github/x509-certificate-exporter
1
0
Fork 0
mirror of https://github.com/enix/x509-certificate-exporter.git synced 2026-08-19 12:06:30 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
6f2133fb06dd67419fbf9affc420a6701c307417
x509-certificate-exporter/Taskfile.yml
T

313 lines
11 KiB
YAML
Raw Blame History

version: '3'
# Thin façade over the build tools:
# - Dagger module (dagger.json at repo root, source in dagger/) for
# sandboxed QA/CI pipelines (lint, test, security, helm utilities).
# Invoked via `dagger call <function>` — find-up locates the module.
# - GoReleaser for ALL image builds — release pipeline AND the dev
# image consumed by Tilt (one Dockerfile path, dev image == release
# image). Driven by .goreleaser.yaml; in CI via release.yaml;
# locally via `task image` (full) or `task image:local` (host-arch
# only). Tilt invokes goreleaser directly with GORELEASER_TILT=1.
# - Direct CLI for things that don't need sandboxing: k3d/tilt for
# the dev cluster, ratchet on workflows (pinned via the Nix shell),
# Renovate dry-run via Docker, and `go mod tidy` / `go get -u`.
env:
DAGGER_NO_NAG: '1'
vars:
KUBECONFIG_DEV: '{{.TASKFILE_DIR}}/kubeconfig.yaml'
DEV_CLUSTER: x509ce-dev
DEV_REGISTRY: x509ce-dev-registry
DEV_REGISTRY_PORT: 5000
# Renovate-tracked (custom regex manager in renovate.json5).
DEV_K3S_IMAGE: rancher/k3s:v1.35.4-k3s1
tasks:
default:
desc: List available tasks
cmds:
- task --list
silent: true
check:
desc: Run every gate that CI runs — lint + test + security
cmds:
- task: lint
- task: test
- task: security
# ─── Build ───────────────────────────────────────────────────────────────
build:
desc: Build binary for the host platform (direct, no sandbox)
cmds:
- mkdir -p bin
- go build -trimpath -tags netgo,osusergo -o bin/x509-certificate-exporter ./cmd/x509-certificate-exporter
image:
desc: 'Build all release image variants locally via GoReleaser snapshot — no push, no sign'
# Snapshot mode skips git tag validation, push, and signing, so
# this is safe to run on any branch / dirty tree. Useful to verify
# the .goreleaser.yaml config produces what's expected.
# IMAGE_NAME defaults to the project name for local snapshots; CI
# overrides it via the `release` Environment's `vars.IMAGE_NAME`.
env:
IMAGE_NAME: '{{.IMAGE_NAME | default "x509-certificate-exporter"}}'
cmds:
- goreleaser release --snapshot --skip=publish,sign --clean
image:local:
desc: 'Like `task image` but only the host architecture — fast iteration, no QEMU cross-build'
# GORELEASER_LOCAL_PLATFORM=1 flips two switches at once:
# 1. builds[]: swaps the full 23-target cross-OS matrix for a
# Linux-only x509ce-local build (amd64).
# 2. dockers_v2: enables only the busybox-local / scratch-local
# entries, which build for `linux/{{ .Runtime.Goarch }}` —
# the host arch, no QEMU emulation.
# Disabled cross-arch entries are reported as "configuration is
# disabled" — cosmetic, exit code is 0.
env:
GORELEASER_LOCAL_PLATFORM: '1'
IMAGE_NAME: '{{.IMAGE_NAME | default "x509-certificate-exporter"}}'
cmds:
- goreleaser release --snapshot --skip=publish,sign --clean
# ─── Dev environment ─────────────────────────────────────────────────────
dev:up:
desc: tilt up — full dev loop (cluster, build, deploy, seed)
deps: [dev:cluster:up]
env:
KUBECONFIG: '{{.KUBECONFIG_DEV}}'
cmds:
- tilt up
dev:down:
desc: tilt down — remove deployed resources (cluster persists)
env:
KUBECONFIG: '{{.KUBECONFIG_DEV}}'
cmds:
- tilt down
dev:cluster:up:
desc: Bring up k3d cluster + local registry (idempotent)
env:
KUBECONFIG: '{{.KUBECONFIG_DEV}}'
_DEV_CLUSTER: '{{.DEV_CLUSTER}}'
_DEV_REGISTRY: '{{.DEV_REGISTRY}}'
_DEV_REGISTRY_PORT: '{{.DEV_REGISTRY_PORT}}'
_DEV_K3S_IMAGE: '{{.DEV_K3S_IMAGE}}'
_KUBECONFIG_DEV: '{{.KUBECONFIG_DEV}}'
cmds:
- cmd: |
if ! k3d registry get "$_DEV_REGISTRY" >/dev/null 2>&1; then
printf '[cluster] creating local registry at localhost:%s\n' "$_DEV_REGISTRY_PORT"
k3d registry create "$_DEV_REGISTRY" --port "$_DEV_REGISTRY_PORT" >/dev/null
fi
- cmd: |
if ! k3d cluster get "$_DEV_CLUSTER" >/dev/null 2>&1; then
printf '[cluster] creating k3d cluster %s\n' "$_DEV_CLUSTER"
k3d cluster create "$_DEV_CLUSTER" \
--image "$_DEV_K3S_IMAGE" \
--registry-use "k3d-${_DEV_REGISTRY}:${_DEV_REGISTRY_PORT}" \
--kubeconfig-update-default=false \
--kubeconfig-switch-context=false \
--k3s-arg "--disable=traefik@server:*" \
--k3s-arg "--disable=servicelb@server:*" \
--no-lb \
--wait
fi
- k3d kubeconfig get "$_DEV_CLUSTER" > "$_KUBECONFIG_DEV"
- chmod 600 "$_KUBECONFIG_DEV"
- printf '[cluster] ready — KUBECONFIG=%s\n' "$_KUBECONFIG_DEV"
- echo "[cluster] reminder — when you're done, free the resources with 'task dev:cluster:down'"
run: once
dev:cluster:down:
desc: Destroy cluster + registry
env:
KUBECONFIG: '{{.KUBECONFIG_DEV}}'
_DEV_CLUSTER: '{{.DEV_CLUSTER}}'
_DEV_REGISTRY: '{{.DEV_REGISTRY}}'
_KUBECONFIG_DEV: '{{.KUBECONFIG_DEV}}'
cmds:
- cmd: |
if k3d cluster get "$_DEV_CLUSTER" >/dev/null 2>&1; then
k3d cluster delete "$_DEV_CLUSTER"
fi
- cmd: |
if k3d registry get "$_DEV_REGISTRY" >/dev/null 2>&1; then
k3d registry delete "$_DEV_REGISTRY"
fi
- rm -f -- "$_KUBECONFIG_DEV"
- echo "[cluster] torn down"
# ─── Dependencies ────────────────────────────────────────────────────────
go:tidy:
desc: go mod tidy on the main module and ./dagger
cmds:
- go mod tidy
- go -C dagger mod tidy
go:upgrade:
desc: Upgrade all Go deps to latest then tidy (main module + ./dagger)
cmds:
- go get -u ./...
- go mod tidy
- go -C dagger get -u ./...
- go -C dagger mod tidy
nix:update:
desc: Update flake.lock to latest inputs
cmds:
- nix flake update
ratchet:pin:
desc: 'Pin every GitHub Action in .github/workflows/*.yaml to a commit SHA (one-shot bootstrap; Renovate maintains afterwards)'
cmds:
- ratchet pin .github/workflows/*.yaml
ratchet:update:
desc: 'Refresh already-pinned Action SHAs in .github/workflows/*.yaml to their latest tags'
cmds:
- ratchet update .github/workflows/*.yaml
renovate:plan:
desc: 'Dry-run Renovate against the working tree — extracts deps and lists planned bumps; does NOT modify files'
# `platform=local` defaults to `dryRun=lookup`: every detected
# update is logged but nothing touches the working tree. Useful for
# debugging renovate.json5 without polluting GitHub. Actual bumps
# come from .github/workflows/renovate.yaml.
cmds:
- |
export GITHUB_COM_TOKEN="$(gh auth token 2>/dev/null || echo '')"
docker run --rm \
-v "$(pwd):/usr/src/app" \
-w /usr/src/app \
--user "$(id -u):$(id -g)" \
-e RENOVATE_PLATFORM=local \
-e LOG_LEVEL=info \
-e GITHUB_COM_TOKEN \
renovate/renovate:43.142.1
# ─── Tests ───────────────────────────────────────────────────────────────
test:
desc: 'Run all tests (unit + e2e)'
cmds:
- task: test:unit
- task: test:e2e
test:unit:
desc: 'Unit tests with race detector + coverage (gotestsum)'
cmds:
- dagger call --progress tty test
test:e2e:
desc: 'End-to-end against a throwaway cluster — built and torn down by the task'
vars:
CLUSTER: x509ce-e2e
REGISTRY: x509ce-e2e-registry
REGISTRY_PORT: 5001
KUBECONFIG_E2E:
sh: mktemp -t e2e-XXXXXX.kubeconfig.yaml
env:
_CLUSTER: '{{.CLUSTER}}'
_REGISTRY: '{{.REGISTRY}}'
_REGISTRY_PORT: '{{.REGISTRY_PORT}}'
_KUBECONFIG_E2E: '{{.KUBECONFIG_E2E}}'
cmds:
- defer: rm -f -- "$_KUBECONFIG_E2E"
- defer: k3d registry delete "$_REGISTRY"
- defer: k3d cluster delete "$_CLUSTER"
- cmd: k3d cluster delete "$_CLUSTER" >/dev/null 2>&1
ignore_error: true
- cmd: k3d registry delete "$_REGISTRY" >/dev/null 2>&1
ignore_error: true
- k3d registry create "$_REGISTRY" --port "$_REGISTRY_PORT" --no-help
- cmd: |
k3d cluster create "$_CLUSTER" \
--registry-use "k3d-${_REGISTRY}:${_REGISTRY_PORT}" \
--kubeconfig-update-default=false \
--kubeconfig-switch-context=false \
--k3s-arg "--disable=traefik@server:*" \
--k3s-arg "--disable=servicelb@server:*" \
--no-lb \
--wait
- k3d kubeconfig get "$_CLUSTER" > "$_KUBECONFIG_E2E"
- cmd: |
export KUBECONFIG="$_KUBECONFIG_E2E"
tilt -f test/e2e/Tiltfile ci
# ─── Quality ─────────────────────────────────────────────────────────────
lint:
desc: Run all linters
cmds:
- task: lint:go
- task: lint:helm
- task: lint:renovate
- task: lint:markdown
lint:go:
desc: golangci-lint on Go code (full configured set)
cmds:
- dagger call lint-go
lint:gocritic:
desc: golangci-lint — gocritic checks only
cmds:
- dagger call lint-go --mode=gocritic
lint:gonocritic:
desc: golangci-lint — full set minus gocritic
cmds:
- dagger call lint-go --mode=no-critic
lint:helm:
desc: helm lint on the chart
cmds:
- dagger call lint-helm
lint:renovate:
desc: renovate-config-validator on renovate.json5
cmds:
- dagger call lint-renovate
lint:markdown:
desc: markdownlint-cli2 on hand-written Markdown
cmds:
- dagger call lint-markdown
# ─── Security ────────────────────────────────────────────────────────────
security:
desc: Run all security checks
cmds:
- task: security:govulncheck
- task: security:vuln-deps
- task: security:chart-misconfig
security:govulncheck:
desc: govulncheck — reachability-based CVE scan on Go code
cmds:
- dagger call govulncheck
security:vuln-deps:
desc: 'Trivy filesystem scan — Go deps, lockfiles, OS packages (HIGH/CRITICAL)'
cmds:
- dagger call trivy --scan-type=fs
security:chart-misconfig:
desc: 'Trivy IaC misconfig scan on chart/'
cmds:
- dagger call trivy --scan-type=config --scan-ref=chart
# ─── Documentation ───────────────────────────────────────────────────────
doc:
desc: Regenerate all documentation
cmds:
- task: doc:helm
doc:helm:
desc: Regenerate chart/README.md from values.yaml + .gotmpl
cmds:
- dagger call helm-docs export --path=chart/README.md
Reference in New Issue View Git Blame Copy Permalink