Taskfile.scripts.yml

version: '3'

silent: true

tasks:
  help:
    desc: Detailed help
    cmds:
      - |
        echo "Tasks:"
        task --list

  lint:actionlint:
    desc: Lint GitHub Actions workflows with actionlint
    cmds:
      - |
        echo "▶️ Running actionlint..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work rhysd/actionlint:latest -color
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ actionlint passed"
        else
          echo "❌ actionlint failed"
          exit $rc
        fi

  lint:hadolint:
    desc: Lint Dockerfile with hadolint
    cmds:
      - |
        echo "▶️ Running hadolint..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work hadolint/hadolint:latest-debian < Dockerfile
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ hadolint passed"
        else
          echo "❌ hadolint failed"
          exit $rc
        fi

  lint:shellcheck:
    desc: Lint shell scripts with shellcheck
    shell: bash
    cmds:
      - |
        echo "▶️ Running shellcheck..."
        mapfile -t files < <(git ls-files '*.sh')
        if [ "${#files[@]}" -eq 0 ]; then
          echo "ℹ️ No shell scripts found, skipping shellcheck"
          exit 0
        fi
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work koalaman/shellcheck:stable -x -S style -- "${files[@]}"
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ shellcheck passed"
        else
          echo "❌ shellcheck failed"
          exit $rc
        fi

  lint:yamllint:
    desc: Lint YAML files with yamllint
    cmds:
      - |
        echo "▶️ Running yamllint..."
        set +e
        docker run --rm -i -v "$PWD:/work" -w /work cytopia/yamllint -c .yamllint.yml .
        rc=$?
        set -e
        if [ "$rc" -eq 0 ]; then
          echo "✅ yamllint passed"
        else
          echo "❌ yamllint failed"
          exit $rc
        fi

  docker:login:
    desc: Login to container registries
    cmds:
      - |
        set -eu
        has_dockerhub=false
        has_ghcr=false

        if [ -n '{{.DOCKER_USERNAME}}' ] && [ -n "${DOCKER_TOKEN:-}" ]; then
          has_dockerhub=true
        fi

        if [ -n '{{.GITHUB_USERNAME}}' ] && [ -n "${GITHUB_TOKEN:-}" ]; then
          has_ghcr=true
        fi

        if [ "$has_dockerhub" = false ] && [ "$has_ghcr" = false ]; then
          echo "❌ No registry credentials provided. Set DOCKER_USERNAME/DOCKER_TOKEN or GITHUB_USERNAME/GITHUB_TOKEN."
          exit 1
        fi

        if [ "$has_dockerhub" = true ]; then
          printf '%s' "${DOCKER_TOKEN}" | docker login -u '{{.DOCKER_USERNAME}}' --password-stdin
        fi

        if [ "$has_ghcr" = true ]; then
          printf '%s' "${GITHUB_TOKEN}" | docker login ghcr.io -u '{{.GITHUB_USERNAME}}' --password-stdin
        fi

  docker:cmds:
    desc: Show docker build commands
    cmds:
      - |
        echo "Local build:"
        echo "docker buildx build --platform {{.PLATFORMS_LOCAL}} --load ..."
        echo
        echo "Multi-arch push:"
        echo "docker buildx build --platform {{.PLATFORMS}} --push ..."

  docker:build:
    desc: Build image for the local host platform
    shell: bash
    cmds:
      - |
        set -eu
        docker buildx create --use >/dev/null 2>&1 || true
        cmd=(docker buildx build --platform '{{.PLATFORMS_LOCAL}}' --load --file '{{.DOCKERFILE}}')
        cmd+=(--build-arg "AZ_VERSION={{.VERSION_FULL}}")
        cmd+=(--label "org.label-schema.schema-version=1.0")
        cmd+=(--label "org.label-schema.build-date={{.BUILD_DATE}}")
        cmd+=(--label "org.label-schema.name={{.LABEL_NAME}}")
        cmd+=(--label "org.label-schema.description={{.LABEL_DESCRIPTION}}")
        cmd+=(--label "org.label-schema.usage={{.LABEL_DOCS_URL}}")
        cmd+=(--label "org.label-schema.url={{.LABEL_HOMEPAGE}}")
        cmd+=(--label "org.label-schema.vcs-url={{.LABEL_REPO_URL}}")
        cmd+=(--label "org.label-schema.vcs-ref={{.GIT_SHA}}")
        cmd+=(--label "org.label-schema.vendor={{.LABEL_VENDOR}}")
        cmd+=(--label "org.label-schema.version={{.VERSION_TAG}}")
        cmd+=(--label "org.opencontainers.image.created={{.BUILD_DATE}}")
        cmd+=(--label "org.opencontainers.image.authors={{.LABEL_AUTHOR}}")
        cmd+=(--label "org.opencontainers.image.url={{.LABEL_HOMEPAGE}}")
        cmd+=(--label "org.opencontainers.image.documentation={{.LABEL_DOCS_URL}}")
        cmd+=(--label "org.opencontainers.image.source={{.LABEL_REPO_URL}}")
        cmd+=(--label "org.opencontainers.image.version={{.VERSION_TAG}}")
        cmd+=(--label "org.opencontainers.image.revision={{.GIT_SHA}}")
        cmd+=(--label "org.opencontainers.image.vendor={{.LABEL_VENDOR}}")
        cmd+=(--label "org.opencontainers.image.licenses={{.LABEL_LICENSE}}")
        cmd+=(--label "org.opencontainers.image.title={{.LABEL_NAME}}")
        cmd+=(--label "org.opencontainers.image.description={{.LABEL_DESCRIPTION}}")
        cmd+=(--tag '{{.DOCKER_NAME}}:{{.EXACT_TAG}}')
        cmd+=(--tag '{{.DOCKER_NAME}}:{{.MINOR_TAG}}')
        cmd+=(--tag '{{.DOCKER_NAME}}:{{.LATEST_TAG}}')
        cmd+=(--tag '{{.GITHUB_NAME}}:{{.EXACT_TAG}}')
        cmd+=(--tag '{{.GITHUB_NAME}}:{{.MINOR_TAG}}')
        cmd+=(--tag '{{.GITHUB_NAME}}:{{.LATEST_TAG}}')
        cmd+=(.)
        "${cmd[@]}"

  docker:build:inspect:
    desc: Inspect the local exact-tag image
    cmds:
      - docker image inspect {{.DOCKER_NAME}}:{{.EXACT_TAG}} | jq

  docker:push:
    desc: Build and push multi-arch images
    shell: bash
    cmds:
      - |
        set -eu
        docker buildx create --use >/dev/null 2>&1 || true
        cmd=(docker buildx build --platform '{{.PLATFORMS}}' --push --file '{{.DOCKERFILE}}')
        cmd+=(--build-arg "AZ_VERSION={{.VERSION_FULL}}")
        cmd+=(--annotation 'index:org.label-schema.schema-version=1.0')
        cmd+=(--annotation 'index:org.label-schema.build-date={{.BUILD_DATE}}')
        cmd+=(--annotation 'index:org.label-schema.name={{.LABEL_NAME}}')
        cmd+=(--annotation 'index:org.label-schema.description={{.LABEL_DESCRIPTION}}')
        cmd+=(--annotation 'index:org.label-schema.usage={{.LABEL_DOCS_URL}}')
        cmd+=(--annotation 'index:org.label-schema.url={{.LABEL_HOMEPAGE}}')
        cmd+=(--annotation 'index:org.label-schema.vcs-url={{.LABEL_REPO_URL}}')
        cmd+=(--annotation 'index:org.label-schema.vcs-ref={{.GIT_SHA}}')
        cmd+=(--annotation 'index:org.label-schema.vendor={{.LABEL_VENDOR}}')
        cmd+=(--annotation 'index:org.label-schema.version={{.VERSION_TAG}}')
        cmd+=(--annotation 'index:org.opencontainers.image.created={{.BUILD_DATE}}')
        cmd+=(--annotation 'index:org.opencontainers.image.authors={{.LABEL_AUTHOR}}')
        cmd+=(--annotation 'index:org.opencontainers.image.url={{.LABEL_HOMEPAGE}}')
        cmd+=(--annotation 'index:org.opencontainers.image.documentation={{.LABEL_DOCS_URL}}')
        cmd+=(--annotation 'index:org.opencontainers.image.source={{.LABEL_REPO_URL}}')
        cmd+=(--annotation 'index:org.opencontainers.image.version={{.VERSION_TAG}}')
        cmd+=(--annotation 'index:org.opencontainers.image.revision={{.GIT_SHA}}')
        cmd+=(--annotation 'index:org.opencontainers.image.vendor={{.LABEL_VENDOR}}')
        cmd+=(--annotation 'index:org.opencontainers.image.licenses={{.LABEL_LICENSE}}')
        cmd+=(--annotation 'index:org.opencontainers.image.title={{.LABEL_NAME}}')
        cmd+=(--annotation 'index:org.opencontainers.image.description={{.LABEL_DESCRIPTION}}')
        cmd+=(--label "org.label-schema.schema-version=1.0")
        cmd+=(--label "org.label-schema.build-date={{.BUILD_DATE}}")
        cmd+=(--label "org.label-schema.name={{.LABEL_NAME}}")
        cmd+=(--label "org.label-schema.description={{.LABEL_DESCRIPTION}}")
        cmd+=(--label "org.label-schema.usage={{.LABEL_DOCS_URL}}")
        cmd+=(--label "org.label-schema.url={{.LABEL_HOMEPAGE}}")
        cmd+=(--label "org.label-schema.vcs-url={{.LABEL_REPO_URL}}")
        cmd+=(--label "org.label-schema.vcs-ref={{.GIT_SHA}}")
        cmd+=(--label "org.label-schema.vendor={{.LABEL_VENDOR}}")
        cmd+=(--label "org.label-schema.version={{.VERSION_TAG}}")
        cmd+=(--label "org.opencontainers.image.created={{.BUILD_DATE}}")
        cmd+=(--label "org.opencontainers.image.authors={{.LABEL_AUTHOR}}")
        cmd+=(--label "org.opencontainers.image.url={{.LABEL_HOMEPAGE}}")
        cmd+=(--label "org.opencontainers.image.documentation={{.LABEL_DOCS_URL}}")
        cmd+=(--label "org.opencontainers.image.source={{.LABEL_REPO_URL}}")
        cmd+=(--label "org.opencontainers.image.version={{.VERSION_TAG}}")
        cmd+=(--label "org.opencontainers.image.revision={{.GIT_SHA}}")
        cmd+=(--label "org.opencontainers.image.vendor={{.LABEL_VENDOR}}")
        cmd+=(--label "org.opencontainers.image.licenses={{.LABEL_LICENSE}}")
        cmd+=(--label "org.opencontainers.image.title={{.LABEL_NAME}}")
        cmd+=(--label "org.opencontainers.image.description={{.LABEL_DESCRIPTION}}")
        cmd+=(--tag '{{.DOCKER_NAME}}:{{.EXACT_TAG}}')
        cmd+=(--tag '{{.DOCKER_NAME}}:{{.MINOR_TAG}}')
        cmd+=(--tag '{{.DOCKER_NAME}}:{{.LATEST_TAG}}')
        cmd+=(--tag '{{.GITHUB_NAME}}:{{.EXACT_TAG}}')
        cmd+=(--tag '{{.GITHUB_NAME}}:{{.MINOR_TAG}}')
        cmd+=(--tag '{{.GITHUB_NAME}}:{{.LATEST_TAG}}')
        cmd+=(.)
        "${cmd[@]}"

  docker:push:inspect:
    desc: Inspect the pushed exact-tag image
    cmds:
      - docker buildx imagetools inspect {{.DOCKER_NAME}}:{{.EXACT_TAG}}

  test:structure:
    desc: Run container-structure-tests
    cmds:
      - |
        set -eu
        image="${IMAGE:-{{.DOCKER_NAME}}:{{.EXACT_TAG}}}"
        docker run --rm \
          -e INPUT_IMAGE="$image" \
          -e INPUT_CONFIG=tests/docker/azure.yml \
          -e INPUT_PULL=false \
          -v /var/run/docker.sock:/var/run/docker.sock \
          -v "$PWD:/work" \
          -w /work \
          devopsinfra/action-container-structure-test:v1

  alpine:update:
    desc: Update Alpine base image references and VERSION_ID test expectations
    cmds:
      - |
        set -eu
        if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
          echo "INFO: Not in a git repository; nothing to update"
          exit 0
        fi

        mkdir -p .tmp
        tracked_files=".tmp/alpine-update-files.txt"
        relevant_files=".tmp/alpine-update-relevant.txt"
        git ls-files > "$tracked_files"
        grep -E '(^|/)(Dockerfile[^/]*|[^/]+\.sh|\.github/workflows/.*\.ya?ml|tests/.*\.ya?ml)$' "$tracked_files" > "$relevant_files" || true

        if [ ! -s "$relevant_files" ]; then
          echo "INFO: No tracked Alpine-related source files found; nothing to update"
          exit 0
        fi

        latest_feed="$(curl -fsSL https://dl-cdn.alpinelinux.org/alpine/latest-stable/releases/x86_64/latest-releases.yaml)"
        latest_alpine="$(printf '%s\n' "$latest_feed" | awk '/^  version:/ {print $2}' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -1)"
        if [ -z "$latest_alpine" ]; then
          echo "ERROR: Could not resolve latest Alpine release"
          exit 1
        fi
        escaped_alpine="$(printf '%s' "$latest_alpine" | sed 's/\./\\\\./g')"

        found_refs=0
        while IFS= read -r file; do
          [ -n "$file" ] || continue
          if grep -Eq 'alpine:[0-9]+\.[0-9]+\.[0-9]+|expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+(\\?\.[0-9]+){2}\]' "$file"; then
            found_refs=1
            break
          fi
        done < "$relevant_files"

        if [ "$found_refs" -eq 0 ]; then
          echo "INFO: No Alpine version references found in tracked source files; nothing to update"
          exit 0
        fi

        updated=0
        while IFS= read -r file; do
          [ -n "$file" ] || continue
          before_file=".tmp/alpine-update-before"
          cp "$file" "$before_file"
          perl -0pi -e 's/alpine:\d+\.\d+\.\d+/alpine:'"$latest_alpine"'/g' "$file"
          if printf '%s\n' "$file" | grep -Eq '^tests/.*\.ya?ml$'; then
            perl -0pi -e 's/expectedOutput:\s*\[VERSION_ID=\d+(?:\\?\.\d+){2}\]/expectedOutput: [VERSION_ID='"$escaped_alpine"']/g' "$file"
          fi
          if ! cmp -s "$file" "$before_file"; then
            echo "UPDATE: Alpine references in $file -> $latest_alpine"
            updated=1
          fi
        done < "$relevant_files"
        rm -f .tmp/alpine-update-before

        if xargs grep -En 'expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+\.[0-9]+\.[0-9]+\]' < "$relevant_files" >/dev/null 2>&1; then
          echo "ERROR: Found unescaped VERSION_ID expectations after update"
          xargs grep -En 'expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+\.[0-9]+\.[0-9]+\]' < "$relevant_files" || true
          exit 1
        fi

        if xargs grep -En 'alpine:[0-9]+\\\.[0-9]+\\\.[0-9]+' < "$relevant_files" >/dev/null 2>&1; then
          echo "ERROR: Found escaped Alpine image tags after update"
          xargs grep -En 'alpine:[0-9]+\\\.[0-9]+\\\.[0-9]+' < "$relevant_files" || true
          exit 1
        fi

        if [ "$updated" -eq 0 ]; then
          echo "INFO: Alpine references already up to date"
        fi

  packages:update:
    desc: Update Alpine package pins in alpine-packages.txt
    cmds:
      - |
        set -eu
        if [ ! -f Dockerfile ] || [ ! -f alpine-packages.txt ]; then
          echo "INFO: Dockerfile or alpine-packages.txt not found; nothing to update"
          exit 0
        fi

        base_image="$(awk '
          toupper($1) == "FROM" {
            i = 2
            while (i <= NF && $i ~ /^--/) {
              i++
            }
            if (i <= NF) {
              image = $i
            }
          }
          END {
            if (image != "") {
              print image
            }
          }
        ' Dockerfile)"

        case "$base_image" in
          alpine:*) ;;
          *) echo "INFO: Base image is '$base_image', not Alpine; nothing to update"; exit 0 ;;
        esac

        alpine_line="${base_image#alpine:}"
        alpine_minor="$(printf '%s' "$alpine_line" | awk -F. '{print $1 "." $2}')"
        alpine_repo="v${alpine_minor}"
        arch="x86_64"

        normalize_minor() {
          printf '%s' "$1" | sed -E 's/^([0-9]+\.[0-9]+).*/\1/'
        }

        fetch_index() {
          repo="$1"
          out="$2"
          url="https://dl-cdn.alpinelinux.org/alpine/${alpine_repo}/${repo}/${arch}/APKINDEX.tar.gz"
          curl --fail --silent --show-error "$url" | tar -O -zx APKINDEX > "$out"
        }

        lookup_latest() {
          pkg="$1"
          for index in "$index_main" "$index_community"; do
            found="$(awk -v pkg="$pkg" '
              BEGIN { RS=""; FS="\n" }
              {
                p=""; v=""
                for (i=1; i<=NF; i++) {
                  if ($i ~ /^P:/) p=substr($i,3)
                  if ($i ~ /^V:/) v=substr($i,3)
                }
                if (p==pkg) { print v; exit }
              }
            ' "$index")"
            if [ -n "$found" ]; then
              printf '%s' "$found"
              return 0
            fi
          done
          return 1
        }

        mkdir -p .tmp
        index_main=".tmp/apkindex-main-${alpine_repo}-${arch}.txt"
        index_community=".tmp/apkindex-community-${alpine_repo}-${arch}.txt"
        fetch_index main "$index_main"
        fetch_index community "$index_community"

        tmp_out=".tmp/alpine-packages.updated.txt"
        : > "$tmp_out"
        updated=0
        while IFS= read -r line || [ -n "$line" ]; do
          if [ -z "$line" ] || printf '%s' "$line" | grep -Eq '^[[:space:]]*#'; then
            echo "$line" >> "$tmp_out"
            continue
          fi

          pkg="$(printf '%s' "$line" | sed -E 's/^([a-zA-Z0-9+_.-]+).*/\1/')"
          current_minor="$(printf '%s' "$line" | sed -nE 's/^[a-zA-Z0-9+_.-]+(~=|=~)([0-9]+\.[0-9]+).*$/\2/p')"
          latest_full="$(lookup_latest "$pkg" || true)"

          if [ -z "$latest_full" ]; then
            echo "$line" >> "$tmp_out"
            continue
          fi

          latest_minor="$(normalize_minor "$latest_full")"
          if [ "$latest_minor" != "$current_minor" ]; then
            updated=1
          fi
          echo "$pkg~=$latest_minor" >> "$tmp_out"
        done < alpine-packages.txt

        if ! cmp -s alpine-packages.txt "$tmp_out"; then
          mv "$tmp_out" alpine-packages.txt
        else
          rm -f "$tmp_out"
        fi

        if [ "$updated" -eq 0 ]; then
          echo "INFO: No Alpine package updates were required"
        fi

  dependency:update:
    desc: Update Azure CLI version and Alpine package pins
    cmds:
      - task: packages:update
      - |
        set -eu
        az_latest="$(curl -LsS https://pypi.org/pypi/azure-cli/json | jq -r '.info.version')"
        current='{{.AZ_VERSION}}'

        update_file() {
          file="$1"
          from="$2"
          to="$3"
          if [ "$from" = "$to" ]; then
            return 0
          fi
          from_escaped="$(printf '%s\n' "$from" | sed 's/[][\\.^$*&/]/\\&/g')"
          to_escaped="$(printf '%s\n' "$to" | sed 's/[&/\\]/\\&/g')"
          {{.SED}} -i "s/${from_escaped}/${to_escaped}/g" "$file"
        }

        set_arg() {
          file="$1"
          key="$2"
          value="$3"
          {{.SED}} -i "s|^ARG ${key}=.*$|ARG ${key}=${value}|g" "$file"
        }

        echo "Current Azure CLI: $current | Latest: $az_latest"
        set_arg Dockerfile AZ_VERSION "$az_latest"
        update_file README.md "$current" "$az_latest"
        update_file tests/docker/azure.yml "$current" "$az_latest"

        version_tag=""
        [ "$current" = "$az_latest" ] || version_tag="$version_tag az-$az_latest"
        if ! git diff --quiet -- alpine-packages.txt 2>/dev/null; then
          version_tag="$version_tag alpine-packages"
        fi
        version_tag="$(echo "$version_tag" | sed 's/^ *//')"
        version_branch="$(echo "$version_tag" | sed 's/ /-/g')"
        if [ -n "${GITHUB_ENV:-}" ]; then
          echo "VERSION_TAG=$version_tag" >> "$GITHUB_ENV"
          echo "VERSION_BRANCH=$version_branch" >> "$GITHUB_ENV"
        fi

  git:get-pr-template:
    desc: Download pull request template
    cmds:
      - mkdir -p .tmp
      - curl -LsS https://raw.githubusercontent.com/devops-infra/.github/refs/tags/v1/PULL_REQUEST_TEMPLATE.md -o .tmp/PULL_REQUEST_TEMPLATE.md

  git:set-config:
    desc: Set git identity for automation
    cmds:
      - git config user.name "github-actions[bot]"
      - git config user.email "github-actions[bot]@users.noreply.github.com"

  version:get:
    desc: Get current Azure CLI version
    cmds:
      - echo "{{.VERSION_FULL}}"

  version:set:
    desc: Validate version format
    cmds:
      - |
        if [ -z "{{.VERSION}}" ]; then
          echo "❌ ERROR: VERSION is empty"
          exit 1
        fi
        if ! printf '%s' "{{.VERSION}}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
          echo "❌ ERROR: VERSION '{{.VERSION}}' is not a valid Azure CLI version (expected X.Y.Z)"
          exit 1
        fi