. ./...

  ##
  ## Deploy
  ##
  deploy:kubernetes:setup-cluster:
    desc: Create a kind cluster and load Docker images
    deps:
      - deps:helm
      - deps:kubectl
      - deps:kind
    vars:
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
      KIND_CREATE_OPTS: '{{ .KIND_CREATE_OPTS | default "" }}'
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      DEPLOY_BAKE_ENV: '{{ if eq .E2E_COVERAGE_ENABLED "true" }}{{ .COVERAGE_BAKE_ENV }}{{ else }}{{ .BAKE_ENV }}{{ end }}'
      DEPLOY_BAKE_GROUP: '{{ if eq .E2E_COVERAGE_ENABLED "true" }}coverage{{ else }}default{{ end }}'
    cmds:
      # Create ephemeral cluster
      - "{{ .KIND_BIN }} create cluster {{ .KIND_CREATE_OPTS }} --name {{ .KIND_CLUSTER_NAME }}"
      - "{{ .KIND_BIN }} export kubeconfig --name {{ .KIND_CLUSTER_NAME }}"

      # Check cluster status
      - "{{ .KUBECTL_BIN }} cluster-info"

      # Import images
      - |
        images=$({{.DEPLOY_BAKE_ENV}} docker buildx bake {{.DEPLOY_BAKE_GROUP}} --print | jq -r '.target | with_entries(.value |= .tags[0]) | to_entries[] | .value')
        echo "$images" | while read image; do
          {{ .KIND_BIN }} load docker-image $image --name {{ .KIND_CLUSTER_NAME }}
        done

  deploy:kubernetes:gen-htpasswd-creds:
    desc: Generate htpasswd credentials and files for DIR deployment
    vars:
      HTPASSWD_USERNAME: '{{ .HTPASSWD_USERNAME | default "apiserver" }}'
      HTPASSWD_SYNC_USERNAME: '{{ .HTPASSWD_SYNC_USERNAME | default "sync-user" }}'
      CREDS_FILE: '{{ .CREDS_FILE | default "/tmp/dir-htpasswd-creds.env" }}'
      HTPASSWD_FILE: '{{ .HTPASSWD_FILE | default "/tmp/dir-htpasswd" }}'
    cmds:
      - |
        # Generate fresh passwords
        HTPASSWD_PASSWORD="$(openssl rand -hex 16)"
        HTPASSWD_SYNC_PASSWORD="$(openssl rand -hex 16)"

        # Generate derived values
        HTPASSWD_AUTH_HEADER="$(echo -n "{{ .HTPASSWD_USERNAME }}:${HTPASSWD_PASSWORD}" | base64)"
        HTPASSWD_ADMIN="$(htpasswd -nbB "{{ .HTPASSWD_USERNAME }}" "${HTPASSWD_PASSWORD}" | sed 's/^{{ .HTPASSWD_USERNAME }}://')"
        HTPASSWD_SYNC="$(htpasswd -nbB "{{ .HTPASSWD_SYNC_USERNAME }}" "${HTPASSWD_SYNC_PASSWORD}" | sed 's/^{{ .HTPASSWD_SYNC_USERNAME }}://')"

        # Write credentials to env file (for helm --set commands)
        cat > {{ .CREDS_FILE }} << EOF
        export HTPASSWD_USERNAME="{{ .HTPASSWD_USERNAME }}"
        export HTPASSWD_PASSWORD="${HTPASSWD_PASSWORD}"
        export HTPASSWD_AUTH_HEADER="${HTPASSWD_AUTH_HEADER}"
        export HTPASSWD_SYNC_USERNAME="{{ .HTPASSWD_SYNC_USERNAME }}"
        export HTPASSWD_SYNC_PASSWORD="${HTPASSWD_SYNC_PASSWORD}"
        EOF

        # Write htpasswd file (for helm --set-file commands)
        cat > {{ .HTPASSWD_FILE }} << EOF
        {{ .HTPASSWD_USERNAME }}:${HTPASSWD_ADMIN}
        {{ .HTPASSWD_SYNC_USERNAME }}:${HTPASSWD_SYNC}
        EOF

  deploy:kubernetes:cleanup-htpasswd-creds:
    desc: Cleanup htpasswd credentials and files
    vars:
      CREDS_FILE: '{{ .CREDS_FILE | default "/tmp/dir-htpasswd-creds.env" }}'
      HTPASSWD_FILE: '{{ .HTPASSWD_FILE | default "/tmp/dir-htpasswd" }}'
    cmds:
      - rm -f {{ .CREDS_FILE }}
      - rm -f {{ .HTPASSWD_FILE }}

  deploy:kubernetes:local:
    aliases: [deploy:local]
    desc: Deploy a local Directory server in Kubernetes
    deps:
      - deploy:kubernetes:setup-cluster
    vars:
      # Kind args
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
      KIND_CREATE_OPTS: '{{ .KIND_CREATE_OPTS | default "" }}'
      # Helm args
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-server" }}'
      HELM_CHART_PATH: "{{ .ROOT_DIR }}/install/charts/dir"
      HELM_VALUES_PATH: "{{ .ROOT_DIR }}/install/charts/dir/values.yaml"
      # Coverage config
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      DEPLOY_IMAGE_TAG: '{{ if eq .E2E_COVERAGE_ENABLED "true" }}{{ .COVERAGE_IMAGE_TAG }}{{ else }}{{ .IMAGE_TAG }}{{ end }}'
    cmds:
      # TODO: make logic idempotent so that running functional tests does not change previous contexts

      # Generate credentials and htpasswd file (using defaults)
      - task: deploy:kubernetes:gen-htpasswd-creds

      # Cleanup credentials on exit (using defaults)
      - defer:
          task: deploy:kubernetes:cleanup-htpasswd-creds

      # Deploy chart
      - |
        # Load credentials
        source /tmp/dir-htpasswd-creds.env

        {{ .HELM_BIN }} dependency build {{ .HELM_CHART_PATH }}

        {{ .HELM_BIN }} upgrade dir \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set apiserver.image.tag="{{ .DEPLOY_IMAGE_TAG }}" \
          {{ if .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
          --set apiserver.config.routing.refresh_interval="1s" \
          --set apiserver.secrets.ociAuth.username="${HTPASSWD_USERNAME}" \
          --set apiserver.secrets.ociAuth.password="${HTPASSWD_PASSWORD}" \
          --set apiserver.zot.authHeader="${HTPASSWD_AUTH_HEADER}" \
          --set-file apiserver.zot.secretFiles.htpasswd="/tmp/dir-htpasswd" \
          --set apiserver.secrets.syncAuth.username="${HTPASSWD_SYNC_USERNAME}" \
          --set apiserver.secrets.syncAuth.password="${HTPASSWD_SYNC_PASSWORD}" \
          {{ if .DIRECTORY_SERVER_RATELIMIT_ENABLED }}--set apiserver.config.ratelimit.enabled="{{ .DIRECTORY_SERVER_RATELIMIT_ENABLED }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_RATELIMIT_GLOBAL_RPS }}--set apiserver.config.ratelimit.global_rps="{{ .DIRECTORY_SERVER_RATELIMIT_GLOBAL_RPS }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_RATELIMIT_GLOBAL_BURST }}--set apiserver.config.ratelimit.global_burst="{{ .DIRECTORY_SERVER_RATELIMIT_GLOBAL_BURST }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_RATELIMIT_PER_CLIENT_RPS }}--set apiserver.config.ratelimit.per_client_rps="{{ .DIRECTORY_SERVER_RATELIMIT_PER_CLIENT_RPS }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_RATELIMIT_PER_CLIENT_BURST }}--set apiserver.config.ratelimit.per_client_burst="{{ .DIRECTORY_SERVER_RATELIMIT_PER_CLIENT_BURST }}"{{ end }} \
          {{ if eq .E2E_COVERAGE_ENABLED "true" }}--set-json 'apiserver.extraEnv=[{"name":"GOCOVERDIR","value":"/tmp/coverage"}]' --set apiserver.coverageVolume=true{{ end }} \
          {{ if .DIRECTORY_SERVER_OASF_API_VALIDATION_SCHEMA_URL }}--set apiserver.config.oasf_api_validation.schema_url="{{ .DIRECTORY_SERVER_OASF_API_VALIDATION_SCHEMA_URL }}"{{ end }} \
          {{ if .DIRECTORY_SERVER_OASF_API_VALIDATION_DISABLE }}--set apiserver.config.oasf_api_validation.disable="{{ .DIRECTORY_SERVER_OASF_API_VALIDATION_DISABLE }}"{{ end }} \
          {{ if ne .DIRECTORY_SERVER_OASF_API_VALIDATION_STRICT_MODE nil }}--set apiserver.config.oasf_api_validation.strict_mode="{{ .DIRECTORY_SERVER_OASF_API_VALIDATION_STRICT_MODE }}"{{ end }} \
          --namespace {{ .HELM_NAMESPACE }} \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  deploy:kubernetes:context:
    desc: Switch context to given Kubernetes cluster
    vars:
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
    cmds:
      - "{{ .KIND_BIN }} export kubeconfig --name {{ .KIND_CLUSTER_NAME }}"

  deploy:kubernetes:dir:
    desc: Deploy DIR helm chart
    vars:
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-server" }}'
      HELM_CHART_PATH: "{{ .ROOT_DIR }}/install/charts/dir"
      HELM_VALUES_PATH: "{{ .ROOT_DIR }}/install/charts/dir/values.yaml"
      HELM_EXTRA_ARGS: '{{ .HELM_EXTRA_ARGS | default "" }}'
    cmds:
      # Generate credentials and htpasswd file (using defaults)
      - task: deploy:kubernetes:gen-htpasswd-creds

      # Cleanup credentials on exit (using defaults)
      - defer:
          task: deploy:kubernetes:cleanup-htpasswd-creds

      # Deploy chart
      - |
        # Load credentials
        source /tmp/dir-htpasswd-creds.env

        {{ .HELM_BIN }} dependency build {{ .HELM_CHART_PATH }}

        {{ .HELM_BIN }} upgrade --install dir \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set apiserver.image.tag="{{ .IMAGE_TAG }}" \
          {{ if .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
          --set apiserver.secrets.ociAuth.username="${HTPASSWD_USERNAME}" \
          --set apiserver.secrets.ociAuth.password="${HTPASSWD_PASSWORD}" \
          --set apiserver.zot.authHeader="${HTPASSWD_AUTH_HEADER}" \
          --set-file apiserver.zot.secretFiles.htpasswd="/tmp/dir-htpasswd" \
          --set apiserver.secrets.syncAuth.username="${HTPASSWD_SYNC_USERNAME}" \
          --set apiserver.secrets.syncAuth.password="${HTPASSWD_SYNC_PASSWORD}" \
          --set apiserver.log_level="DEBUG" \
          {{ .HELM_EXTRA_ARGS }} \
          --namespace {{ .HELM_NAMESPACE }} \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  deploy:kubernetes:dirctl:
    desc: Deploy DIRCTL helm chart
    vars:
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-client" }}'
      HELM_CHART_PATH: "{{ .ROOT_DIR }}/install/charts/dirctl"
      HELM_VALUES_PATH: "{{ .ROOT_DIR }}/install/charts/dirctl/values.yaml"
      HELM_EXTRA_ARGS: '{{ .HELM_EXTRA_ARGS | default "" }}'
    cmds:
      - |
        {{ .HELM_BIN }} upgrade --install dirctl \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set image.tag="{{ .IMAGE_TAG }}" \
          {{ .HELM_EXTRA_ARGS }} \
          --namespace {{ .HELM_NAMESPACE }} \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  deploy:kubernetes:spire:
    desc: Deploy SPIRE helm chart
    vars:
      TRUST_DOMAIN: '{{ .TRUST_DOMAIN | default "example.org" }}'
      SERVICE_TYPE: '{{ .SERVICE_TYPE | default "LoadBalancer" }}'
      BUNDLE_PATH: '{{ .BUNDLE_PATH | default "/tmp/spire-bundle.spiffe" }}'
    cmds:
      - |
        {{ .HELM_BIN }} upgrade --install spire-crds spire-crds \
          --repo https://spiffe.github.io/helm-charts-hardened/ \
          --namespace spire-crds \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

      - |
        {{ .HELM_BIN }} upgrade --install spire spire \
          --repo https://spiffe.github.io/helm-charts-hardened/ \
          --set global.spire.trustDomain="{{ .TRUST_DOMAIN }}" \
          --set spire-server.image.tag="{{ .SPIRE_VERSION }}" \
          --set spire-agent.image.tag="{{ .SPIRE_VERSION }}" \
          --set spire-server.service.type="{{ .SERVICE_TYPE }}" \
          --set spire-server.federation.enabled="true" \
          --set spire-server.controllerManager.watchClassless="true" \
          --set spire-server.controllerManager.className="dir-spire" \
          --namespace spire \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

      - |
        {{ .KUBECTL_BIN }} get configmap -n spire spire-bundle -o json | jq '.data."bundle.spiffe"' -r > {{ .BUNDLE_PATH }}

  deploy:kubernetes:local:port-forward:
    aliases: [deploy:local:port-forward]
    desc: Set up port-forwarding for the local deployment
    vars:
      # Helm args
      HELM_NAMESPACE: '{{ .HELM_NAMESPACE | default "dir-server" }}'
    cmds:
      # Port-forward dependency services
      - |
        {{ .KUBECTL_BIN }} port-forward service/dir-apiserver 8888:8888 -n {{ .HELM_NAMESPACE }} &
        {{ .KUBECTL_BIN }} port-forward service/dir-apiserver 9090:9090 -n {{ .HELM_NAMESPACE }} &
        {{ .KUBECTL_BIN }} port-forward service/dir-ingress-controller 8080:80 -n {{ .HELM_NAMESPACE }} &

      # Delay to ensure services are online
      - sleep 10

  deploy:kubernetes:local:port-forward:cleanup:
    aliases: [deploy:local:port-forward:cleanup]
    desc: Cleanup port-forwarding processes
    cmds:
      # Kill any existing port-forward processes for the dir-apiserver and dir-ingress-controller services
      - kill -9 $(ps aux | grep port-forward | grep -E "(dir-apiserver|dir-ingress-controller)" | awk '{print $2}') || true

  deploy:kubernetes:local:cleanup:
    aliases: [deploy:local:cleanup, deploy:kubernetes:cleanup]
    desc: Cleanup Kubernetes environment for local deployment
    deps:
      - deps:kind
    vars:
      # Kind args
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
    cmds:
      - "{{ .KIND_BIN }} delete cluster --name {{ .KIND_CLUSTER_NAME }}"

  deploy:kubernetes:network:bootstrap:
    internal: true
    desc: Deploy a bootstrap Directory server in Kubernetes
    deps:
      - task: deploy:kubernetes:setup-cluster
        vars:
          E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
      - deps:dirctl-bin
    vars:
      # Helm args
      HELM_CHART_PATH: "{{ .ROOT_DIR }}/install/charts/dir"
      HELM_VALUES_PATH: "{{ .ROOT_DIR }}/install/charts/dir/values.yaml"
      # Coverage config
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      DEPLOY_IMAGE_TAG: '{{ if eq .E2E_COVERAGE_ENABLED "true" }}{{ .COVERAGE_IMAGE_TAG }}{{ else }}{{ .IMAGE_TAG }}{{ end }}'
    cmds:
      # Generate private key if it doesn't exist
      - |
        test -f /tmp/node.privkey || {{ .BIN_DIR }}/dirctl network init --output /tmp/node.privkey

      # Generate the bootstrap peer ID and export it to the environment file
      - |
        bootstrap_peerid=$({{ .BIN_DIR }}/dirctl network info /tmp/node.privkey)
        echo "PEER ID: ${bootstrap_peerid}"
        echo BOOTSTRAP_PEER_ID="${bootstrap_peerid}" > .env

      # Generate credentials and htpasswd file
      - task: deploy:kubernetes:gen-htpasswd-creds
        vars:
          CREDS_FILE: "/tmp/dir-htpasswd-creds-bootstrap.env"
          HTPASSWD_FILE: "/tmp/zot-htpasswd-bootstrap"

      # Cleanup credentials on exit
      - defer:
          task: deploy:kubernetes:cleanup-htpasswd-creds
          vars:
            CREDS_FILE: "/tmp/dir-htpasswd-creds-bootstrap.env"
            HTPASSWD_FILE: "/tmp/zot-htpasswd-bootstrap"

      # Deploy the bootstrap server using Helm
      - |
        # Load credentials
        source /tmp/dir-htpasswd-creds-bootstrap.env

        {{ .HELM_BIN }} dependency build {{ .HELM_CHART_PATH }}

        {{ .HELM_BIN }} upgrade agntcy-dir \
          {{ .HELM_CHART_PATH }} \
          -f {{ .HELM_VALUES_PATH }} \
          --set apiserver.image.tag="{{ .DEPLOY_IMAGE_TAG }}" \
            {{ if .PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
          --set apiserver.config.routing.refresh_interval="1s" \
          --set apiserver.secrets.privKey="$(cat /tmp/node.privkey)" \
          --set apiserver.config.routing.key_path="/etc/agntcy/dir/node.privkey" \
          --set apiserver.config.routing.listen_address="/ip4/0.0.0.0/tcp/8999" \
          --set apiserver.config.routing.directory_api_address="agntcy-dir-apiserver.bootstrap.svc.cluster.local:8888" \
          --set apiserver.config.store.oci.registry_address="agntcy-dir-zot.bootstrap.svc.cluster.local:5000" \
          --set apiserver.zot.extraVolumes[0].persistentVolumeClaim.claimName="agntcy-dir-zot-config" \
          --set apiserver.secrets.ociAuth.username="${HTPASSWD_USERNAME}" \
          --set apiserver.secrets.ociAuth.password="${HTPASSWD_PASSWORD}" \
          --set apiserver.zot.authHeader="${HTPASSWD_AUTH_HEADER}" \
          --set-file apiserver.zot.secretFiles.htpasswd="/tmp/zot-htpasswd-bootstrap" \
          --set apiserver.secrets.syncAuth.username="${HTPASSWD_SYNC_USERNAME}" \
          --set apiserver.secrets.syncAuth.password="${HTPASSWD_SYNC_PASSWORD}" \
          {{ if eq .E2E_COVERAGE_ENABLED "true" }}--set-json 'apiserver.extraEnv=[{"name":"GOCOVERDIR","value":"/tmp/coverage"}]' --set apiserver.coverageVolume=true{{ end }} \
          --namespace "bootstrap" \
          --create-namespace \
          --install \
          --wait \
          --wait-for-jobs \
          --timeout "15m"

  deploy:kubernetes:network:
    aliases: [deploy:network]
    desc: Deploy a network of Directory servers in Kubernetes (1 bootstrap + 3 peers)
    vars:
      HELM_CHART_PATH: "{{ .ROOT_DIR }}/install/charts/dir"
      HELM_VALUES_PATH: "{{ .ROOT_DIR }}/install/charts/dir/values.yaml"
      # Coverage config
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      DEPLOY_IMAGE_TAG: '{{ if eq .E2E_COVERAGE_ENABLED "true" }}{{ .COVERAGE_IMAGE_TAG }}{{ else }}{{ .IMAGE_TAG }}{{ end }}'
    cmds:
      # Deploy bootstrap with explicit var passing (not as dependency)
      - task: deploy:kubernetes:network:bootstrap
        vars:
          PUBLICATION_SCHEDULER_INTERVAL: "{{ .PUBLICATION_SCHEDULER_INTERVAL }}"
          E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"

      # Deploy the peer servers using Helm
      - for:
          matrix:
            PEER: ["peer1", "peer2", "peer3"]
        cmd: |
          export $(cat .env)

          # Generate fresh credentials for this peer using helper task
          task deploy:kubernetes:gen-htpasswd-creds \
            CREDS_FILE=/tmp/dir-htpasswd-creds-{{ .ITEM.PEER }}.env \
            HTPASSWD_FILE=/tmp/zot-htpasswd-{{ .ITEM.PEER }}

          # Load credentials
          source /tmp/dir-htpasswd-creds-{{ .ITEM.PEER }}.env

          {{ .HELM_BIN }} dependency build {{ .HELM_CHART_PATH }}
          {{ .HELM_BIN }} upgrade agntcy-dir \
            {{ .HELM_CHART_PATH }} \
            -f {{ .HELM_VALUES_PATH }} \
            --set apiserver.image.tag="{{ .DEPLOY_IMAGE_TAG }}" \
            {{ if .PUBLICATION_SCHEDULER_INTERVAL }}--set apiserver.config.publication.scheduler_interval="{{ .PUBLICATION_SCHEDULER_INTERVAL }}"{{ end }} \
            --set apiserver.config.routing.refresh_interval="1s" \
            --set apiserver.config.store.oci.registry_address="agntcy-dir-zot.{{ .ITEM.PEER }}.svc.cluster.local:5000" \
            --set apiserver.config.routing.bootstrap_peers[0]="/dns4/agntcy-dir-apiserver-routing.bootstrap.svc.cluster.local/tcp/8999/p2p/${BOOTSTRAP_PEER_ID}" \
            --set apiserver.config.routing.directory_api_address="agntcy-dir-apiserver.{{ .ITEM.PEER }}.svc.cluster.local:8888" \
            --set apiserver.zot.extraVolumes[0].persistentVolumeClaim.claimName="agntcy-dir-zot-config" \
            --set apiserver.secrets.ociAuth.username="${HTPASSWD_USERNAME}" \
            --set apiserver.secrets.ociAuth.password="${HTPASSWD_PASSWORD}" \
            --set apiserver.zot.authHeader="${HTPASSWD_AUTH_HEADER}" \
            --set-file apiserver.zot.secretFiles.htpasswd="/tmp/zot-htpasswd-{{ .ITEM.PEER }}" \
            --set apiserver.secrets.syncAuth.username="${HTPASSWD_SYNC_USERNAME}" \
            --set apiserver.secrets.syncAuth.password="${HTPASSWD_SYNC_PASSWORD}" \
            {{ if eq .E2E_COVERAGE_ENABLED "true" }}--set-json 'apiserver.extraEnv=[{"name":"GOCOVERDIR","value":"/tmp/coverage"}]' --set apiserver.coverageVolume=true{{ end }} \
            --namespace "{{ .ITEM.PEER }}" \
            --create-namespace \
            --install \
            --wait \
            --wait-for-jobs \
            --timeout "15m"

          # Cleanup temp files
          rm -f /tmp/zot-htpasswd-{{ .ITEM.PEER }}
          rm -f /tmp/dir-htpasswd-creds-{{ .ITEM.PEER }}.env

  deploy:kubernetes:network:port-forward:
    aliases: [deploy:network:port-forward]
    desc: Set up port-forwarding for the peers
    cmds:
      # Port-forward dependency services
      - "{{ .KUBECTL_BIN }} port-forward svc/agntcy-dir-apiserver -n peer1 8890:8888 &"
      - "{{ .KUBECTL_BIN }} port-forward svc/agntcy-dir-apiserver -n peer2 8891:8888 &"
      - "{{ .KUBECTL_BIN }} port-forward svc/agntcy-dir-apiserver -n peer3 8892:8888 &"

      # Delay to ensure services are online
      - sleep 10

  deploy:kubernetes:network:port-forward:cleanup:
    aliases: [deploy:network:port-forward:cleanup]
    desc: Cleanup port-forwarding processes
    cmds:
      # Kill any existing port-forward processes for the agntcy-dir-apiserver service
      - kill -9 $(ps aux | grep port-forward | grep agntcy-dir-apiserver | awk '{print $2}') || true

  deploy:kubernetes:network:cleanup:
    aliases: [deploy:network:cleanup]
    desc: Cleanup Kubernetes environment for network deployment
    vars:
      # Kind args
      KIND_CLUSTER_NAME: '{{ .KIND_CLUSTER_NAME | default "agntcy-cluster" }}'
    cmds:
      # Delete helm releases
      - for:
          matrix:
            PEER: ["bootstrap", "peer1", "peer2", "peer3"]
        cmd: |
          {{ .HELM_BIN }} delete --namespace {{ .ITEM.PEER }} agntcy-dir

      - "{{ .KIND_BIN }} delete cluster --name {{ .KIND_CLUSTER_NAME }}"

  ##
  ## Test
  ##
  test:unit:
    desc: Run unit tests on codebase
    aliases: [test]
    env:
      GOWORK: off
    vars:
      EXTRA_ARGS: '{{ .EXTRA_ARGS | default "" }}'
    cmds:
      - for: { var: GO_MOD_DIR_UNIT_TEST }
        cmd: |
          echo "Running tests in {{.ITEM}}"
          go -C {{.ITEM}} test ./... {{.EXTRA_ARGS}}

  test:unit:coverage:
    desc: Run all unit tests with coverage and generate summaries + HTML reports
    vars:
      COVERAGE_DIR: '{{ .COVERAGE_DIR | default (print .ROOT_DIR "/.coverage/unit") }}'
    cmds:
      - echo "Removing existing coverage directory and reports"
      - rm -rf {{.COVERAGE_DIR}}/*
      - echo "Creating new coverage directory"
      - mkdir -p {{.COVERAGE_DIR}}
      - |
        set -euo pipefail
        # Build list of modules from GO_MOD_DIR_UNIT_TEST
        modules=""
        {{range $dir := .GO_MOD_DIR_UNIT_TEST | splitList "\n"}}
        {{if $dir}}modules="$modules $(basename {{$dir}})"{{end}}
        {{end}}
        for m in $modules; do
          if [ -d "$m" ]; then
            echo "[coverage] Testing module: $m"
            (
              cd "$m"
              # Run tests with coverprofile (text format)
              if go test -covermode=atomic -coverprofile="{{.COVERAGE_DIR}}/$m.out.tmp" ./... -json 2>&1 | tee "{{.COVERAGE_DIR}}/test-report-$m.json" >/dev/null; then
                echo "[coverage] Completed: $m"
              else
                status=$?
                echo "[coverage][warn] Tests failed in $m (exit $status); continuing"
              fi
            )
            # Filter out generated files (matching codecov.yml ignores)
            if [ -f "{{.COVERAGE_DIR}}/$m.out.tmp" ]; then
              grep -v "\.pb\.go" "{{.COVERAGE_DIR}}/$m.out.tmp" | grep -v "mock_.*\.go" > "{{.COVERAGE_DIR}}/$m.out" || echo "mode: atomic" > "{{.COVERAGE_DIR}}/$m.out"
              rm "{{.COVERAGE_DIR}}/$m.out.tmp"
            else
              echo "[coverage] No coverage generated for $m"
              echo "mode: atomic" > "{{.COVERAGE_DIR}}/$m.out"
            fi
          fi
        done

      - |
        set -euo pipefail
        echo "[coverage] Generating per-module summaries"
        : > {{.COVERAGE_DIR}}/summary.txt
        # Build list of modules from GO_MOD_DIR_UNIT_TEST
        modules=""
        {{range $dir := .GO_MOD_DIR_UNIT_TEST | splitList "\n"}}
        {{if $dir}}modules="$modules $(basename {{$dir}})"{{end}}
        {{end}}
        for m in $modules; do
          if [ -f "{{.COVERAGE_DIR}}/$m.out" ]; then
            if (cd "$m" && go tool cover -func={{.COVERAGE_DIR}}/$m.out > {{.COVERAGE_DIR}}/$m.func.txt 2>/dev/null); then
              tail -n1 {{.COVERAGE_DIR}}/$m.func.txt | sed "s/^total:/[$m] total:/" >> {{.COVERAGE_DIR}}/summary.txt || true
            else
              echo "[$m] total: (error generating summary)" >> {{.COVERAGE_DIR}}/summary.txt
            fi
          fi
        done
        echo "[coverage] Summary:"; cat {{.COVERAGE_DIR}}/summary.txt

      - |
        set -euo pipefail
        echo "[coverage] Generating HTML reports"
        # Build list of modules from GO_MOD_DIR_UNIT_TEST
        modules=""
        {{range $dir := .GO_MOD_DIR_UNIT_TEST | splitList "\n"}}
        {{if $dir}}modules="$modules $(basename {{$dir}})"{{end}}
        {{end}}
        for m in $modules; do
          if [ -f "{{.COVERAGE_DIR}}/$m.out" ] && [ -d "$m" ]; then
            (cd "$m" && go tool cover -html={{.COVERAGE_DIR}}/$m.out -o {{.COVERAGE_DIR}}/$m.html || true)
          fi
        done
        echo "[coverage] Generated HTML files:"; ls -1 {{.COVERAGE_DIR}}/*.html 2>/dev/null | sed 's|{{.COVERAGE_DIR}}/|  - |' || echo "  (none)"

  bench:
    desc: Run bench tests on codebase
    cmds: # run in sequence
      - task: server:bench
      - echo "Done"

  test:e2e:
    desc: Run end-to-end tests for local deployment and network deployment
    aliases: [e2e]
    cmds:
      - task: test:e2e:local
      - task: test:e2e:network

  test:e2e:local:cli:
    desc: Run only local CLI tests (with dedicated infrastructure)
    aliases: [e2e:local:cli]
    vars:
      PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL | default "1s" }}'
      RATELIMIT_ENABLED: '{{ .RATELIMIT_ENABLED | default "false" }}'
      RATELIMIT_GLOBAL_RPS: '{{ .RATELIMIT_GLOBAL_RPS | default "100" }}'
      RATELIMIT_GLOBAL_BURST: '{{ .RATELIMIT_GLOBAL_BURST | default "200" }}'
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      COVERAGE_DIR: '{{ .COVERAGE_DIR | default (print .ROOT_DIR "/.coverage/e2e") }}'
    env:
      DIRECTORY_E2E_DEPLOYMENT_MODE: "local"
    cmds:
      - defer: { task: deploy:kubernetes:local:cleanup }
      - defer: { task: deploy:kubernetes:local:port-forward:cleanup }
      - defer:
          task: test:e2e:coverage:extract-pods
          vars:
            E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
            NAMESPACE: "dir-server"
            COVERAGE_DIR: "{{ .COVERAGE_DIR }}"
      - task: deploy:kubernetes:local
        vars:
          DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL: "{{ .PUBLICATION_SCHEDULER_INTERVAL }}"
          DIRECTORY_SERVER_RATELIMIT_ENABLED: "{{ .RATELIMIT_ENABLED }}"
          DIRECTORY_SERVER_RATELIMIT_GLOBAL_RPS: "{{ .RATELIMIT_GLOBAL_RPS }}"
          DIRECTORY_SERVER_RATELIMIT_GLOBAL_BURST: "{{ .RATELIMIT_GLOBAL_BURST }}"
          E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
      - task: deploy:kubernetes:local:port-forward
      - |
        # Run E2E tests with coverage if enabled
        if [ "{{.E2E_COVERAGE_ENABLED}}" = "true" ]; then
          mkdir -p {{.COVERAGE_DIR}}
          go test -C ./e2e/local -covermode=atomic -coverpkg={{ .COVERAGE_PKGS }} -coverprofile={{.COVERAGE_DIR}}/local-cli.out.tmp . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v
          # Filter out generated files (matching codecov.yml ignores)
          if [ -f {{.COVERAGE_DIR}}/local-cli.out.tmp ]; then
            grep -v "\.pb\.go" {{.COVERAGE_DIR}}/local-cli.out.tmp | grep -v "mock_.*\.go" > {{.COVERAGE_DIR}}/local-cli.out || echo "mode: atomic" > {{.COVERAGE_DIR}}/local-cli.out
            rm {{.COVERAGE_DIR}}/local-cli.out.tmp
          fi
        else
          go test -C ./e2e/local . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v
        fi

  test:e2e:client:
    desc: Run only client library tests (with dedicated infrastructure)
    aliases: [e2e:client]
    vars:
      PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL | default "1s" }}'
      RATELIMIT_ENABLED: '{{ .RATELIMIT_ENABLED | default "true" }}'
      RATELIMIT_GLOBAL_RPS: '{{ .RATELIMIT_GLOBAL_RPS | default "100" }}'
      RATELIMIT_GLOBAL_BURST: '{{ .RATELIMIT_GLOBAL_BURST | default "200" }}'
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      COVERAGE_DIR: '{{ .COVERAGE_DIR | default (print .ROOT_DIR "/.coverage/e2e") }}'
    env:
      DIRECTORY_E2E_DEPLOYMENT_MODE: "local"
    cmds:
      - defer: { task: deploy:kubernetes:local:cleanup }
      - defer: { task: deploy:kubernetes:local:port-forward:cleanup }
      - defer:
          task: test:e2e:coverage:extract-pods
          vars:
            E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
            NAMESPACE: "dir-server"
            COVERAGE_DIR: "{{ .COVERAGE_DIR }}"
      - task: deploy:kubernetes:local
        vars:
          DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL: "{{ .PUBLICATION_SCHEDULER_INTERVAL }}"
          DIRECTORY_SERVER_RATELIMIT_ENABLED: "{{ .RATELIMIT_ENABLED }}"
          DIRECTORY_SERVER_RATELIMIT_GLOBAL_RPS: "{{ .RATELIMIT_GLOBAL_RPS }}"
          DIRECTORY_SERVER_RATELIMIT_GLOBAL_BURST: "{{ .RATELIMIT_GLOBAL_BURST }}"
          E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
      - task: deploy:kubernetes:local:port-forward
      - |
        # Run E2E tests with coverage if enabled
        if [ "{{.E2E_COVERAGE_ENABLED}}" = "true" ]; then
          mkdir -p {{.COVERAGE_DIR}}
          go test -C ./e2e/client -covermode=atomic -coverpkg={{ .COVERAGE_PKGS }} -coverprofile={{.COVERAGE_DIR}}/local-client.out.tmp . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v
          # Filter out generated files (matching codecov.yml ignores)
          if [ -f {{.COVERAGE_DIR}}/local-client.out.tmp ]; then
            grep -v "\.pb\.go" {{.COVERAGE_DIR}}/local-client.out.tmp | grep -v "mock_.*\.go" > {{.COVERAGE_DIR}}/local-client.out || echo "mode: atomic" > {{.COVERAGE_DIR}}/local-client.out
            rm {{.COVERAGE_DIR}}/local-client.out.tmp
          fi
        else
          go test -C ./e2e/client . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v
        fi

  test:e2e:local:
    desc: Run end-to-end tests for local deployment (Client + CLI + Rate limiting tests)
    aliases: [e2e:local]
    vars:
      PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL | default "1s" }}'
      RATELIMIT_ENABLED: '{{ .RATELIMIT_ENABLED | default "true" }}'
      RATELIMIT_GLOBAL_RPS: '{{ .RATELIMIT_GLOBAL_RPS | default "100" }}'
      RATELIMIT_GLOBAL_BURST: '{{ .RATELIMIT_GLOBAL_BURST | default "200" }}'
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      COVERAGE_DIR: '{{ .COVERAGE_DIR | default (print .ROOT_DIR "/.coverage/e2e") }}'
    env:
      DIRECTORY_E2E_DEPLOYMENT_MODE: "local"
    cmds:
      - defer: { task: deploy:kubernetes:local:cleanup }
      - defer: { task: deploy:kubernetes:local:port-forward:cleanup }
      - defer:
          task: test:e2e:coverage:extract-pods
          vars:
            E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
            NAMESPACE: "dir-server"
      # Bootstrap infrastructure once for all test suites
      - task: deploy:kubernetes:local
        vars:
          DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL: "{{ .PUBLICATION_SCHEDULER_INTERVAL }}"
          DIRECTORY_SERVER_RATELIMIT_ENABLED: "{{ .RATELIMIT_ENABLED }}"
          DIRECTORY_SERVER_RATELIMIT_GLOBAL_RPS: "{{ .RATELIMIT_GLOBAL_RPS }}"
          DIRECTORY_SERVER_RATELIMIT_GLOBAL_BURST: "{{ .RATELIMIT_GLOBAL_BURST }}"
          E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
      - task: deploy:kubernetes:local:port-forward
      # Run client library tests first (faster feedback)
      - |
        if [ "{{.E2E_COVERAGE_ENABLED}}" = "true" ]; then
          mkdir -p {{.COVERAGE_DIR}}
          go test -C ./e2e/client -covermode=atomic -coverpkg={{ .COVERAGE_PKGS }} -coverprofile={{.COVERAGE_DIR}}/local-client.out.tmp . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v -ginkgo.label-filter="!ratelimit"
          # Filter out generated files (matching codecov.yml ignores)
          if [ -f {{.COVERAGE_DIR}}/local-client.out.tmp ]; then
            grep -v "\.pb\.go" {{.COVERAGE_DIR}}/local-client.out.tmp | grep -v "mock_.*\.go" > {{.COVERAGE_DIR}}/local-client.out || echo "mode: atomic" > {{.COVERAGE_DIR}}/local-client.out
            rm {{.COVERAGE_DIR}}/local-client.out.tmp
          fi
        else
          go test -C ./e2e/client . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v -ginkgo.label-filter="!ratelimit"
        fi
      # Run local CLI tests second (same infrastructure)
      - |
        if [ "{{.E2E_COVERAGE_ENABLED}}" = "true" ]; then
          mkdir -p {{.COVERAGE_DIR}}
          go test -C ./e2e/local -covermode=atomic -coverpkg={{ .COVERAGE_PKGS }} -coverprofile={{.COVERAGE_DIR}}/local-cli.out.tmp . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v
          # Filter out generated files (matching codecov.yml ignores)
          if [ -f {{.COVERAGE_DIR}}/local-cli.out.tmp ]; then
            grep -v "\.pb\.go" {{.COVERAGE_DIR}}/local-cli.out.tmp | grep -v "mock_.*\.go" > {{.COVERAGE_DIR}}/local-cli.out || echo "mode: atomic" > {{.COVERAGE_DIR}}/local-cli.out
            rm {{.COVERAGE_DIR}}/local-cli.out.tmp
          fi
        else
          go test -C ./e2e/local . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v
        fi
      # Wait 3 seconds for rate limit reset
      - sleep 3
      # Run rate limiting tests LAST
      - |
        if [ "{{.E2E_COVERAGE_ENABLED}}" = "true" ]; then
          mkdir -p {{.COVERAGE_DIR}}
          go test -C ./e2e/client -coverpkg={{ .COVERAGE_PKGS }} -coverprofile={{.COVERAGE_DIR}}/local-client.out . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v -ginkgo.label-filter="ratelimit"
        else
          go test -C ./e2e/client . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v -ginkgo.label-filter="ratelimit"
        fi

  test:e2e:network:
    desc: Run end-to-end tests for network deployment (Multi-peer CLI tests)
    aliases: [e2e:network]
    vars:
      PUBLICATION_SCHEDULER_INTERVAL: '{{ .PUBLICATION_SCHEDULER_INTERVAL | default "1s" }}'
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      COVERAGE_DIR: '{{ .COVERAGE_DIR | default (print .ROOT_DIR "/.coverage/e2e") }}'
    env:
      DIRECTORY_E2E_DEPLOYMENT_MODE: "network"
    cmds:
      - defer: { task: deploy:kubernetes:network:cleanup }
      - defer: { task: deploy:kubernetes:network:port-forward:cleanup }
      # Extract coverage from all network namespaces
      - defer:
          task: test:e2e:coverage:extract-pods
          vars:
            E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
            NAMESPACE: "bootstrap"
      - defer:
          task: test:e2e:coverage:extract-pods
          vars:
            E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
            NAMESPACE: "peer1"
      - defer:
          task: test:e2e:coverage:extract-pods
          vars:
            E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
            NAMESPACE: "peer2"
      - defer:
          task: test:e2e:coverage:extract-pods
          vars:
            E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
            NAMESPACE: "peer3"
      # Bootstrap
      # NOTE: Run as a dedicated task instead of dependency, otherwise the port forwarding won't work
      - task: deploy:kubernetes:network
        vars:
          PUBLICATION_SCHEDULER_INTERVAL: "{{ .PUBLICATION_SCHEDULER_INTERVAL }}"
          E2E_COVERAGE_ENABLED: "{{ .E2E_COVERAGE_ENABLED }}"
      - task: deploy:kubernetes:network:port-forward
      # Run network tests with proper isolation and cleanup
      - |
        if [ "{{.E2E_COVERAGE_ENABLED}}" = "true" ]; then
          mkdir -p {{.COVERAGE_DIR}}
          go test -C ./e2e/network -covermode=atomic -coverpkg={{ .COVERAGE_PKGS }} -coverprofile={{.COVERAGE_DIR}}/network.out.tmp . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v
          # Filter out generated files (matching codecov.yml ignores)
          if [ -f {{.COVERAGE_DIR}}/network.out.tmp ]; then
            grep -v "\.pb\.go" {{.COVERAGE_DIR}}/network.out.tmp | grep -v "mock_.*\.go" > {{.COVERAGE_DIR}}/network.out || echo "mode: atomic" > {{.COVERAGE_DIR}}/network.out
            rm {{.COVERAGE_DIR}}/network.out.tmp
          fi
        else
          go test -C ./e2e/network . -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 2h -timeout 2h -ginkgo.v
        fi

  test:e2e:spire:
    desc: Run end-to-end tests for SPIRE deployment
    cmds:
      # Run SPIRE deployment
      - defer: { task: test:spire:cleanup }
      - task: test:spire
      # Run SDK tests
      - task: sdk:deps:javascript
      - task: sdk:test-env:spiffe:load-test-image
      - task: sdk:test:all:spiffe

  # TODO: move spire out from here
  # TODO: change to Ingress services instead of LoadBalancer
  test:spire:
    desc: Test SPIRE federation setup between DIR and DIRCTL clusters
    deps:
      - task: helm:gen
    vars:
      AUTH_MODE: '{{ .AUTH_MODE | default "x509" }}' # or "jwt"
      DIR_TRUST_DOMAIN: '{{ .DIR_TRUST_DOMAIN | default "dir.example" }}'
      DIRCTL_TRUST_DOMAIN: '{{ .DIRCTL_TRUST_DOMAIN | default "dirctl.example" }}'
      DIR_DNS_NAME_TEMPLATE: '{{ .DIR_DNS_NAME_TEMPLATE | default "127.0.0.1.nip.io" }}'
    cmds:
      # Setup DIR cluster
      - task: deploy:kubernetes:setup-cluster
        vars:
          KIND_CLUSTER_NAME: "{{ .DIR_TRUST_DOMAIN }}"

      # Start cloud provider for LoadBalancer support
      - |
        echo "Starting Kind cloud provider for LoadBalancer support..."
        if [[ {{OS}} == "darwin" ]]; then
          sudo go run sigs.k8s.io/cloud-provider-kind@latest > /dev/null 2>&1 &
        elif [[ {{OS}} == "linux" ]]; then
          go run sigs.k8s.io/cloud-provider-kind@latest > /dev/null 2>&1 &
        else
          echo "Unknown OS"
          exit 1
        fi
        echo "Cloud provider started in background"

      # Deploy SPIRE on DIR cluster
      - task: deploy:kubernetes:spire
        vars:
          TRUST_DOMAIN: "{{ .DIR_TRUST_DOMAIN }}"
          BUNDLE_PATH: /tmp/{{ .DIR_TRUST_DOMAIN }}.spiffe

      # Setup DIRCTL cluster
      - task: deploy:kubernetes:setup-cluster
        vars:
          KIND_CLUSTER_NAME: "{{ .DIRCTL_TRUST_DOMAIN }}"

      # Start cloud provider for LoadBalancer support
      - |
        echo "Starting Kind cloud provider for LoadBalancer support..."
        go run sigs.k8s.io/cloud-provider-kind@latest > /dev/null 2>&1 &
        echo "Cloud provider started in background"

      # Deploy SPIRE on DIRCTL cluster
      - task: deploy:kubernetes:spire
        vars:
          TRUST_DOMAIN: "{{ .DIRCTL_TRUST_DOMAIN }}"
          BUNDLE_PATH: /tmp/{{ .DIRCTL_TRUST_DOMAIN }}.spiffe

      # Get DIR cluster service addresses
      - task: deploy:kubernetes:context
        vars:
          KIND_CLUSTER_NAME: "{{ .DIR_TRUST_DOMAIN }}"
      - |
        echo "Getting DIR cluster service addresses..."
        DIR_BUNDLE_IP=$(kubectl get service -n spire spire-server -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null || echo "127.0.0.1")
        echo "DIR_BUNDLE_ADDRESS=${DIR_BUNDLE_IP}:8443" >> /tmp/spire-addresses.env

      # Get DIRCTL cluster service addresses
      - task: deploy:kubernetes:context
        vars:
          KIND_CLUSTER_NAME: "{{ .DIRCTL_TRUST_DOMAIN }}"
      - |
        echo "Getting DIRCTL cluster service addresses..."
        DIRCTL_BUNDLE_IP=$(kubectl get service -n spire spire-server -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null || echo "127.0.0.1")
        echo "DIRCTL_BUNDLE_ADDRESS=${DIRCTL_BUNDLE_IP}:8443" >> /tmp/spire-addresses.env

      # Create DIR server federation config
      - |
        source /tmp/spire-addresses.env
        echo "Creating DIR server federation config..."
        cat > /tmp/server-federation.yaml << EOF
        apiserver:
          service:
            type: LoadBalancer
          config:
            authn:
              enabled: true
              mode: "{{ .AUTH_MODE }}"
              audiences:
                - "spiffe://{{ .DIR_TRUST_DOMAIN }}/spire/server"
            authz:
              enabled: true
              trust_domain: {{ .DIR_TRUST_DOMAIN }}
          extraEnv:
            - name: DIRECTORY_SERVER_OASF_API_VALIDATION_DISABLE
              value: "true"
          spire:
            enabled: true
            trustDomain: {{ .DIR_TRUST_DOMAIN }}
            className: dir-spire
            dnsNameTemplates:
              - "{{ .DIR_DNS_NAME_TEMPLATE }}"
            federation:
              - trustDomain: {{ .DIRCTL_TRUST_DOMAIN }}
                bundleEndpointURL: https://${DIRCTL_BUNDLE_ADDRESS}
                bundleEndpointProfile:
                  type: https_spiffe
                  endpointSPIFFEID: spiffe://{{ .DIRCTL_TRUST_DOMAIN }}/spire/server
                trustDomainBundle: |-
                  $(cat /tmp/{{ .DIRCTL_TRUST_DOMAIN }}.spiffe)
        EOF

      # Deploy DIR server with federation
      - task: deploy:kubernetes:context
        vars:
          KIND_CLUSTER_NAME: "{{ .DIR_TRUST_DOMAIN }}"
      - task: deploy:kubernetes:dir
        vars:
          KIND_CLUSTER_NAME: "{{ .DIR_TRUST_DOMAIN }}"
          HELM_EXTRA_ARGS: "-f /tmp/server-federation.yaml"
          DIRECTORY_SERVER_PUBLICATION_SCHEDULER_INTERVAL: 1s

      # Get DIR API server address
      - task: deploy:kubernetes:context
        vars:
          KIND_CLUSTER_NAME: "{{ .DIR_TRUST_DOMAIN }}"
      - |
        echo "Getting DIR API server address..."
        DIR_API_IP=$(kubectl get service -n dir-server dir-apiserver -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null || echo "127.0.0.1")
        echo "DIR_SERVER_ADDRESS=${DIR_API_IP}:8888" >> /tmp/spire-addresses.env

      # Create DIRCTL client federation config (for dirctl in dir.example)
      - |
        source /tmp/spire-addresses.env
        echo "Creating DIRCTL client federation config for dir.example..."
        cat > /tmp/client-federation-dir-example.yaml << EOF
        env:
          - name: DIRECTORY_CLIENT_SERVER_ADDRESS
            value: ${DIR_SERVER_ADDRESS}
          - name: DIRECTORY_CLIENT_AUTH_MODE
            value: "{{ .AUTH_MODE }}"
          - name: DIRECTORY_CLIENT_JWT_AUDIENCE
            value: "spiffe://{{ .DIR_TRUST_DOMAIN }}/spire/server"
        spire:
          enabled: true
          trustDomain: {{ .DIR_TRUST_DOMAIN }}
          className: dir-spire
        EOF

      # Deploy DIRCTL client in dir.example trust domain (same cluster as dir)
      - task: deploy:kubernetes:context
        vars:
          KIND_CLUSTER_NAME: "{{ .DIR_TRUST_DOMAIN }}"
      - task: deploy:kubernetes:dirctl
        vars:
          KIND_CLUSTER_NAME: "{{ .DIR_TRUST_DOMAIN }}"
          HELM_NAMESPACE: "dir-client"
          HELM_EXTRA_ARGS: "-f /tmp/client-federation-dir-example.yaml"

      # Create DIRCTL client federation config (for dirctl.example cluster)
      - |
        source /tmp/spire-addresses.env
        echo "Creating DIRCTL client federation config..."
        cat > /tmp/client-federation.yaml << EOF
        env:
          - name: DIRECTORY_CLIENT_SERVER_ADDRESS
            value: ${DIR_SERVER_ADDRESS}
          - name: DIRECTORY_CLIENT_AUTH_MODE
            value: "{{ .AUTH_MODE }}"
          - name: DIRECTORY_CLIENT_JWT_AUDIENCE
            value: "spiffe://{{ .DIR_TRUST_DOMAIN }}/spire/server"
        spire:
          enabled: true
          trustDomain: {{ .DIRCTL_TRUST_DOMAIN }}
          className: dir-spire
          federation:
            - trustDomain: {{ .DIR_TRUST_DOMAIN }}
              bundleEndpointURL: https://${DIR_BUNDLE_ADDRESS}
              bundleEndpointProfile:
                type: https_spiffe
                endpointSPIFFEID: spiffe://{{ .DIR_TRUST_DOMAIN }}/spire/server
              trustDomainBundle: |-
                $(cat /tmp/{{ .DIR_TRUST_DOMAIN }}.spiffe)
        EOF

      # Deploy DIRCTL client with federation (in dirctl.example cluster)
      - task: deploy:kubernetes:context
        vars:
          KIND_CLUSTER_NAME: "{{ .DIRCTL_TRUST_DOMAIN }}"
      - task: deploy:kubernetes:dirctl
        vars:
          KIND_CLUSTER_NAME: "{{ .DIRCTL_TRUST_DOMAIN }}"
          HELM_EXTRA_ARGS: "-f /tmp/client-federation.yaml"

      # Display completion status
      - |
        source /tmp/spire-addresses.env
        echo "=============================================="
        echo "SPIRE federation test deployment complete!"
        echo "=============================================="
        echo "DIR Server: ${DIR_SERVER_ADDRESS}"
        echo "DIR Bundle: ${DIR_BUNDLE_ADDRESS}"
        echo "DIRCTL Bundle: ${DIRCTL_BUNDLE_ADDRESS}"
        echo ""
        echo "Trust domains setup:"
        echo "  DIR: {{ .DIR_TRUST_DOMAIN }}"
        echo "  DIRCTL Internal: {{ .DIR_TRUST_DOMAIN }}"
        echo "  DIRCTL External: {{ .DIRCTL_TRUST_DOMAIN }}"
        echo ""
        echo "To verify deployment:"
        echo "  kubectl --context kind-{{ .DIR_TRUST_DOMAIN }} get pods -n dir-server"
        echo "  kubectl --context kind-{{ .DIR_TRUST_DOMAIN }} logs -n dir-client -l app.kubernetes.io/name=dirctl"
        echo "  kubectl --context kind-{{ .DIRCTL_TRUST_DOMAIN }} logs -n dir-client -l app.kubernetes.io/name=dirctl"
        echo ""
        echo "To cleanup:"
        echo "  task test:spire:cleanup"

  test:spire:cleanup:
    desc: Cleanup SPIRE federation test clusters
    vars:
      DIR_TRUST_DOMAIN: '{{ .DIR_TRUST_DOMAIN | default "dir.example" }}'
      DIRCTL_TRUST_DOMAIN: '{{ .DIRCTL_TRUST_DOMAIN | default "dirctl.example" }}'
    cmds:
      - echo "Cleaning up DIR cluster ({{ .DIR_TRUST_DOMAIN }})..."
      - task: deploy:kubernetes:cleanup
        vars:
          KIND_CLUSTER_NAME: "{{ .DIR_TRUST_DOMAIN }}"
      - echo "Cleaning up DIRCTL cluster ({{ .DIRCTL_TRUST_DOMAIN }})..."
      - task: deploy:kubernetes:cleanup
        vars:
          KIND_CLUSTER_NAME: "{{ .DIRCTL_TRUST_DOMAIN }}"
      - echo "Cleanup complete!"

  test:e2e:coverage:
    desc: Run end-to-end tests with coverage
    aliases: [e2e:coverage]
    deps:
      - build:coverage
    vars:
      COVERAGE_DIR: '{{ .COVERAGE_DIR | default (print .ROOT_DIR "/.coverage/e2e") }}'
    cmds:
      - echo "Removing existing coverage directory and reports"
      - rm -rf {{.COVERAGE_DIR}}/*
      - echo "Creating new coverage directory"
      - mkdir -p {{.COVERAGE_DIR}}
      - E2E_COVERAGE_ENABLED=true task test:e2e
      - task: test:e2e:coverage:process
        vars:
          COVERAGE_DIR: "{{ .COVERAGE_DIR }}"

  test:e2e:coverage:extract-pods:
    desc: Extract coverage data from Kubernetes pods
    internal: true
    vars:
      E2E_COVERAGE_ENABLED: '{{ .E2E_COVERAGE_ENABLED | default "false" }}'
      NAMESPACE: '{{ .NAMESPACE | default "dir-server" }}'
      POD_SELECTOR: '{{ .POD_SELECTOR | default "app.kubernetes.io/name=apiserver" }}'
      COVERAGE_DIR: '{{ .COVERAGE_DIR | default (print .ROOT_DIR "/.coverage/e2e/pods") }}'
    cmds:
      - |
        if [ "{{.E2E_COVERAGE_ENABLED}}" = "true" ]; then
          echo "[coverage] Triggering graceful shutdown of pod to flush coverage data..."

          # Get pod matching the selector
          POD_NAME=$({{.KUBECTL_BIN}} get pods -n {{.NAMESPACE}} -l {{.POD_SELECTOR}} -o jsonpath='{.items[*].metadata.name}')

            if [ -n "$POD_NAME" ]; then
              # Send SIGTERM to PID 1 to trigger coverage flush (like the PoC)
              echo "[coverage] Sending SIGTERM to PID 1 in pod: $POD_NAME"
              {{.KUBECTL_BIN}} exec -n {{.NAMESPACE}} $POD_NAME -- sh -c 'kill -TERM 1' 2>/dev/null || true

              # Wait for container to restart (coverage files persist in emptyDir volume)
              echo "[coverage] Waiting for container to restart and coverage to be flushed..."
              sleep 5

              # Extract coverage files (emptyDir persists across container restarts)
              echo "[coverage] Extracting coverage data from pod: $POD_NAME"
              mkdir -p {{.COVERAGE_DIR}}/pod-$POD_NAME
              {{.KUBECTL_BIN}} cp -n {{.NAMESPACE}} $POD_NAME:/tmp/coverage {{.COVERAGE_DIR}}/pod-$POD_NAME 2>&1 || echo "[coverage][warn] Failed to extract from $POD_NAME"
          else
            echo "[coverage][warn] No pod found matching selector {{.POD_SELECTOR}}"
          fi
          echo "[coverage] Coverage data extracted to {{.COVERAGE_DIR}}"
        else
          echo "[coverage] E2E_COVERAGE_ENABLED is false, skipping pod coverage extraction"
        fi

  test:e2e:coverage:process:
    desc: Collect and merge E2E coverage data from pods
    vars:
      COVERAGE_DIR: '{{ .COVERAGE_DIR | default (print .ROOT_DIR "/.coverage/e2e") }}'
    cmds:
      - |
        echo "[e2e-coverage] Collecting and merging E2E coverage data from pods"
        if [ -d "{{.COVERAGE_DIR}}/pods" ]; then
          # Build comma-separated list of pod directories
          pod_dirs=$(find {{.COVERAGE_DIR}}/pods -mindepth 1 -maxdepth 1 -type d 2>/dev/null | tr '\n' ',' | sed 's/,$//')

          if [ -n "$pod_dirs" ]; then
            echo "  Found pod coverage directories"
            mkdir -p {{.COVERAGE_DIR}}/server-binary
            go tool covdata merge -i="$pod_dirs" -o={{.COVERAGE_DIR}}/server-binary
            go tool covdata textfmt -i={{.COVERAGE_DIR}}/server-binary -o={{.COVERAGE_DIR}}/server.out.tmp
            # Filter out generated files (matching codecov.yml ignores)
            if [ -f {{.COVERAGE_DIR}}/server.out.tmp ]; then
              grep -v "\.pb\.go" {{.COVERAGE_DIR}}/server.out.tmp | grep -v "mock_.*\.go" > {{.COVERAGE_DIR}}/server.out || echo "mode: atomic" > {{.COVERAGE_DIR}}/server.out
              rm {{.COVERAGE_DIR}}/server.out.tmp
            fi
          else
            echo "No pod coverage found"
          fi
        else
          echo "No pods directory found"
        fi

  ##
  ## Linters
  ##
  lint:go:
    desc: Run Golang linters
    deps:
      - task: deps:golangci-lint
    vars:
      FIX: '{{ .FIX | default "false" }}'
      FIX_FLAG: '{{if eq .FIX "true"}}--fix{{end}}'
    cmds:
      - for: { var: GO_MOD_DIR }
        cmd: |
          echo "Running golangci-lint in {{.ITEM}}"
          cd {{.ITEM}}
          {{.GOLANGCI_LINT_BIN}} run --config {{.ROOT_DIR}}/.golangci.yml {{.FIX_FLAG}}

  lint:buf:
    desc: Run Buf linters
    deps:
      - task: deps:protoc
      - task: deps:bufbuild
    dir: ./proto
    cmds:
      - "{{.BUFBUILD_BIN}} lint"

  lint:helm:
    desc: Run Helm linters
    deps:
      - task: deps:helm
    vars:
      HELM_CHARTS:
        sh: find ./install/charts -maxdepth 1 -mindepth 1 -type d -exec basename {} \;
    cmds:
      - for: { var: HELM_CHARTS }
        cmd: |
          echo "Running helm lint on {{.ITEM}}"
          {{.HELM_BIN}} dependency update ./install/charts/{{.ITEM}}
          {{.HELM_BIN}} lint ./install/charts/{{.ITEM}} --with-subcharts

  lint:
    desc: Run all linters
    deps:
      - lint:go
      - lint:buf
      - lint:helm

  ##
  ## License
  ##
  license:
    desc: Check licenses
    deps:
      - task: deps:licensei
    cmds:
      - for: { var: GO_MOD_DIR }
        cmd: echo "Running licensei in {{.ITEM}}" && cd {{.ITEM}} && {{ .LICENSEI_BIN }} check --config {{.ROOT_DIR}}/.licensei.toml

  license:cache:
    desc: Check licenses
    deps:
      - task: deps:licensei
    cmds:
      - for: { var: GO_MOD_DIR }
        cmd: echo "Running licensei in {{.ITEM}}" && cd {{.ITEM}} && {{ .LICENSEI_BIN }} cache --config {{.ROOT_DIR}}/.licensei.toml

  ##
  ## Various proof-of-concept tasks
  ##
  poc:integration:
    desc: Run integration against VS Code and Continue proof-of-concept.
    dir: ./docs/research/integrations
    prompt:
      - |
        Are you sure you want to run integration proof-of-concept?
        This will overwrite your local workspace VSCode and Continue configuration.
    vars:
      RECORD_FILE: '{{ .RECORD_FILE | default "docs/research/integrations/demo.record.json" }}'
    cmd: |
      # Prepare Python environment
      python3 -m venv venv
      . ./venv/bin/activate
      python3 -m pip install pyyaml

      # Run script
      python3 ./importer.py \
        -record={{.ROOT_DIR}}/{{.RECORD_FILE}} \
        -vscode_path={{.ROOT_DIR}}/.vscode \
        -continue_path={{.ROOT_DIR}}/.continue/assistants

      # Print env requirements
      cat .env.example

  poc:mcp-to-oasf:
    desc: Import MCP-to-OASF Exporter Agent into the current workspace.
    cmds:
      - task: poc:integration
        vars:
          RECORD_FILE: "docs/research/integrations/mcp-to-oasf-agent/extractor.record.json"

  ##
  ## Dependencies
  ##
  deps:
    desc: Install dependencies
    cmds:
      - task: deps:helm
      - task: deps:kubectl
      - task: deps:kind
      - task: deps:protoc
      - task: deps:bufbuild
      - task: deps:uv
      - task: deps:cosign

  deps:bin-dir:
    desc: Create bin directory
    internal: true
    run: once
    cmd: mkdir -p {{.BIN_DIR}}
    status:
      - test -d {{.BIN_DIR}}

  deps:dirctl-bin:
    desc: Compile dirctl binary
    internal: true
    run: once
    cmds:
      - task: cli:compile
    status:
      - test -f {{.BIN_DIR}}/dirctl

  deps:helm:
    desc: Ensure supported Helm version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which curl
      - which tar
    cmds:
      - cmd: echo "Downloading Helm v{{.HELM_VERSION}}..."
      - cmd: curl -sSfL 'https://get.helm.sh/helm-v{{.HELM_VERSION}}-{{OS}}-{{ARCH}}.tar.gz' --output - | tar xzvOf - '{{OS}}-{{ARCH}}/helm' > {{.HELM_BIN}}
      - cmd: chmod +x {{.HELM_BIN}}
    status:
      - test -x {{.HELM_BIN}}

  deps:kubectl:
    desc: Ensure supported kubectl version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which curl
    cmds:
      - cmd: echo "Downloading Kubectl v{{.KUBECTL_VERSION}}..."
      - cmd: curl -L "https://dl.k8s.io/release/v{{.KUBECTL_VERSION}}/bin/{{OS}}/{{ARCH}}/kubectl" -o {{.KUBECTL_BIN}}
      - cmd: chmod +x {{.KUBECTL_BIN}}
    status:
      - test -x {{.KUBECTL_BIN}}

  deps:kind:
    desc: Ensure supported kind version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which go
    cmds:
      - cmd: echo "Downloading Kind v{{.KIND_VERSION}}..."
      - cmd: GOBIN={{.BIN_DIR}} go install sigs.k8s.io/kind@v{{.KIND_VERSION}}
      - cmd: mv {{.BIN_DIR}}/kind {{.KIND_BIN}}
    status:
      - test -x {{.KIND_BIN}}

  deps:protoc:
    desc: Ensure supported Protoc version and plugins are installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which go
      - which curl
      - which unzip
    vars:
      ARCH_TYPE: '{{ if eq ARCH "arm64" }}aarch_64{{ else if eq ARCH "amd64" }}x86_64{{else if eq ARCH "s390x"}}x390_64{{ else }}{{ARCH}}{{ end }}'
      OS_VARIANT: '{{ if eq OS "darwin" }}osx-universal_binary{{ else if eq OS "windows" }}win64{{else}}linux-{{.ARCH_TYPE}}{{ end }}'
    cmds:
      - cmd: echo "Downloading Protoc v{{.PROTOC_VERSION}}..."
      - cmd: |
          curl -sL https://github.com/protocolbuffers/protobuf/releases/download/v{{.PROTOC_VERSION}}/protoc-{{.PROTOC_VERSION}}-{{.OS_VARIANT}}.zip -o {{.BIN_DIR}}/tmp.zip
          unzip -j {{.BIN_DIR}}/tmp.zip "bin/protoc" -d {{.BIN_DIR}}
          mv {{.BIN_DIR}}/protoc {{.PROTOC_BIN}}
          rm {{.BIN_DIR}}/tmp.zip
      - cmd: chmod +x {{.PROTOC_BIN}}
      - cmd: echo "Downloading go plugins for protoc..."
      - cmd: go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
      - cmd: go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
      - cmd: go install github.com/NathanBaulch/protoc-gen-cobra@latest
    status:
      - test -x {{.PROTOC_BIN}}

  deps:bufbuild:
    desc: Ensure supported bufbuild version is installed
    internal: true
    deps:
      - deps:bin-dir
    preconditions:
      - which curl
    vars:
      ARCH_TYPE: '{{ if eq ARCH "amd64" }}x86_64{{ else }}{{ARCH}}{{ end }}'
    cmds:
      - cmd: echo "Downloading BufBuild v{{.BUFBUILD_VERSION}}..."
      - cmd: |
          curl -L "https://github.com/bufbuild/buf/releases/download/v{{.BUFBUILD_VERSION}}/buf-{{OS}}-{{.ARCH_TYPE}}" -o {{.BUFBUILD_BIN}}
      - cmd: chmod +x {{.BUFBUILD_BIN}}
    status:
      - test -x {{.BUFBUILD_BIN}}

  deps:tidy:
    desc: Ensure dependencies are up-to-date
    cmds:
      - for: { var: GO_MOD_DIR }
        cmd: go -C {{.ITEM}} mod tidy -go={{.GO_VERSION}}

  deps:multimod-bin:
    desc: Build the multimod binary
    internal: true
    deps:
      - deps:bin-dir
    vars:
      MULTIMOD_REPO_DIR: "{{ .BIN_DIR }}/opentelemetry-go-build-tools"
    cmds:
      - git clone https://github.com/open-telemetry/opentelemetry-go-build-tools --branch multimod/v{{.MULTIMOD_VERSION}} {{.MULTIMOD_REPO_DIR}}
      - go build -C {{.MULTIMOD_REPO_DIR}}/multimod -o {{.MULTIMOD_BIN}} main.go
      - rm -rf {{.MULTIMOD_REPO_DIR}}
    status:
      - test -x {{.MULTIMOD_BIN}}

  deps:golangci-lint:
    desc: Install golangci-lint
    internal: true
    deps:
      - deps:bin-dir
    cmds:
      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s v{{.GOLANGCI_LINT_VERSION}}
      - mv {{.BIN_DIR}}/golangci-lint {{.GOLANGCI_LINT_BIN}}
      - chmod +x {{.GOLANGCI_LINT_BIN}}
    status:
      - test -x {{.GOLANGCI_LINT_BIN}}

  deps:licensei:
    desc: Install licensei
    internal: true
    deps:
      - deps:bin-dir
    cmds:
      - curl -sfL https://raw.githubusercontent.com/goph/licensei/master/install.sh | bash -s v{{.LICENSEI_VERSION}}
      - mv {{.BIN_DIR}}/licensei {{.LICENSEI_BIN}}
      - chmod +x {{.LICENSEI_BIN}}
    status:
      - test -x {{.LICENSEI_BIN}}

  deps:uv:
    desc: Install uv
    internal: true
    deps:
      - deps:bin-dir
    env:
      UV_INSTALL_DIR: "{{ .BIN_DIR }}"
    cmds:
      - curl -sfL https://astral.sh/uv/{{.UV_VERSION}}/install.sh | sh
      - mv {{.BIN_DIR}}/uv {{.UV_BIN}}
      - chmod +x {{.UV_BIN}}
      - rm {{.BIN_DIR}}/uvx
    status:
      - test -x {{.BIN_DIR}}/uv

  deps:cosign:
    desc: Install sigstore cosign
    dir: "{{ .BIN_DIR }}"
    internal: true
    cmds:
      - curl -sfL https://github.com/sigstore/cosign/releases/download/v{{.COSIGN_VERSION}}/cosign-{{OS}}-{{ARCH}} -o cosign-{{.COSIGN_VERSION}}
      - chmod +x cosign-{{.COSIGN_VERSION}}
    status:
      - test -x cosign-{{.COSIGN_VERSION}}

  deps:htpasswd:
    desc: Install htpasswd
    dir: "{{ .BIN_DIR }}"
    internal: true
    cmds:
      - npm install -g htpasswd

  ##
  ## Helm
  ##
  helm:gen:
    desc: Update Helm dependencies for chart and subcharts
    internal: true
    deps:
      - deps:helm
    vars:
      HELM_ALL_CHART_PATHS:
        sh: find . -name Chart.yaml -exec dirname {} \;
    cmds:
      # Add Helm repo
      - "{{ .HELM_BIN }} repo add project-zot http://zotregistry.dev/helm-charts"
      - "{{ .HELM_BIN }} repo add spiffe https://spiffe.github.io/helm-charts-hardened"

      # Update dependencies
      - for: { var: HELM_ALL_CHART_PATHS }
        cmd: "cd {{ .ITEM }} && {{ .HELM_BIN }} dependency update"

  ##
  ## GUI
  ##
  gui:build:macos:
    desc: Build the GUI for macOS
    dir: gui
    cmds:
      - flutter config --enable-macos-desktop
      - flutter create . --platforms=macos
      - flutter build macos