Taskfile.yml

version: "3"

vars:
  BUILDER_IMAGE: ebpf-builder
  BUILD_DIR: build

  UID: "{{default \"1000\" .UID}}"
  GID: "{{default \"1000\" .GID}}"

tasks:
  setup:
    desc: Build/Rebuild the Docker image for the builder environment
    cmd: docker build --platform linux/amd64 -t {{.BUILDER_IMAGE}} .
    sources: [ Dockerfile ]

  headers:
    desc: Populate .include/ with the libbpf and UAPI kernel headers the BPF
      programs compile against
    deps: [ setup ]
    sources:
      - Dockerfile
    generates:
      - .include/bpf/bpf_helpers.h
      - .include/linux/bpf.h
    # .include is the single normalized include root, which is why the BPF
    # sources carry one -I regardless of environment: Debian keeps asm/ under
    # a multiarch path (/usr/include/x86_64-linux-gnu/asm) while el9 keeps it
    # at /usr/include/asm, and a -target bpf compile resolves neither on its
    # own. Flattening both layouts here keeps the go:generate directives
    # identical in the Docker builder and in an rpmbuild tree.
    #
    # No vmlinux.h: the BPF programs use only UAPI types and take no CO-RE
    # relocation, so nothing here needs BTF — which is what lets this run
    # unprivileged.
    cmds:
      - rm -rf .include/bpf .include/asm .include/asm-generic .include/linux .include/vmlinux.h
      - mkdir -p .include
      - |
        cid=$(docker create --platform linux/amd64 {{.BUILDER_IMAGE}})
        docker cp $cid:/usr/include/bpf .include/bpf
        docker cp $cid:/usr/include/x86_64-linux-gnu/asm .include/asm
        docker cp $cid:/usr/include/asm-generic .include/asm-generic
        docker cp $cid:/usr/include/linux .include/linux
        docker rm $cid

  generate:
    desc: Generate BPF Go bindings only if C code or headers changed
    deps: [ headers ]
    sources:
      - bpf/*.c
      - bpf/test_fixtures/*.c
      - .include/*
    generates:
      - internal/bpf/telemetry_bpfel.go
      - internal/bpf/telemetry_bpfel.o
      - internal/testenv/bpfunit/fixtures/noop_bpfel.go
      - internal/testenv/bpfunit/fixtures/noop_bpfel.o
    cmd: >
      docker run --rm --platform linux/amd64 -v "$(pwd)":/app -u
      {{.UID}}:{{.GID}} {{.BUILDER_IMAGE}} go generate ./...

  binary:
    desc: Build the agent binary into ./build/agent for Linux/amd64
    deps: [ generate ]
    cmds:
      - mkdir -p {{.BUILD_DIR}}
      - >
        docker run --rm --platform linux/amd64 -v "$(pwd)":/app -u
        {{.UID}}:{{.GID}} -e GOOS=linux -e GOARCH=amd64 -e GOWORK=off
        {{.BUILDER_IMAGE}} go build -o {{.BUILD_DIR}}/agent ./cmd/agent

  test:
    desc: Run unit tests on the host (no integration tag; no privileges needed)
    cmd: GOWORK=off go test ./internal/...

  test-integration:
    desc: Run integration tests inside the privileged Docker builder
    deps: [ generate ]
    cmd: >
      docker run --rm --platform linux/amd64 --privileged -u 0
      -v "$(pwd)":/app -w /app -e GOWORK=off {{.BUILDER_IMAGE}}
      sh -c "go test -tags integration -v ./internal/..."

  bench-gate:
    desc: Enforce zero-allocation contract on BenchmarkHotpath_* benchmarks
    cmd: ./scripts/bench-gate.sh

  bench-gate-integration:
    desc: Enforce zero-allocation contract on integration-tagged
      BenchmarkHotpath_* (kernel BPF_PROG_TEST_RUN benches) in privileged Docker
    deps: [ generate ]
    cmd: >
      docker run --rm --platform linux/amd64 --privileged -u 0
      -v "$(pwd)":/app -w /app -e GOWORK=off {{.BUILDER_IMAGE}}
      ./scripts/bench-gate.sh integration

  loadtest:
    desc: Build the agent + loadtest binaries, then exercise the agent under
      sustained traffic and verify resource budgets (RSS, CPU). Extra args
      after -- are forwarded to the loadtest binary.
    deps: [ generate ]
    cmds:
      - mkdir -p {{.BUILD_DIR}}
      - >
        docker run --rm --platform linux/amd64 -v "$(pwd)":/app -u
        {{.UID}}:{{.GID}} -e GOOS=linux -e GOARCH=amd64 -e GOWORK=off
        {{.BUILDER_IMAGE}} go build -buildvcs=false -o {{.BUILD_DIR}}/agent ./cmd/agent
      - >
        docker run --rm --platform linux/amd64 -v "$(pwd)":/app -u
        {{.UID}}:{{.GID}} -e GOOS=linux -e GOARCH=amd64 -e GOWORK=off
        {{.BUILDER_IMAGE}} go build -buildvcs=false -o {{.BUILD_DIR}}/loadtest ./cmd/loadtest
      - >
        docker run --rm --platform linux/amd64 --privileged -u 0
        -v "$(pwd)":/app -w /app {{.BUILDER_IMAGE}}
        ./build/loadtest -agent ./build/agent {{.CLI_ARGS}}

  lint:
    desc: Run golangci-lint inside the builder — the same analysis the CI lint job does
    # In the builder, not on the host, and not cross-compiled. The linters'
    # facts depend on a natively-typechecking tree: from a darwin host,
    # GOOS=linux loses the fact that testing.T.Fatalf never returns and
    # staticcheck then reports SA5011 against correct code, while a plain
    # host run cannot typecheck the linux-only packages at all. Depends on
    # generate for the same reason CI runs it first — without the
    # bpf2go-generated types internal/bpf does not typecheck and every
    # dependent package is analysed with degraded facts.
    deps: [ generate ]
    cmd: >
      docker run --rm --platform linux/amd64 -v "$(pwd)":/app -w /app
      -u {{.UID}}:{{.GID}} -e HOME=/tmp -e GOCACHE=/tmp/gocache -e GOWORK=off
      {{.BUILDER_IMAGE}} golangci-lint run --build-tags=integration

  ci:
    desc: Run the CI checks devs can run locally without Docker (lint + unit + bench-gate)
    cmds:
      - task: lint
      - task: test
      - task: bench-gate

  clean:
    desc: Remove build artifacts
    cmd: rm -rf build/ internal/bpf/*_bpfel.go internal/bpf/*_bpfel.o

  editor-setup:
    desc: Generate .clangd for clangd-based editors. Run after `task headers`.
      The .clangd is machine-local (absolute paths) and gitignored.
    cmds:
      - |
        cat > .clangd <<EOF
        CompileFlags:
          Add:
            - --target=bpf
            - -I$(pwd)/.include
            - -I$(pwd)/.include/bpf
            - -D__TARGET_ARCH_x86
            - -D__BPF_TRACING__
            - -std=gnu17
          Compiler: clang

        Diagnostics:
          Suppress:
            - unused-includes
        EOF
      - echo "Wrote $(pwd)/.clangd — reload your editor to pick it up."