Taskfile.yml

# Copyright AGNTCY Contributors (https://github.com/agntcy)
# SPDX-License-Identifier: Apache-2.0

version: '3'

vars:
  VULN_SCAN_CHARTS:
    - applications/dir/dev
    - applications/oidc-gateway/dev
    - applications/spire/dev
    - applications/dex/dev
    - applications/dex-credentials/dev

tasks:
  default:
    cmds:
      - task -l

  deps:vuln:chart:images:
    desc: List container images from a Helm chart directory containing config.json
    requires:
      vars: [CHART_DIR]
    cmd: |
      CHART_REPO=$(jq -r .chart_repo "{{.CHART_DIR}}/config.json")
      CHART_NAME=$(jq -r .chart_name "{{.CHART_DIR}}/config.json")
      CHART_VERSION=$(jq -r .chart_version "{{.CHART_DIR}}/config.json")
      VALUES_FLAG=""
      [ -f "{{.CHART_DIR}}/values.yaml" ] && VALUES_FLAG="-f {{.CHART_DIR}}/values.yaml"
      if [[ "$CHART_REPO" == https://* ]]; then
        REPO_ALIAS=$(echo "$CHART_NAME" | tr '/' '-')
        helm repo add "$REPO_ALIAS" "$CHART_REPO" --force-update >/dev/null 2>&1
        helm template release "$REPO_ALIAS/$CHART_NAME" \
          --version "$CHART_VERSION" $VALUES_FLAG 2>/dev/null
      else
        helm template release "oci://$CHART_REPO/$CHART_NAME" \
          --version "$CHART_VERSION" $VALUES_FLAG 2>/dev/null
      fi | grep '^\s*image:' | awk '{print $2}' | tr -d '"'

  deps:vuln:images:list:
    desc: Output deduplicated vulnerability-scan image refs (one per line) for CI matrix
    cmd: |
      for chart in {{.VULN_SCAN_CHARTS | join " "}}; do
        task deps:vuln:chart:images CHART_DIR="{{.ROOT_DIR}}/$chart" 2>/dev/null
      done | sort -u

  deps:vuln:images:
    desc: Run vulnerability scan on container images resolved from Helm charts
    preconditions:
      - sh: command -v trivy
        msg: trivy is required – install it from https://aquasecurity.github.io/trivy
    cmd: |
      trivy clean --scan-cache
      IMAGES=$(task --silent deps:vuln:images:list)
      if [ -z "$IMAGES" ]; then
        echo "No images found to scan."
        exit 0
      fi
      echo "$IMAGES" | while IFS= read -r image; do
        echo "Scanning $image..."
        trivy image --scanners vuln --severity CRITICAL,HIGH,MEDIUM --ignore-unfixed "$image"
      done

  gen:
    desc: Generate application manifests
    cmds:
      - task: gen:dir

  gen:dir:
    desc: Generate Directory application manifests
    vars:
      DEST_VALUES: "{{ .ROOT_DIR }}/applications/dir/gen.values.yaml"
      # Glob pattern matches visible .yaml files only (excludes hidden .*.yaml templates)
      # Matches: dev.ads.outshift.io.yaml, spire.ads.outshift.io.yaml, etc.
      # Excludes: .federation.web.template.yaml, .federation.spiffe.template.yaml
      FEDERATION_SOURCE: "{{ .ROOT_DIR }}/onboarding/federation/*.yaml"
    cmds:
      # Add initial autogen comment to the destination file
      - echo "# This file is autogenerated by 'task gen:dir'." > {{ .DEST_VALUES }}
      - echo "# Do not edit directly." >> {{ .DEST_VALUES }}

      # Merge all federation configs into the destination file.
      # Only use bash and taskfile built-ins for compatibility.
      - |
        # One-liner to convert dot notation to YAML hierarchy
        cat <<EOF >> {{ .DEST_VALUES }}
        apiserver:
          spire:
            federation:
        EOF
        for file in {{ .FEDERATION_SOURCE }}; do
          if [ -f "$file" ]; then
            echo "    -" >> {{ .DEST_VALUES }}
            cat "$file" | sed 's/^/      /' >> {{ .DEST_VALUES }}
          fi
        done