Taskfile.yaml

version: "3"

vars:
  ENVIRONMENT: '{{.ENVIRONMENT | default "development"}}'

tasks:
  default:
    desc: Show available tasks
    cmds:
      - task --list

  help:
    desc: Show usage
    cmds:
      - |
        echo ""
        echo "Usage:"
        echo "  task <target> [ENVIRONMENT=development|staging|production|hub]"
        echo ""
        task --list

  # === Validation ===

  lint:yaml:
    desc: Run yamllint on all YAML files
    cmds:
      - yamllint -c .yamllint.yaml .

  kustomize:build:
    desc: Build all Kustomize overlays (all environments) + env-agnostic roots
    cmds:
      - |
        echo "Building all Kustomize overlays..."
        find . -path '*/overlays/*/kustomization.yaml' -exec dirname {} \; | while read dir; do
          echo "Building $dir ..."
          kustomize build --enable-helm "$dir" > /dev/null || exit 1
        done
        # Env-agnostic kustomize roots — identical on every cluster (their
        # per-environment values resolve through External Secrets and the
        # cluster generator), so they carry no per-env overlays.
        for dir in dashboards/base addons/bootstrap/secret-stores; do
          echo "Building $dir ..."
          kustomize build --enable-helm "$dir" > /dev/null || exit 1
        done
        echo "All manifests built successfully."

  kustomize:build:env:
    desc: "Build overlays for ENVIRONMENT (default: development)"
    cmds:
      - |
        echo "Building {{.ENVIRONMENT}} overlays..."
        find . -path "*/overlays/{{.ENVIRONMENT}}/kustomization.yaml" -exec dirname {} \; | while read dir; do
          echo "Building $dir ..."
          kustomize build --enable-helm "$dir" > /dev/null || exit 1
        done
        echo "All {{.ENVIRONMENT}} overlays built successfully."

  validate:dashboards:
    desc: "Dashboard gate — grafana.com ids must exist and be AMG-saveable"
    cmds:
      - ./scripts/validate-dashboards.py

  validate:fork-safety:
    desc: "Fork-safety gate — no hardcoded catalog repoURL in applied ApplicationSets (local report-only; CI runs it --blocking)"
    cmds:
      - ./scripts/check-hardcoded-org.py

  validate:helm-render:
    desc: "Helm-render gate — template every addon against its appset-pinned chart + per-env values"
    cmds:
      - ./scripts/render-addons.py

  validate:appset-schema:
    desc: "ApplicationSet schema gate — kubeconform over applicationsets/"
    cmds:
      - KUBECONFORM_SKIP="" ./scripts/kubeconform-scan.sh applicationsets/

  validate:sync-waves:
    desc: "Sync-wave gate — documented category ordering holds across the appsets"
    cmds:
      - ./scripts/check-sync-waves.py

  validate:label-values:
    desc: "Label-value gate — every k8s label value satisfies the API server's grammar"
    cmds:
      - ./scripts/check-label-values.py

  validate:appset-render:
    desc: "Appset render gate — render the Karpenter EC2NodeClass patch template against fixture cluster Secrets"
    dir: applicationsets/rendertest
    cmds:
      - go test ./...

  validate:policy-admission:
    desc: "Policy-admission gate — render the fleet and prove no addon is denied by the Enforce-tier Kyverno policies (+ exclusion-list parity)"
    cmds:
      - ./scripts/check-policy-admission.py

  validate:externalsecret-keys:
    desc: "ExternalSecret key gate — each names its remote secret once, and the delivering appset patches it"
    cmds:
      - ./scripts/check-externalsecret-keys.py

  validate:athena-panel-columns:
    desc: "Athena panel gate — every column a CUR panel names is one the export delivers"
    cmds:
      - ./scripts/check-athena-panel-columns.py

  validate:
    desc: Run all validations (lint, build, helm-render, appset schema, sync waves, label values, appset render, policy admission, externalsecret keys, athena panel columns, dashboard/fork-safety)
    deps:
      - lint:yaml
      - kustomize:build
      - validate:helm-render
      - validate:appset-schema
      - validate:sync-waves
      - validate:label-values
      - validate:appset-render
      - validate:policy-admission
      - validate:externalsecret-keys
      - validate:athena-panel-columns
      - validate:dashboards
      - validate:fork-safety
    cmds:
      - echo "All validations passed."

  scan:
    desc: "Schema + misconfiguration gates on rendered/ (run task render first)"
    cmds:
      # Shared kubeconform invocation — same skip list as CI (scripts/kubeconform-scan.sh).
      - ./scripts/kubeconform-scan.sh rendered
      - |
        trivy config --exit-code 1 \
          --severity MEDIUM,HIGH,CRITICAL \
          --ignorefile .trivyignore.yaml \
          rendered

  # === Rendering ===

  render:
    desc: "Render overlays to rendered/ directory for ENVIRONMENT (default: development)"
    cmds:
      - |
        mkdir -p rendered
        echo "Rendering {{.ENVIRONMENT}} overlays..."
        find . -path "*/overlays/{{.ENVIRONMENT}}/kustomization.yaml" -exec dirname {} \; | while read dir; do
          name=$(echo "$dir" | sed 's|^\./||' | tr '/' '-')
          echo "Rendering $dir ..."
          kustomize build --enable-helm "$dir" > "rendered/${name}.yaml" || exit 1
        done
        # Druid catalog chart with synthetic tenant values — same render CI
        # gates (see .github/workflows/ci.yml).
        echo "Rendering catalog/druid/chart ..."
        helm template ci catalog/druid/chart -n druid-ci \
          -f catalog/druid/values.yaml \
          --set hostedId=ci \
          --set environment={{.ENVIRONMENT}} \
          --set secrets.metadata=ci/druid/metadata \
          --set secrets.admin=ci/druid/admin \
          --set secrets.system=ci/druid/system \
          --set secrets.keystore=ci/druid/keystore \
          --set s3.indexLogsBucket=ci-druid-indexlogs \
          --set s3.deepStorageBucket=ci-druid-deepstorage \
          --set s3.msqBucket=ci-druid-msq \
          > rendered/catalog-druid-chart.yaml
        echo "All {{.ENVIRONMENT}} overlays rendered to rendered/"

  clean:
    desc: Remove rendered output
    cmds:
      - rm -rf rendered/