Makefile.toml

[config]
skip_core_tasks = true

[env]
BUILDSYS_ARCH = { script = ["uname -m"] }
BUILDSYS_ROOT_DIR = "${CARGO_MAKE_WORKING_DIRECTORY}"
BUILDSYS_BUILD_DIR = "${BUILDSYS_ROOT_DIR}/build"
BUILDSYS_PACKAGES_DIR = "${BUILDSYS_BUILD_DIR}/rpms"
BUILDSYS_IMAGES_DIR = "${BUILDSYS_BUILD_DIR}/images"
BUILDSYS_TOOLS_DIR = "${BUILDSYS_ROOT_DIR}/tools"
BUILDSYS_SOURCES_DIR = "${BUILDSYS_ROOT_DIR}/sources"
BUILDSYS_TIMESTAMP = { script = ["date +%s"] }
BUILDSYS_VERSION_BUILD = { script = ["git describe --always --dirty --exclude '*' || echo 00000000"] }
# For now, release config path can't be overridden with -e, because it's used
# later in this section.  You have to edit the path here in Makefile.toml to
# use a different Release.toml.
BUILDSYS_RELEASE_CONFIG_PATH = "${BUILDSYS_ROOT_DIR}/Release.toml"
BUILDSYS_VERSION_IMAGE = { script = ["awk -F '[ =\"]+' '$1 == \"version\" {print $2}' ${BUILDSYS_RELEASE_CONFIG_PATH}"] }
# This can be overridden with -e to build a different variant from the variants/ directory
BUILDSYS_VARIANT = "aws-k8s-1.17"
# Product name used for file and directory naming
BUILDSYS_NAME = "bottlerocket"

# These can be overridden with -e to change configuration for pubsys (`cargo
# make repo`).  In addition, you can set RELEASE_START_TIME to determine when
# update waves and repo metadata expiration times will start, instead of
# starting now.  (This can be an RFC3339 date, or an offset like "in X
# hours/days/weeks".)
PUBLISH_EXPIRATION_POLICY_PATH = "${BUILDSYS_ROOT_DIR}/tools/pubsys/policies/repo-expiration/2w-2w-1w.toml"
PUBLISH_WAVE_POLICY_PATH = "${BUILDSYS_ROOT_DIR}/sources/updater/waves/default-waves.toml"
PUBLISH_INFRA_CONFIG_PATH = "${BUILDSYS_ROOT_DIR}/Infra.toml"
# Default repo to read from PUBLISH_INFRA_CONFIG_PATH
PUBLISH_REPO = "default"
# Default signing key to use from PUBLISH_INFRA_CONFIG_PATH
PUBLISH_KEY = "default"

# The size in GiB of the data volume in the block device mapping of registered
# AMIs.  (You can also specify PUBLISH_ROOT_VOLUME_SIZE to override the root
# volume size; by default it's the image size, rounded up.)
PUBLISH_DATA_VOLUME_SIZE = "20"
# This can be overridden with -e to change the path to the file containing SSM
# parameter templates.  This file determines the parameter names and values
# that will be published to SSM when you run `cargo make ssm`.  See
# tools/pubsys/policies/ssm/README.md for more information.
PUBLISH_SSM_TEMPLATES_PATH = "${BUILDSYS_ROOT_DIR}/tools/pubsys/policies/ssm/defaults.toml"

# You can also set PUBLISH_REGIONS to override the list of regions from
# Infra.toml for AMI and SSM commands; it's a comma-separated list like
# "us-west-2,us-east-1".
# You can set NO_PROGRESS=true to not print progress bars during snapshot upload.
# You can use ALLOW_CLOBBER=true with the `ssm` task to make it overwrite existing values.
# (This is not required with `promote-ssm` because the intent of promotion is overwriting.)

# Disallow pulling directly Upstream URLs when lookaside cache results in MISSes as a fallback.
# To use the upstream source as fallback, override this on the command line and set it to 'true'
BUILDSYS_UPSTREAM_SOURCE_FALLBACK = "false"

# We require license checks to pass to build an image.  If you're working on a
# local change and don't have license information yet, you can run with `-e
# BUILDSYS_ALLOW_FAILED_LICENSE_CHECK=true` to allow the build to continue even
# if the license check fails.
BUILDSYS_ALLOW_FAILED_LICENSE_CHECK = "false"

# This controls how many `docker build` commands we'll invoke at once.
BUILDSYS_JOBS = "8"

CARGO_HOME = "${BUILDSYS_ROOT_DIR}/.cargo"
GO_MOD_CACHE = "${BUILDSYS_ROOT_DIR}/.gomodcache"
DOCKER_BUILDKIT = "1"

[env.development]
# Certain variables are defined here to allow us to override a component value
# on the command line.

# Depends on ${BUILDSYS_ARCH}.
BUILDSYS_SDK_IMAGE = "bottlerocket/sdk-${BUILDSYS_ARCH}:v0.12.0"

# Depends on ${BUILDSYS_JOBS}.
CARGO_MAKE_CARGO_ARGS = "--jobs ${BUILDSYS_JOBS} --offline --locked"

# Depends on ${BUILDSYS_ARCH} and ${BUILDSYS_VARIANT}.
BUILDSYS_OUTPUT_DIR = "${BUILDSYS_IMAGES_DIR}/${BUILDSYS_ARCH}-${BUILDSYS_VARIANT}"

# Depends on a number of variables defined above, and each other.
BUILDSYS_VERSION_FULL="${BUILDSYS_VERSION_IMAGE}-${BUILDSYS_VERSION_BUILD}"
# These names are used as prefixes for build and repo steps.
BUILDSYS_NAME_VARIANT="${BUILDSYS_NAME}-${BUILDSYS_VARIANT}-${BUILDSYS_ARCH}"
BUILDSYS_NAME_VERSION="${BUILDSYS_NAME}-${BUILDSYS_VERSION_FULL}"
BUILDSYS_NAME_FULL="${BUILDSYS_NAME_VARIANT}-${BUILDSYS_VERSION_FULL}"
# Repo directories have subdirectories for variant/arch, so we only want version here.
PUBLISH_REPO_BASE_DIR = "${BUILDSYS_BUILD_DIR}/repos"
PUBLISH_REPO_OUTPUT_DIR = "${PUBLISH_REPO_BASE_DIR}/${BUILDSYS_NAME_VERSION}"
# The default name of registered AMIs; override by setting PUBLISH_AMI_NAME.
PUBLISH_AMI_NAME_DEFAULT = "${BUILDSYS_NAME}-${BUILDSYS_VARIANT}-${BUILDSYS_ARCH}-v${BUILDSYS_VERSION_IMAGE}-${BUILDSYS_VERSION_BUILD}"

[tasks.setup]
script = [
'''
mkdir -p ${BUILDSYS_BUILD_DIR}
mkdir -p ${BUILDSYS_OUTPUT_DIR}
mkdir -p ${BUILDSYS_PACKAGES_DIR}
mkdir -p ${GO_MOD_CACHE}

for cmd in bash curl docker gunzip ; do
  if ! command -v ${cmd} >/dev/null 2>&1 ; then
    echo "required program '${cmd}' not found" >&2
    exit 1
  fi
done
'''
]

[tasks.fetch]
dependencies = [
  "fetch-sdk",
  "fetch-sources",
  "fetch-vendored",
]

[tasks.fetch-sdk]
dependencies = ["setup"]
script_runner = "bash"
script = [
'''
set -o pipefail
if ! docker image inspect ${BUILDSYS_SDK_IMAGE} >/dev/null 2>&1 ; then
  # Let curl resolve the certificates instead of the tasks resolved bundle.
  unset SSL_CERT_FILE SSL_CERT_DIR
  if ! curl https://cache.bottlerocket.aws/${BUILDSYS_SDK_IMAGE}.tar.gz \
       | gunzip | docker load ; then
    echo "failed to load '${BUILDSYS_SDK_IMAGE}'" >&2
    exit 1
  fi
fi
'''
]

[tasks.fetch-sources]
dependencies = ["setup"]
script_runner = "bash"
script = [
'''
for ws in sources packages variants/* tools; do
  [ -d "${ws}" ] || continue
  cargo fetch --locked --manifest-path ${ws}/Cargo.toml
done
chmod -R o+r ${CARGO_HOME}
'''
]

[tasks.fetch-vendored]
dependencies = ["setup", "fetch-sdk"]
script = [
'''
${BUILDSYS_TOOLS_DIR}/docker-go \
  --module-path ${BUILDSYS_SOURCES_DIR}/host-ctr \
  --sdk-image ${BUILDSYS_SDK_IMAGE} \
  --go-mod-cache ${GO_MOD_CACHE} \
  --command "go list -mod=readonly ./... >/dev/null && go mod vendor"
'''
]

[tasks.unit-tests]
dependencies = ["setup", "fetch-sdk", "fetch-sources", "fetch-vendored"]
script = [
'''
export VARIANT="${BUILDSYS_VARIANT}"

cargo test \
  ${CARGO_BUILD_ARGS} \
  ${CARGO_MAKE_CARGO_ARGS} \
  --manifest-path ${BUILDSYS_SOURCES_DIR}/Cargo.toml \
  --all

# host-ctr unit tests (go)
${BUILDSYS_TOOLS_DIR}/docker-go \
  --module-path ${BUILDSYS_SOURCES_DIR}/host-ctr \
  --sdk-image ${BUILDSYS_SDK_IMAGE} \
  --go-mod-cache ${GO_MOD_CACHE} \
  --command "cd cmd/host-ctr; go test -v"
'''
]

[tasks.build-tools]
dependencies = ["setup", "fetch"]
script = [
'''
cargo install \
  ${CARGO_MAKE_CARGO_ARGS} \
  --path tools/buildsys \
  --root tools \
  --force \
  --quiet
'''
]

[tasks.publish-tools]
dependencies = ["setup", "fetch-sources"]
script = [
'''
cargo install \
  ${CARGO_MAKE_CARGO_ARGS} \
  --path tools/pubsys \
  --root tools \
  --force \
  --quiet
'''
]

[tasks.build-packages]
dependencies = ["build-tools"]
script = [
'''
export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"
cargo build \
  ${CARGO_BUILD_ARGS} \
  ${CARGO_MAKE_CARGO_ARGS} \
  --manifest-path packages/Cargo.toml \
  --all
'''
]

[tasks.build-variant]
dependencies = ["build-packages"]
script = [
'''
export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"
cargo build \
  ${CARGO_BUILD_ARGS} \
  ${CARGO_MAKE_CARGO_ARGS} \
  --manifest-path variants/${BUILDSYS_VARIANT}/Cargo.toml
'''
]

[tasks.world-packages]
alias = "build-packages"

[tasks.world-variant]
alias = "build-variant"

[tasks.check-licenses]
dependencies = ["fetch"]
script = [
'''
[ "${BUILDSYS_ALLOW_FAILED_LICENSE_CHECK}" = "true" ] && set +e
(cd sources && cargo deny check --disable-fetch licenses)
(cd tools/buildsys && cargo deny check --disable-fetch licenses)
(cd tools/pubsys && cargo deny check --disable-fetch licenses)
set -e
'''
]

[tasks.link-clean]
dependencies = ["fetch"]
script = [
'''
for link in ${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_NAME_VARIANT}*; do
  if [ -L "${link}" ]; then
    rm ${link}
  fi
done
'''
]

[tasks.link-variant]
dependencies = ["build-variant"]
script = [
'''
mkdir -p ${BUILDSYS_OUTPUT_DIR}/latest
ln -snf ../${BUILDSYS_NAME_FULL}.img.lz4 \
  ${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_NAME_VARIANT}.img.lz4
ln -snf ../${BUILDSYS_NAME_FULL}-data.img.lz4 \
  ${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_NAME_VARIANT}-data.img.lz4
ln -snf ../${BUILDSYS_NAME_FULL}-boot.ext4.lz4 \
  ${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_NAME_VARIANT}-boot.ext4.lz4
ln -snf ../${BUILDSYS_NAME_FULL}-root.ext4.lz4 \
  ${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_NAME_VARIANT}-root.ext4.lz4
ln -snf ../${BUILDSYS_NAME_FULL}-root.verity.lz4 \
  ${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_NAME_VARIANT}-root.verity.lz4
ln -snf ../${BUILDSYS_NAME_FULL}-migrations.tar \
  ${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_NAME_VARIANT}-migrations.tar
'''
]

[tasks.build]
dependencies = [
    "link-clean",
    "check-licenses",
    "build-variant",
    "link-variant",
]

[tasks.world]
alias = "build"

# Builds a local repository based on the 'latest' built targets.  Uses pubsys
# to create a repo under /build/repos, named after the arch/variant/version,
# containing subdirectories for the repo metadata and targets.
[tasks.repo]
# Rather than depend on "build", which currently rebuilds images each run, we
# check for the image files below to save time.  This does mean that `cargo
# make` must be run before `cargo make repo`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

cleanup() {
   [ -n "${MIGRATIONS_DIR}" ] && rm -rf "${MIGRATIONS_DIR}"
}
trap 'cleanup' EXIT

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

bootlz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-boot.ext4.lz4"
rootlz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-root.ext4.lz4"
hashlz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-root.verity.lz4"
if [ ! -s "${bootlz4}" ] || [ ! -s "${rootlz4}" ] || [ ! -s "${hashlz4}" ]; then
   echo "Image files don't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make'" >&2
   exit 1
fi

# TODO: only add migrations from Release.toml, not all
MIGRATIONS_DIR="$(mktemp -d)"
tar xpf "${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-migrations.tar" -C "${MIGRATIONS_DIR}"
ADD_MIGRATION_TARGETS=()
for file in ${MIGRATIONS_DIR}/*; do
   [ -e "${file}" ] || continue
   ADD_MIGRATION_TARGETS+=("--copy-target ${file}")
done

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   repo \
   \
   --repo "${PUBLISH_REPO}" \
   --arch "${BUILDSYS_ARCH}" \
   --version "${BUILDSYS_VERSION_IMAGE}" \
   --variant "${BUILDSYS_VARIANT}" \
   \
   --boot-image "${bootlz4}" \
   --root-image "${rootlz4}" \
   --hash-image "${hashlz4}" \
   ${ADD_MIGRATION_TARGETS[*]} \
   \
   --repo-expiration-policy-path "${PUBLISH_EXPIRATION_POLICY_PATH}" \
   --release-config-path "${BUILDSYS_RELEASE_CONFIG_PATH}" \
   --wave-policy-path "${PUBLISH_WAVE_POLICY_PATH}" \
   \
   ${RELEASE_START_TIME:+--release-start-time ${RELEASE_START_TIME}} \
   \
   --signing-key "${PUBLISH_KEY}" \
   --outdir "${PUBLISH_REPO_OUTPUT_DIR}"

ln -sfn "${PUBLISH_REPO_OUTPUT_DIR##*/}" "${PUBLISH_REPO_BASE_DIR}/latest"
'''
]

[tasks.ami]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the image files below to save time.
# This does mean that `cargo make` must be run before `cargo make ami`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

cleanup() {
   [ -f "${root_image}" ] && rm -f "${root_image}"
   [ -f "${data_image}" ] && rm -f "${data_image}"
}
trap 'cleanup' EXIT

# Unlz4 the root / data images
rootlz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}.img.lz4"
root_image="${rootlz4%.lz4}"
datalz4="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-data.img.lz4"
data_image="${datalz4%.lz4}"
if [ ! -s "${rootlz4}" ] || [ ! -s "${datalz4}" ]; then
   echo "Image files don't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make'" >&2
   exit 1
fi
lz4 -df "${rootlz4}" "${root_image}"
lz4 -df "${datalz4}" "${data_image}"

# Canonicalize architecture identifier to the value recognized by EC2.
case "${BUILDSYS_ARCH,,}" in
   arm64|aarch64)
      arch=arm64 ;;
   x86_64|amd64)
      arch=x86_64 ;;
   *)
      arch="${BUILDSYS_ARCH}" ;;
esac

ami_output="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-amis.json"
ami_output_latest="${BUILDSYS_OUTPUT_DIR}/latest/${BUILDSYS_NAME_VARIANT}-amis.json"

ami_name="${PUBLISH_AMI_NAME:-${PUBLISH_AMI_NAME_DEFAULT}}"

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   ami \
   \
   --root-image "${root_image}" \
   --data-image "${data_image}" \
   ${PUBLISH_ROOT_VOLUME_SIZE:+--root-volume-size "${PUBLISH_ROOT_VOLUME_SIZE}"} \
   --data-volume-size "${PUBLISH_DATA_VOLUME_SIZE}" \
   \
   --arch "${arch}" \
   --name "${ami_name}" \
   --description "${PUBLISH_AMI_DESCRIPTION:-${ami_name}}" \
   \
   --ami-output "${ami_output}" \
   \
   ${NO_PROGRESS:+--no-progress} \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}

ln -snf "../${ami_output##*/}" "${ami_output_latest}"
'''
]

[tasks.ami-public]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make ami-public`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-amis.json"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   publish-ami \
   --grant \
   --group-names all \
   \
   --ami-input "${ami_input}" \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.ami-private]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make ami-private`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-amis.json"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   publish-ami \
   --revoke \
   --group-names all \
   \
   --ami-input "${ami_input}" \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.grant-ami]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make grant-ami`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

if [ -z "${GRANT_TO_USERS}" ] && [ -z "${GRANT_TO_GROUPS}" ]; then
   echo "GRANT_TO_USERS and/or GRANT_TO_GROUPS is mandatory for grant-ami; please give a comma-separated list of user IDs or group names" >&2
   exit 1
fi

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-amis.json"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   publish-ami \
   --grant \
   ${GRANT_TO_USERS:+--user-ids "${GRANT_TO_USERS}"} \
   ${GRANT_TO_GROUPS:+--group-names "${GRANT_TO_GROUPS}"} \
   \
   --ami-input "${ami_input}" \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.revoke-ami]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make revoke-ami`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

if [ -z "${REVOKE_FROM_USERS}" ] && [ -z "${REVOKE_FROM_GROUPS}" ]; then
   echo "REVOKE_FROM_USERS and/or REVOKE_FROM_GROUPS is mandatory for revoke-ami; please give a comma-separated list of user IDs or group names" >&2
   exit 1
fi

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-amis.json"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   publish-ami \
   --revoke \
   ${REVOKE_FROM_USERS:+--user-ids "${REVOKE_FROM_USERS}"} \
   ${REVOKE_FROM_GROUPS:+--group-names "${REVOKE_FROM_GROUPS}"} \
   \
   --ami-input "${ami_input}" \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.ssm]
# Rather than depend on "build", which currently rebuilds images each run, we
# depend on publish-tools and check for the input file below to save time.
# This does mean that `cargo make ami` must be run before `cargo make ssm`.
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

ami_input="${BUILDSYS_OUTPUT_DIR}/${BUILDSYS_NAME_FULL}-amis.json"
if [ ! -s "${ami_input}" ]; then
   echo "AMI input file doesn't exist for the current version/commit - ${BUILDSYS_VERSION_FULL} - please run 'cargo make ami'" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   ssm \
   \
   --ami-input "${ami_input}" \
   --arch "${BUILDSYS_ARCH}" \
   --variant "${BUILDSYS_VARIANT}" \
   --version "${BUILDSYS_VERSION_FULL}" \
   --template-path "${PUBLISH_SSM_TEMPLATES_PATH}" \
   \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"} \
   ${ALLOW_CLOBBER:+--allow-clobber}
'''
]

[tasks.promote-ssm]
dependencies = ["publish-tools"]
script_runner = "bash"
script = [
'''
set -e

export PATH="${BUILDSYS_TOOLS_DIR}/bin:${PATH}"

source="${SSM_SOURCE:-${BUILDSYS_VERSION_FULL}}"
target="${SSM_TARGET}"
if [ -z "${target}" ]; then
   echo "SSM_TARGET is mandatory for promote-ssm; please give the version (or pointer like "latest") to which you want to promote ${source}" >&2
   exit 1
fi

pubsys \
   --infra-config-path "${PUBLISH_INFRA_CONFIG_PATH}" \
   \
   promote-ssm \
   \
   --arch "${BUILDSYS_ARCH}" \
   --variant "${BUILDSYS_VARIANT}" \
   --source "${source}" \
   --target "${target}" \
   --template-path "${PUBLISH_SSM_TEMPLATES_PATH}" \
   \
   ${PUBLISH_REGIONS:+--regions "${PUBLISH_REGIONS}"}
'''
]

[tasks.clean]
dependencies = [
  "clean-sources",
  "clean-packages",
  "clean-images",
  "clean-repos",
]

[tasks.clean-sources]
script_runner = "bash"
script = [
'''
for ws in sources variants/* tools/{buildsys,pubsys}; do
  [ -d "${ws}" ] || continue
  cargo clean --manifest-path ${ws}/Cargo.toml
done
rm -f ${BUILDSYS_TOOLS_DIR}/bin/{buildsys,pubsys}
'''
]

[tasks.clean-packages]
script_runner = "bash"
script = [
'''
for ws in packages; do
  [ -d "${ws}" ] || continue
  cargo clean --manifest-path ${ws}/Cargo.toml
done
rm -rf ${BUILDSYS_PACKAGES_DIR}
'''
]

[tasks.clean-images]
script_runner = "bash"
script = [
'''
rm -rf ${BUILDSYS_IMAGES_DIR}
'''
]

[tasks.clean-repos]
script_runner = "bash"
script = [
'''
rm -rf ${PUBLISH_REPO_BASE_DIR}
'''
]

[tasks.default]
alias = "build"