Taskfile.yml

version: '3'

dotenv:
  - version.env

vars:
  COLLECTOR_VERSION_MAJOR: '{{.COLLECTOR_VERSION_MAJOR}}'
  COLLECTOR_VERSION_MINOR: '{{.COLLECTOR_VERSION_MINOR}}'
  COLLECTOR_VERSION_PATCH: '{{.COLLECTOR_VERSION_PATCH}}'
  COLLECTOR_VERSION: '{{.COLLECTOR_VERSION_MAJOR}}.{{.COLLECTOR_VERSION_MINOR}}.{{.COLLECTOR_VERSION_PATCH}}'
  COLLECTOR_VERSION_SUFFIX: '{{.COLLECTOR_VERSION_SUFFIX}}'
  COLLECTOR_REVISION: '{{.COLLECTOR_REVISION}}'
  GIT_REV:
    sh: git rev-parse --short HEAD
  TIMESTAMP_NOW: '{{now | date "20060102150405"}}'
  GO_LDFLAGS: >-
    -s
    -X github.com/Graylog2/collector/superv/version.version={{.COLLECTOR_VERSION}}{{.COLLECTOR_VERSION_SUFFIX}}
    -X github.com/Graylog2/collector/superv/version.commit={{.GIT_REV}}
  WINDOWS_INSTALLER_VERSION: '{{.COLLECTOR_VERSION}}-{{.COLLECTOR_REVISION}}{{.COLLECTOR_VERSION_SUFFIX | replace "-" "."}}'
  FMT_ARGS: >-
    -f .license.template
    -ignore '{.github,.idea,changelog,dist,out}/**'
    -ignore '**/*.{yml,yaml}'
    .
  FMT_ARGS_OTEL: >-
    -f .license.template.otel
    -ignore '**/*.{yml,yaml}'
    receiver/windowseventlogreceiver
    receiver/macosunifiedloggingreceiver
  # Add new Go modules here!
  GO_MODULES:
    - .
    - superv
    - receiver/macosunifiedloggingreceiver
    - receiver/windowseventlogreceiver
    #- extension/sidecar
    - internal/tools
  MACOS_PAYLOAD_PKG_DIR: '{{.ROOT_DIR}}/dist/macos'
  MACOS_TARGET_PKG_DIR: '{{.ROOT_DIR}}/target/macos'

includes:
  'receiver:winlog':
    taskfile: ./receiver/windowseventlogreceiver/Taskfile.yml
    dir: ./receiver/windowseventlogreceiver
  'receiver:macoslog':
    taskfile: ./receiver/macosunifiedloggingreceiver/Taskfile.yml
    dir: ./receiver/macosunifiedloggingreceiver
  superv:
    taskfile: ./superv/Taskfile.yml
    dir: ./superv
  builder:
    taskfile: ./builder/Taskfile.yml
    dir: ./builder
    vars:
      GO_LDFLAGS: '{{.GO_LDFLAGS}}'

tasks:
  default:
    desc: 'Show available tasks'
    cmds:
      - go tool task -l
    silent: true

  clean:
    desc: "Cleanup artifacts and build directories"
    cmds:
      - rm -vrf target
      - rm -vf builder/resource_windows.syso

  fmt:
    desc: 'Format Go sources and apply license headers'
    cmds:
      - gofmt -w -s -l .
      - go tool github.com/google/addlicense {{.FMT_ARGS_OTEL}}
      - go tool github.com/google/addlicense {{.FMT_ARGS}}

  fmt:check:
    desc: 'Verify license headers and formatting (non-mutating)'
    cmds:
      - go tool github.com/google/addlicense -check {{.FMT_ARGS_OTEL}}
      - go tool github.com/google/addlicense -check {{.FMT_ARGS}}
      - test -z "$(gofmt -l .)" || (echo 'gofmt found unformatted files' && gofmt -l . && exit 1)

  test:
    desc: 'Run unit tests for all modules'
    cmds: # We use cmds instead of deps to have deterministic order and output
      - task: receiver:winlog:test
      - task: receiver:macoslog:test
      - task: superv:test
      - task: builder:test

  build:
    desc: 'Build the collector for the host OS/arch'
    cmds:
      - task: builder:build

  vulncheck:
    desc: 'Run govulncheck for all modules'
    cmds:
      - for:
          var: GO_MODULES
          as: CURRENT
        cmd: go tool govulncheck -C {{.CURRENT}} ./...

  all:
    desc: 'Cross-compile collector for all platforms with full preflight'
    cmds:
      - task: fmt:check
      - task: vulncheck
      - task: builder:build:all

  package:linux:
    desc: "Build Linux packages"
    platforms: [linux]
    cmds:
      - for: ["deb", "rpm"]
        task: "package:linux:{{.ITEM}}"

  package:linux:deb:
    desc: "Build Linux DEB"
    platforms: [linux]
    cmds:
      - for: ["amd64", "arm64"]
        task: package:linux:do
        vars:
          NFPM_PACKAGER: "deb"
          NFPM_ARCH: "{{.ITEM}}"

  package:linux:rpm:
    desc: "Build Linux RPM"
    platforms: [linux]
    cmds:
      - for: ["amd64", "arm64"]
        task: package:linux:do
        vars:
          NFPM_PACKAGER: "rpm"
          NFPM_ARCH: "{{.ITEM}}"

  package:linux:do:
    internal: true
    platforms: [linux]
    requires:
      vars: ["NFPM_PACKAGER", "NFPM_ARCH"]
    env:
      VERSION: "{{.COLLECTOR_VERSION}}"
      VERSION_RELEASE: '{{.COLLECTOR_REVISION}}{{if ne .COLLECTOR_VERSION_SUFFIX ""}}.{{trimPrefix "-" .COLLECTOR_VERSION_SUFFIX}}.{{.TIMESTAMP_NOW}}{{end}}'
      VERSION_SUFFIX: '{{.COLLECTOR_VERSION_SUFFIX}}'
      ARCH: "{{.NFPM_ARCH}}"
    cmds:
      - cmd: echo PACKAGER={{.NFPM_PACKAGER }}
        silent: true
      - cmd: echo VERSION=$VERSION
        silent: true
      - cmd: echo VERSION_RELEASE=$VERSION_RELEASE
        silent: true
      - cmd: echo ARCH=$ARCH
        silent: true
      - nfpm package -f {{.ROOT_DIR}}/dist/linux/nfpm.yaml -p {{.NFPM_PACKAGER | lower}} -t {{.ROOT_DIR}}/target/

  package:install:scripts:
    desc: "Copy script"
    platforms: [linux]
    cmds:
      - cmd: mkdir -p "{{.ROOT_DIR}}/target"
      - cmd: cp "{{.ROOT_DIR}}/dist/install/install-"* "{{.ROOT_DIR}}/target"

  package:windows:msi:
    desc: 'Build Windows MSI installer (Windows only; requires dotnet SDK + WiX 7)'
    platforms: [windows]
    deps: [builder:build:windows:amd64]
    vars:
      VERSION: '{{.COLLECTOR_VERSION}}{{.COLLECTOR_VERSION_SUFFIX}}'
    cmds:
      - >-
        dotnet build dist/windows/graylog-collector.wixproj
        -c Release
        -p:Version={{.COLLECTOR_VERSION}}
        -p:SourceExe={{.ROOT_DIR}}/target/graylog-collector-{{.VERSION}}-windows-amd64.exe
        -p:LicenseFile={{.ROOT_DIR}}/LICENSE
        -p:OutputPath={{.ROOT_DIR}}/target/

  package:macos:pkg:
    # dep of package:macos:pkg:notarize - don't rebuild when both are invoked
    run: once
    desc: "Build macOS pkg installer (macOS only)"
    vars:
      VERSION: '{{.COLLECTOR_VERSION}}{{.COLLECTOR_VERSION_SUFFIX}}'
    deps: [package:macos:pkg:prepare]
    platforms: [darwin]
    cmds:
      - cmd: "mkdir -p {{.MACOS_TARGET_PKG_DIR}}/components"
      - cmd: >-
          pkgbuild
          --root "{{.MACOS_TARGET_PKG_DIR}}/payload"
          --scripts "{{.MACOS_TARGET_PKG_DIR}}/scripts"
          --identifier "org.graylog.collector"
          --version "{{.VERSION}}"
          --install-location "/"
          "{{.MACOS_TARGET_PKG_DIR}}/components/graylog-collector-component.pkg"
      - cmd: >-
          productbuild
          --distribution "{{.ROOT_DIR}}/dist/macos/distribution.xml"
          --package-path "{{.MACOS_TARGET_PKG_DIR}}/components"
          --resources "{{.MACOS_TARGET_PKG_DIR}}/resources"
          "{{.ROOT_DIR}}/target/graylog-collector-{{.VERSION}}-darwin-universal.pkg"
      - cmd: >-
          productsign --sign "{{.PRODUCTSIGN_IDENTITY}}"
          "{{.ROOT_DIR}}/target/graylog-collector-{{.VERSION}}-darwin-universal.pkg"
          "{{.ROOT_DIR}}/target/graylog-collector-{{.VERSION}}-darwin-universal-signed.pkg"
        if: '[ -n "$PRODUCTSIGN_IDENTITY" ]'
      - cmd: >-
          pkgutil --check-signature
          "{{.ROOT_DIR}}/target/graylog-collector-{{.VERSION}}-darwin-universal-signed.pkg"
        if: '[ -n "$PRODUCTSIGN_IDENTITY" ]'
      - cmd: >-
          mv
          "{{.ROOT_DIR}}/target/graylog-collector-{{.VERSION}}-darwin-universal-signed.pkg"
          "{{.ROOT_DIR}}/target/graylog-collector-{{.VERSION}}-darwin-universal.pkg"
        if: '[ -n "$PRODUCTSIGN_IDENTITY" ]'

  package:macos:bin:sign:
    desc: "Sign macOS binaries (macOS only)"
    deps: [builder:build:darwin]
    platforms: [darwin]
    vars:
      BIN_PATH_PREFIX: '{{.ROOT_DIR}}/target/graylog-collector-{{.COLLECTOR_VERSION}}{{.COLLECTOR_VERSION_SUFFIX}}-darwin'
      ARCHS: [amd64, arm64, universal]
    cmds:
      - for:
          var: ARCHS
          as: ARCH
        cmd: >-
          codesign --force --options runtime --timestamp
          --sign "{{.CODESIGN_IDENTITY}}" "{{.BIN_PATH_PREFIX}}-{{.ARCH}}"
        if: '[ -n "$CODESIGN_IDENTITY" ]'
      - for:
          var: ARCHS
          as: ARCH
        cmd: codesign --verify --strict --verbose=2 "{{.BIN_PATH_PREFIX}}-{{.ARCH}}"
        if: '[ -n "$CODESIGN_IDENTITY" ]'
      - for:
          var: ARCHS
          as: ARCH
        cmd: codesign -dvv "{{.BIN_PATH_PREFIX}}-{{.ARCH}}"
        if: '[ -n "$CODESIGN_IDENTITY" ]'

  package:macos:pkg:notarize:
    desc: "Notarize macOS installer (macOS only)"
    deps: [package:macos:pkg]
    platforms: [darwin]
    if: '[ -n "$NOTARYTOOL_PROFILE_NAME" ] && [ -n "$KEYCHAIN_PATH" ]'
    vars:
      PKG_FILE: "{{.ROOT_DIR}}/target/graylog-collector-{{.COLLECTOR_VERSION}}{{.COLLECTOR_VERSION_SUFFIX}}-darwin-universal.pkg"
    cmds:
      # The --wait flag polls until Apple finishes. Typically takes 1-5 minutes.
      # Capture the submission ID so we can pull the failure log if rejected.
      - cmd: >-
          xcrun notarytool submit "{{.PKG_FILE}}"
          --keychain-profile "$NOTARYTOOL_PROFILE_NAME"
          --keychain "$KEYCHAIN_PATH"
          --wait
          --timeout 30m
          --output-format json
          | tee "{{.MACOS_TARGET_PKG_DIR}}/notarytool-submit-output.json"
          | jq -r '.id'
          | tee "{{.MACOS_TARGET_PKG_DIR}}/notarytool-submit-id"

      # Check an capture the submission status.
      - cmd: >-
          xcrun notarytool info "$(< "{{.MACOS_TARGET_PKG_DIR}}/notarytool-submit-id")"
          --keychain-profile "$NOTARYTOOL_PROFILE_NAME"
          --keychain "$KEYCHAIN_PATH"
          --output-format json
          | tee "{{.MACOS_TARGET_PKG_DIR}}/notarytool-info-output.json"
          | jq -r '.status'
          | tee "{{.MACOS_TARGET_PKG_DIR}}/notarytool-info-status"

      # Check the status
      - cmd: |
          SUBMIT_ID="$(< "{{.MACOS_TARGET_PKG_DIR}}/notarytool-submit-id")"
          STATUS="$(< "{{.MACOS_TARGET_PKG_DIR}}/notarytool-info-status")"

          if [ "$STATUS" != "Accepted" ]; then
            echo "Notarization failed with status: $STATUS" >&2
            # The log names the exact file and rule that was rejected
            # (unsigned binary, missing hardened runtime, missing timestamp, ...).
            xcrun notarytool log "$SUBMIT_ID" \
              --keychain-profile "$NOTARYTOOL_PROFILE_NAME" \
              --keychain "$KEYCHAIN_PATH"
            exit 1
          fi

      # Attach the notarization ticket so Gatekeeper accepts the pkg offline.
      - cmd: xcrun stapler staple "{{.PKG_FILE}}"

      # End-to-end Gatekeeper verification of the final artifact.
      - cmd: spctl -a -vv -t install "{{.PKG_FILE}}"
      - cmd: pkgutil --check-signature "{{.PKG_FILE}}"

  package:macos:pkg:prepare:
    desc: "Prepare input directory for pkgbuild"
    deps: [package:macos:bin:sign]
    platforms: [darwin]
    internal: true
    vars:
      MACOS_UNIVERSAL_BINARY_PATH: '{{.ROOT_DIR}}/target/graylog-collector-{{.COLLECTOR_VERSION}}{{.COLLECTOR_VERSION_SUFFIX}}-darwin-universal'
      MACOS_TARGET_APP_DIR: '{{.MACOS_TARGET_PKG_DIR}}/payload/Library/Application Support/Graylog/Graylog Collector.app'
    cmds:
      - cmd: mkdir -p "{{.MACOS_TARGET_PKG_DIR}}/payload"
      - cmd: cp -v -R {{.MACOS_PAYLOAD_PKG_DIR}}/payload/ {{.MACOS_TARGET_PKG_DIR}}/payload
      - cmd: mkdir -p "{{.MACOS_TARGET_PKG_DIR}}/scripts"
      - cmd: cp -v -R {{.MACOS_PAYLOAD_PKG_DIR}}/scripts/ {{.MACOS_TARGET_PKG_DIR}}/scripts
      - cmd: mkdir -p "{{.MACOS_TARGET_PKG_DIR}}/resources"
      - cmd: cp -v "{{.ROOT_DIR}}/LICENSE" "{{.MACOS_TARGET_PKG_DIR}}/resources/LICENSE.txt"
      - cmd: >-
          go run "{{.ROOT_DIR}}/dist/macos/make-background.go"
          "{{.ROOT_DIR}}/dist/graylog.png"
          "{{.MACOS_TARGET_PKG_DIR}}/resources/background.png"
      # Assemble the app bundle. The daemon binary lives inside a bundle so
      # System Settings (Login Items & Extensions) shows the bundle name and
      # icon instead of the code-signing certificate name.
      - cmd: mkdir -p "{{.MACOS_TARGET_APP_DIR}}/Contents/MacOS" "{{.MACOS_TARGET_APP_DIR}}/Contents/Resources"
      - cmd: cp -v {{.MACOS_UNIVERSAL_BINARY_PATH}} "{{.MACOS_TARGET_APP_DIR}}/Contents/MacOS/graylog-collector"
      - cmd: chmod +x "{{.MACOS_TARGET_APP_DIR}}/Contents/MacOS/graylog-collector"
      - cmd: >-
          "{{.ROOT_DIR}}/dist/macos/make-icns.sh"
          "{{.ROOT_DIR}}/dist/graylog.png"
          "{{.MACOS_TARGET_APP_DIR}}/Contents/Resources/AppIcon.icns"
      - cmd: >-
          /usr/libexec/PlistBuddy
          -c "Set :CFBundleShortVersionString {{.COLLECTOR_VERSION}}"
          -c "Set :CFBundleVersion {{.COLLECTOR_VERSION}}"
          "{{.MACOS_TARGET_APP_DIR}}/Contents/Info.plist"
      # ensure the bundled uninstall script is executable on the target;
      # must happen before codesign seals the bundle
      - cmd: chmod +x "{{.MACOS_TARGET_APP_DIR}}/Contents/Resources/uninstall.sh"
      # Sign the whole bundle: this signs the embedded binary and seals
      # Info.plist and Resources (including the icon and uninstall script)
      - cmd: >-
          codesign --force --options runtime --timestamp
          --sign "{{.CODESIGN_IDENTITY}}" "{{.MACOS_TARGET_APP_DIR}}"
        if: '[ -n "$CODESIGN_IDENTITY" ]'
      - cmd: codesign --verify --strict --verbose=2 "{{.MACOS_TARGET_APP_DIR}}"
        if: '[ -n "$CODESIGN_IDENTITY" ]'
      - cmd: codesign -dvv "{{.MACOS_TARGET_APP_DIR}}"
        if: '[ -n "$CODESIGN_IDENTITY" ]'
      # ensure scripts are always executable, the installer would otherwise fail
      - cmd: chmod +x {{.MACOS_TARGET_PKG_DIR}}/scripts/preinstall {{.MACOS_TARGET_PKG_DIR}}/scripts/postinstall
      # ensure the payload PATH wrapper is executable on the target
      - cmd: chmod +x {{.MACOS_TARGET_PKG_DIR}}/payload/usr/local/bin/graylog-collector

  version:set:release:
    desc: 'Set version in version.env'
    requires:
      vars:
        - RELEASE_VERSION
        - RELEASE_REVISION
    cmds:
      - cmd: |
          {{ $v := .RELEASE_VERSION | split "." }}
          {
            echo "COLLECTOR_VERSION_MAJOR={{ $v._0 }}"
            echo "COLLECTOR_VERSION_MINOR={{ $v._1 }}"
            echo "COLLECTOR_VERSION_PATCH={{ $v._2 }}"
            echo "COLLECTOR_VERSION_SUFFIX="
            echo "COLLECTOR_REVISION={{ .RELEASE_REVISION }}"
          } > version.env.new

      - cmd: |
          mv version.env.new version.env

      - task: version:set:builder
        vars:
          VERSION: '{{.RELEASE_VERSION}}'

  version:set:snapshot:
    desc: 'Set SNAPSHOT version in version.env'
    requires:
      vars:
        - SNAPSHOT_VERSION
    cmds:
      - cmd: |
          {{ $v := .SNAPSHOT_VERSION | split "." }}
          {
            echo "COLLECTOR_VERSION_MAJOR={{ $v._0 }}"
            echo "COLLECTOR_VERSION_MINOR={{ $v._1 }}"
            echo "COLLECTOR_VERSION_PATCH={{ $v._2 }}"
            echo "COLLECTOR_VERSION_SUFFIX=-SNAPSHOT"
            echo "COLLECTOR_REVISION=1"
          } > version.env.new

      - cmd: |
          mv version.env.new version.env

      - task: version:set:builder
        vars:
          VERSION: '{{.SNAPSHOT_VERSION}}-SNAPSHOT'

  version:bump:snapshot:patch:
    desc: 'Bump the patch version and set SNAPSHOT suffix in version.env'
    vars:
      PATCH: '{{add (.COLLECTOR_VERSION_PATCH | atoi) 1}}'
    cmds:
      - cmd: |
          {
            echo "COLLECTOR_VERSION_MAJOR={{.COLLECTOR_VERSION_MAJOR}}"
            echo "COLLECTOR_VERSION_MINOR={{.COLLECTOR_VERSION_MINOR}}"
            echo "COLLECTOR_VERSION_PATCH={{.PATCH}}"
            echo "COLLECTOR_VERSION_SUFFIX=-SNAPSHOT"
            echo "COLLECTOR_REVISION=1"
          } > version.env.new

      - cmd: |
          mv version.env.new version.env

      - task: version:set:builder
        vars:
          VERSION: '{{.COLLECTOR_VERSION_MAJOR}}.{{.COLLECTOR_VERSION_MINOR}}.{{.PATCH}}-SNAPSHOT'

  version:set:builder:
    desc: 'Set version in builder config'
    internal: true
    requires:
      vars:
        - VERSION
    cmds:
      - cmd: >
          sed -i -E -e 's,^  version: .+$,  version: {{.VERSION}},g' builder/builder-config.yaml
      - task: builder:generate

  version:get:
    desc: 'Bump the patch version and set SNAPSHOT suffix in version.env'
    silent: true
    cmds:
      - cmd: |
          echo "{{.COLLECTOR_VERSION}}{{.COLLECTOR_VERSION_SUFFIX}}"

  go:mod:tidy:
    desc: 'Run go mod tidy in all modules'

    requires:
      vars: ["GO_MODULES"]

    cmds:
      - for:
          var: GO_MODULES
          as: CURRENT
        cmd: cd {{.CURRENT}} && go mod tidy

  go:fix:
    desc: 'Run go fix in all modules'

    requires:
      vars: ["GO_MODULES"]

    cmds:
      - for:
          var: GO_MODULES
          as: CURRENT
        cmd: cd {{.CURRENT}} && go fix ./... || true

  go:lint:
    desc: 'Run golangci-lint in all modules'

    requires:
      vars: ["GO_MODULES"]

    cmds:
      - for:
          var: GO_MODULES
          as: CURRENT
        cmd: cd {{.CURRENT}} && golangci-lint run -c {{.ROOT_DIR}}/.golangci.yml

  update:dependency:
    desc: 'Update one dependency in all modules'

    requires:
      vars: ["GO_MODULES", "PKG"]

    cmds:
      - for:
          var: GO_MODULES
          as: CURRENT
        cmd: cd {{.CURRENT}} && go get -u {{.PKG}} && go mod tidy

  update:dependencies:
    desc: 'Update dependencies in all modules'

    vars:
      OTEL_BETA_VERSION:
        sh: go list -m go.opentelemetry.io/collector/cmd/builder@latest | awk '{print $2}'
      OTEL_STABLE_VERSION:
        sh: go list -m go.opentelemetry.io/collector/confmap/provider/envprovider@latest | awk '{print $2}'
      OTEL_CONTRIB_VERSION:
        sh: go list -m github.com/open-telemetry/opentelemetry-collector-contrib/receiver/filelogreceiver@latest | awk '{print $2}'

    requires:
      vars: ["GO_MODULES"]

    preconditions:
      - sh: 'test "{{.OTEL_BETA_VERSION}}" = "{{.OTEL_CONTRIB_VERSION}}"'
        msg: 'Latest OTel core and contrib releases are not aligned yet'

    cmds:
      - go get go.opentelemetry.io/collector/cmd/builder@{{.OTEL_BETA_VERSION}}
      - cmd: >-
          sed -i -E
          -e 's#((go\.opentelemetry\.io/collector|github\.com/open-telemetry/opentelemetry-collector-contrib)/[^[:space:]]+)[[:space:]]+v0\.[0-9]+\.[0-9]+#\1 {{.OTEL_BETA_VERSION}}#g'
          -e 's#((go\.opentelemetry\.io/collector|github\.com/open-telemetry/opentelemetry-collector-contrib)/[^[:space:]]+)[[:space:]]+v1\.[0-9]+\.[0-9]+#\1 {{.OTEL_STABLE_VERSION}}#g'
          builder/builder-config.yaml
      - for:
          var: GO_MODULES
          as: CURRENT
        cmd: cd {{.CURRENT}} && go get -u -t ./... && go mod tidy
      - task: builder:generate