Taskfile.yml

# =============================================================================
# Helios Platform - Root Taskfile
# =============================================================================
# Usage:
#   task check          Verify all prerequisites are installed
#   task setup          Bootstrap the full local environment (cluster + deps)
#   task dev            Run operator + portal concurrently
#   task test           Run all tests
#   task clean          Tear down the k3d cluster
#
# First-time setup:
#   cp .env.example .env   # fill in your credentials
#   task setup             # ~5-10 minutes
#   task dev               # opens operator + portal
#
# Cross-platform:
#   Linux/macOS: works natively
#   Windows:     requires Git Bash or WSL (for bash-based sub-scripts)
# =============================================================================
version: "3"

dotenv: [".env"]

vars:
  CLUSTER_NAME: helios-dev
  ARGOCD_PORT: "8080"
  KUBECTL_PROXY_PORT: "8001"
  GITEA_PORT: "3030"
  GITEA_INTERNAL_HOST: gitea-http.gitea.svc.cluster.local:3000
  GITOPS_SECRET_NAME: helios-gitops-bot
  # Cap Tekton resource usage during local builds/tests to avoid host lockups.
  TEKTON_LIMIT_NAMESPACE: default
  TEKTON_LIMIT_CPU: "2"
  TEKTON_LIMIT_MEMORY: 2Gi
  TEKTON_LIMIT_REQUEST_CPU: "500m"
  TEKTON_LIMIT_REQUEST_MEMORY: 512Mi

set: [errexit, pipefail]

# =============================================================================
# Prerequisite Checking
# =============================================================================
tasks:
  check:
    desc: Verify all development prerequisites are installed
    cmds:
      - cmd: bash scripts/check-prereqs.sh
        platforms: [linux, darwin]
      - cmd: cmd /c scripts\\check-prereqs.bat
        platforms: [windows]

  check:env:
    desc: Verify prerequisites and .env configuration
    cmds:
      - cmd: bash scripts/check-prereqs.sh --env
        platforms: [linux, darwin]
      - cmd: cmd /c scripts\\check-prereqs.bat --env
        platforms: [windows]

  # ===========================================================================
  # Setup Tasks
  # ===========================================================================
  setup:
    desc: Bootstrap the full local development environment
    deps: [check:env]
    cmds:
      - task: setup:cluster
      - task: setup:tekton
      - task: setup:tekton-pruner
      - task: setup:argocd
      - task: setup:gitea
      - task: setup:gitea-token
      - task: setup:gitea-gitops-secret
      - task: setup:argocd-gitea
      - task: setup:crds
      - task: setup:tekton-rbac
      - task: setup:credentials
      - task: setup:portal-deps
      - echo ""
      - echo "============================================="
      - echo "  Helios local environment is ready!"
      - echo "  Gitea is available at http://localhost:{{.GITEA_PORT}}"
      - echo "  Run 'task dev' to start developing."
      - echo "============================================="

  setup:cluster:
    desc: Create a k3d cluster (idempotent)
    status:
      - k3d kubeconfig get {{.CLUSTER_NAME}}
    cmds:
      - echo "Creating k3d cluster '{{.CLUSTER_NAME}}'..."
      - k3d cluster create {{.CLUSTER_NAME}} --agents 1 --wait --api-port 127.0.0.1:6550 --k3s-arg "--disable=traefik@server:0"
      - kubectl config set-cluster k3d-{{.CLUSTER_NAME}} --server=https://localhost:6550
      - kubectl cluster-info

  setup:tekton:
    desc: Install Tekton Pipeline, Triggers, and Interceptors
    status:
      - kubectl get namespace tekton-pipelines
      - kubectl get deployment/tekton-pipelines-controller -n tekton-pipelines
      - kubectl get deployment/tekton-pipelines-webhook -n tekton-pipelines
    cmds:
      - echo "Installing Tekton Pipeline..."
      - kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml --request-timeout=120s
      - echo "Installing Tekton Triggers..."
      - kubectl apply --filename https://storage.googleapis.com/tekton-releases/triggers/latest/release.yaml --request-timeout=120s
      - echo "Installing Tekton Interceptors..."
      - kubectl apply --filename https://storage.googleapis.com/tekton-releases/triggers/latest/interceptors.yaml --request-timeout=120s
      - echo "Waiting for Tekton Pipelines controller..."
      - kubectl rollout status deployment/tekton-pipelines-controller -n tekton-pipelines --timeout=600s
      - echo "Waiting for Tekton Pipelines webhook..."
      - kubectl rollout status deployment/tekton-pipelines-webhook -n tekton-pipelines --timeout=600s
      - echo "Ensuring Tekton webhook deployment is still healthy..."
      - cmd: kubectl rollout status deployment/tekton-pipelines-webhook -n tekton-pipelines --timeout=120s
        platforms: [linux, darwin]
      - cmd: kubectl rollout status deployment/tekton-pipelines-webhook -n tekton-pipelines --timeout=120s
        platforms: [windows]
      - echo "Patching Tekton feature flags..."
      - >-
        kubectl patch configmap feature-flags -n tekton-pipelines
        -p '{"data":{"disable-affinity-assistant":"true","coschedule":"disabled"}}'
      - kubectl rollout restart deployment tekton-pipelines-controller -n tekton-pipelines
      - kubectl rollout status deployment/tekton-pipelines-controller -n tekton-pipelines --timeout=600s
      - echo "Applying LimitRange to cap Tekton build resources..."
      - cmd: |
          kubectl apply -f - <<EOF
          apiVersion: v1
          kind: LimitRange
          metadata:
            name: tekton-resource-limits
            namespace: {{.TEKTON_LIMIT_NAMESPACE}}
          spec:
            limits:
              - type: Container
                default:
                  memory: {{.TEKTON_LIMIT_MEMORY}}
                  cpu: "{{.TEKTON_LIMIT_CPU}}"
                defaultRequest:
                  memory: {{.TEKTON_LIMIT_REQUEST_MEMORY}}
                  cpu: "{{.TEKTON_LIMIT_REQUEST_CPU}}"
          EOF

  setup:tekton-pruner:
    desc: Install Tekton Pruner to clean old PipelineRuns/TaskRuns
    status:
      - kubectl get deployment/tekton-pruner-controller -n tekton-pipelines
      - kubectl get configmap/tekton-pruner-default-spec -n tekton-pipelines
    cmds:
      - echo "Installing Tekton Pruner..."
      - kubectl apply -f "https://infra.tekton.dev/tekton-releases/pruner/previous/v0.3.3/release.yaml"
      - echo "Waiting for Tekton Pruner deployments..."
      - kubectl rollout status deployment/tekton-pruner-controller -n tekton-pipelines --timeout=300s
      - kubectl rollout status deployment/tekton-pruner-webhook -n tekton-pipelines --timeout=300s
      - echo "Ensuring Tekton pruner webhook deployment is still healthy..."
      - cmd: kubectl rollout status deployment/tekton-pruner-webhook -n tekton-pipelines --timeout=120s
        platforms: [linux, darwin]
      - cmd: kubectl rollout status deployment/tekton-pruner-webhook -n tekton-pipelines --timeout=120s
        platforms: [windows]
      - echo "Configuring Tekton Pruner (global TTL)..."
      - cmd: |
          kubectl apply -f - <<'EOF'
          apiVersion: v1
          kind: ConfigMap
          metadata:
            name: tekton-pruner-default-spec
            namespace: tekton-pipelines
            labels:
              app.kubernetes.io/part-of: tekton-pruner
              pruner.tekton.dev/config-type: global
          data:
            global-config: |
              enforcedConfigLevel: global
              ttlSecondsAfterFinished: 7200
              successfulHistoryLimit: 3
              failedHistoryLimit: 3
          EOF
      - echo "Waiting for Tekton Pruner controller..."
      - kubectl wait --for=condition=Ready pod -l app=tekton-pruner-controller -n tekton-pipelines --timeout=180s

  setup:argocd:
    desc: Install ArgoCD
    status:
      - kubectl get namespace argocd
      - kubectl get deployment/argocd-server -n argocd
      - kubectl get deployment/argocd-repo-server -n argocd
    cmds:
      - kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
      - echo "Installing ArgoCD..."
      - kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
      # Repo-server often needs several minutes on first install (image pull + scheduling).
      # Use the same budget as rollout status below; 180s is too easy to hit on k3d/minikube.
      - echo "Waiting for ArgoCD components to be created..."
      - cmd: kubectl wait --for=condition=Available deployment/argocd-repo-server -n argocd --timeout=600s
        platforms: [linux, darwin]
      - cmd: kubectl wait --for=condition=Available deployment/argocd-repo-server -n argocd --timeout=600s
        platforms: [windows]
      - echo "Waiting for ArgoCD API server..."
      - kubectl rollout status deployment/argocd-server -n argocd --timeout=600s
      - echo "Waiting for ArgoCD repo server..."
      - kubectl rollout status deployment/argocd-repo-server -n argocd --timeout=600s
      - echo "Waiting for ArgoCD application controller..."
      - kubectl rollout status statefulset/argocd-application-controller -n argocd --timeout=600s

  setup:gitea:
    desc: Install Gitea (lightweight Git server) with SQLite
    status:
      - kubectl get namespace gitea
      - kubectl get deployment/gitea -n gitea
    cmds:
      - echo "Installing Gitea via Helm (SQLite, minimal resources)..."
      - cmd: >-
          helm install gitea oci://registry-1.docker.io/giteacharts/gitea
          --namespace gitea --create-namespace
          --set gitea.admin.username=${GITEA_ADMIN_USER:-helios}
          --set gitea.admin.password=${GITEA_ADMIN_PASS:-helios123}
          --set postgresql.enabled=false
          --set postgresql-ha.enabled=false
          --set redis-cluster.enabled=false
          --set redis.enabled=false
          --set gitea.config.database.DB_TYPE=sqlite3
          --set gitea.config.session.PROVIDER=memory
          --set gitea.config.cache.ADAPTER=memory
          --set gitea.config.queue.TYPE=level
          --set gitea.config.server.ROOT_URL=http://localhost:{{.GITEA_PORT}}
          --set gitea.config.server.HTTP_PORT=3000
          --set gitea.config.webhook.ALLOWED_HOST_LIST=*
          --set persistence.size=1Gi
          --set resources.requests.memory=128Mi
          --set resources.limits.memory=256Mi
        platforms: [linux, darwin]
      - echo "Waiting for Gitea deployment..."
      - kubectl rollout status deployment/gitea -n gitea --timeout=300s

  setup:gitea-token:
    desc: Create Gitea API token, default org, and write to .env
    cmds:
      - echo "Port-forwarding Gitea for setup..."
      - cmd: |
          kubectl port-forward -n gitea svc/gitea-http {{.GITEA_PORT}}:3000 &
          PF_PID=$!
          sleep 3

          GITEA_ADMIN_USER="${GITEA_ADMIN_USER:-helios}"
          GITEA_ADMIN_PASS="${GITEA_ADMIN_PASS:-helios123}"
          GITEA_BASE="http://localhost:{{.GITEA_PORT}}"

          echo "Creating Gitea organization 'helios'..."
          curl -s -X POST "$GITEA_BASE/api/v1/orgs" \
            -u "$GITEA_ADMIN_USER:$GITEA_ADMIN_PASS" \
            -H "Content-Type: application/json" \
            -d '{"username":"helios-platform", "full_name":"Helios Platform", "visibility":"public"}' || true

          echo "Creating Gitea API token..."
          TOKEN_RESP=$(curl -s -X POST "$GITEA_BASE/api/v1/users/$GITEA_ADMIN_USER/tokens" \
            -u "$GITEA_ADMIN_USER:$GITEA_ADMIN_PASS" \
            -H "Content-Type: application/json" \
            -d '{"name":"helios-platform-'"$(date +%s)"'","scopes":["all"]}')

          TOKEN=$(echo "$TOKEN_RESP" | jq -r '.sha1 // .token // empty')

          if [ -z "$TOKEN" ]; then
            echo "Warning: Could not extract token. You may need to create one manually."
            echo "Response was: $TOKEN_RESP"
          else
            ENV_FILE=".env"
            PORTAL_ENV="apps/portal/.env"
            GITEA_URL="http://localhost:{{.GITEA_PORT}}"
            GITEA_INTERNAL_URL="http://gitea-http.gitea.svc.cluster.local:3000"

            update_env_var() {
              local file="$1" key="$2" val="$3"
              if [ ! -f "$file" ]; then touch "$file"; fi
              if grep -q "^${key}=" "$file" 2>/dev/null; then
                sed -i "s|^${key}=.*|${key}=${val}|" "$file"
              else
                echo "${key}=${val}" >> "$file"
              fi
            }

            for f in "$ENV_FILE" "$PORTAL_ENV"; do
              update_env_var "$f" "GITEA_TOKEN"        "$TOKEN"
              update_env_var "$f" "GITEA_USER"         "$GITEA_ADMIN_USER"
              update_env_var "$f" "GITEA_URL"          "$GITEA_URL"
              update_env_var "$f" "GITEA_INTERNAL_URL" "$GITEA_INTERNAL_URL"
            done

            echo ""
            echo "============================================="
            echo "  Gitea API token created and saved!"
            echo "  Updated: $ENV_FILE, $PORTAL_ENV"
            echo "  GITEA_TOKEN=$TOKEN"
            echo "============================================="
          fi

          kill $PF_PID 2>/dev/null || true
        platforms: [linux, darwin]

  setup:argocd-gitea:
    desc: Register Gitea repository credentials with ArgoCD
    cmds:
      - echo "Configuring ArgoCD to access Gitea repos..."
      - cmd: |
          GITEA_ADMIN_USER="${GITEA_ADMIN_USER:-helios}"
          GITEA_ADMIN_PASS="${GITEA_ADMIN_PASS:-helios123}"

          kubectl apply -f - <<EOF
          apiVersion: v1
          kind: Secret
          metadata:
            name: gitea-repo-creds
            namespace: argocd
            labels:
              argocd.argoproj.io/secret-type: repo-creds
          stringData:
            type: git
            url: http://{{.GITEA_INTERNAL_HOST}}
            username: "$GITEA_ADMIN_USER"
            password: "$GITEA_ADMIN_PASS"
          EOF
        platforms: [linux, darwin]
      - echo "ArgoCD can now access Gitea repositories."

  setup:gitea-gitops-secret:
    desc: Create/refresh Tekton GitOps credentials secret (dedicated bot preferred)
    cmds:
      - echo "Creating Tekton GitOps credentials secret '{{.GITOPS_SECRET_NAME}}' in namespace default..."
      - cmd: |
          GITOPS_GIT_USER="${GITOPS_GIT_USER:-${GITEA_BOT_USER:-${GITEA_ADMIN_USER:-helios}}}"
          GITOPS_GIT_PASSWORD="${GITOPS_GIT_PASSWORD:-${GITEA_BOT_PASSWORD:-${GITEA_ADMIN_PASS:-helios123}}}"
          GITOPS_SECRET_NAME="{{.GITOPS_SECRET_NAME}}"

          kubectl create secret generic "$GITOPS_SECRET_NAME" \
            --type=kubernetes.io/basic-auth \
            --from-literal=username="$GITOPS_GIT_USER" \
            --from-literal=password="$GITOPS_GIT_PASSWORD" \
            --dry-run=client -o yaml | kubectl apply -f -

          kubectl annotate secret "$GITOPS_SECRET_NAME" \
            tekton.dev/git-0=http://{{.GITEA_INTERNAL_HOST}} \
            --overwrite

          ENV_FILE=".env"
          PORTAL_ENV="apps/portal/.env"
          update_env_var() {
            local file="$1" key="$2" val="$3"
            if [ ! -f "$file" ]; then touch "$file"; fi
            if grep -q "^${key}=" "$file" 2>/dev/null; then
              sed -i "s|^${key}=.*|${key}=${val}|" "$file"
            else
              echo "${key}=${val}" >> "$file"
            fi
          }
          for f in "$ENV_FILE" "$PORTAL_ENV"; do
            update_env_var "$f" "GITOPS_SECRET_REF" "$GITOPS_SECRET_NAME"
          done

          echo "Created secret '$GITOPS_SECRET_NAME' and wrote GITOPS_SECRET_REF to .env files."
        platforms: [linux, darwin]

  setup:crds:
    desc: Install Helios CRDs into the cluster
    dir: apps/operator
    status:
      - kubectl get crd heliosapps.app.helios.io
    cmds:
      - cmd: make install
        platforms: [linux, darwin]
      - cmd: kubectl kustomize config/crd | kubectl apply -f -
        platforms: [windows]

  setup:tekton-rbac:
    desc: Grant Tekton Triggers SA the permissions to create PipelineRuns
    status:
      - kubectl get role tekton-triggers-pipelinerun-runner --namespace default
      - kubectl get rolebinding tekton-triggers-pipelinerun-runner --namespace default
    cmds:
      - >-
        kubectl create role tekton-triggers-pipelinerun-runner
        --namespace default
        --verb=get,list,watch,create,update,patch
        --resource=pipelineruns.tekton.dev,taskruns.tekton.dev
        --dry-run=client -o yaml | kubectl apply -f -
      - >-
        kubectl create rolebinding tekton-triggers-pipelinerun-runner
        --namespace default
        --role=tekton-triggers-pipelinerun-runner
        --serviceaccount=default:tekton-triggers-sa
        --dry-run=client -o yaml | kubectl apply -f -

  setup:credentials:
    desc: Create Docker registry secret and link to pipeline SA
    cmds:
      - cmd: |
          if [ -z "$DOCKER_USERNAME" ] || [ -z "$DOCKER_PASSWORD" ]; then
            echo "DOCKER_USERNAME and DOCKER_PASSWORD must be set in .env" >&2
            exit 1
          fi
        platforms: [linux, darwin]
      - cmd: |
          powershell -Command "if ([string]::IsNullOrEmpty($env:DOCKER_USERNAME) -or [string]::IsNullOrEmpty($env:DOCKER_PASSWORD)) { Write-Error 'DOCKER_USERNAME and DOCKER_PASSWORD must be set in .env'; exit 1 }"
        platforms: [windows]
      - cmd: |
          kubectl create secret docker-registry docker-credentials \
            --docker-server=${DOCKER_SERVER:-https://index.docker.io/v1/} \
            --docker-username=$DOCKER_USERNAME \
            --docker-password=$DOCKER_PASSWORD \
            --docker-email=${DOCKER_EMAIL:-dev@helios.io} \
            --dry-run=client -o yaml | kubectl apply -f -
        platforms: [linux, darwin]
      - cmd: |
          powershell -Command "$server = if ([string]::IsNullOrEmpty($env:DOCKER_SERVER)) { 'https://index.docker.io/v1/' } else { $env:DOCKER_SERVER }; $email = if ([string]::IsNullOrEmpty($env:DOCKER_EMAIL)) { 'dev@helios.io' } else { $env:DOCKER_EMAIL }; kubectl create secret docker-registry docker-credentials --docker-server=$server --docker-username=$env:DOCKER_USERNAME --docker-password=$env:DOCKER_PASSWORD --docker-email=$email --dry-run=client -o yaml | kubectl apply -f -"
        platforms: [windows]
      - cmd: |
          if kubectl get sa pipeline >/dev/null 2>&1; then
            kubectl patch sa pipeline -p '{"secrets": [{"name": "docker-credentials"}]}'
          else
            echo "pipeline ServiceAccount not found yet; skipping patch (will be created by Tekton)"
          fi
        platforms: [linux, darwin]
      - cmd: |
          powershell -Command "kubectl get sa pipeline *> $null; if ($LASTEXITCODE -eq 0) { kubectl patch sa pipeline -p '{\"secrets\": [{\"name\": \"docker-credentials\"}]}' } else { Write-Host 'pipeline ServiceAccount not found yet; skipping patch (will be created by Tekton)' }"
        platforms: [windows]

  setup:portal-deps:
    desc: Install Backstage portal dependencies
    dir: apps/portal
    cmds:
      - yarn install

  # ===========================================================================
  # Development Tasks
  # ===========================================================================
  dev:
    desc: Run operator and portal concurrently
    deps: [dev:operator, dev:portal]

  operator:
    desc: Alias for running the Helios operator
    cmds:
      - task: dev:operator

  dev:operator:
    desc: Run the Helios operator locally
    dir: apps/operator
    env:
      HELIOS_CUE_PATH: "{{.ROOT_DIR}}/cue"
    cmds:
      - cmd: make run
        platforms: [linux, darwin]
      - cmd: go run ./cmd/main.go
        platforms: [windows]

  portal:
    desc: Alias for running the Backstage portal
    cmds:
      - task: dev:portal

  dev:portal:
    desc: Run the Backstage portal with ArgoCD + kubectl proxy
    cmds:
      - cmd: cd apps/portal && ./start-dev.sh
        platforms: [linux, darwin]
      - cmd: powershell -ExecutionPolicy Bypass -File ../../scripts/start-portal.ps1 -ArgocdPort {{.ARGOCD_PORT}}
        platforms: [windows]

  # ===========================================================================
  # Testing Tasks
  # ===========================================================================
  test:
    desc: Run all tests
    cmds:
      - task: test:operator
      - task: test:portal

  test:operator:
    desc: Run operator unit tests
    dir: apps/operator
    cmds:
      - make test

  test:portal:
    desc: Run portal tests
    dir: apps/portal
    cmds:
      - yarn test

  # ===========================================================================
  # Teardown Tasks
  # ===========================================================================
  clean:
    desc: Delete the k3d cluster and clean up
    cmds:
      - task: clean:cluster

  clean:cluster:
    desc: Delete the k3d cluster
    cmds:
      - k3d cluster delete {{.CLUSTER_NAME}}
      - echo "Cluster '{{.CLUSTER_NAME}}' deleted."