Taskfile.yaml

# SPDX-FileCopyrightText: Copyright 2025 Stacklok, Inc.
# SPDX-License-Identifier: Apache-2.0

version: '3'

vars:
  RUNNER_NAME: go-microvm-runner
  VERSION:
    sh: git describe --tags --always --dirty 2>/dev/null || echo "dev"
  COMMIT:
    sh: git rev-parse --short HEAD 2>/dev/null || echo "unknown"
  BUILD_DATE:
    sh: date -u +"%Y-%m-%dT%H:%M:%SZ"
  LDFLAGS: >-
    -X github.com/stacklok/go-microvm/internal/version.Version={{.VERSION}}
    -X github.com/stacklok/go-microvm/internal/version.Commit={{.COMMIT}}
    -X github.com/stacklok/go-microvm/internal/version.BuildDate={{.BUILD_DATE}}
  HOST_ARCH:
    sh: uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/'
  CONTAINER_RUNTIME:
    sh: command -v podman >/dev/null 2>&1 && echo podman || echo docker
  BUILDER_IMAGE: ghcr.io/stacklok/go-microvm-builder
  LIBKRUN_VERSION:
    sh: grep '^LIBKRUN_VERSION=' versions.env | cut -d= -f2
  LIBKRUN_MAJOR:
    sh: grep '^LIBKRUN_VERSION=' versions.env | cut -d= -f2 | sed 's/^v//' | cut -d. -f1
  LIBKRUNFW_VERSION:
    sh: grep '^LIBKRUNFW_VERSION=' versions.env | cut -d= -f2
  LIBKRUNFW_MAJOR:
    sh: grep '^LIBKRUNFW_VERSION=' versions.env | cut -d= -f2 | sed 's/^v//' | cut -d. -f1
  BUILDER_IMAGE_TAG:
    sh: grep '^LIBKRUN_VERSION=' versions.env | cut -d= -f2

env:
  GOTOOLCHAIN: auto

# Quick reference:
#   task build-dev        → Fast dev build (requires system libkrun-devel)
#   task build-runner     → Build runner + libs using builder container
#   task fetch-runtime    → Download pre-built runtime from GitHub Release
#   task fetch-firmware   → Download pre-built firmware from GitHub Release
#   task test             → Run tests with race detector
#   task test-nocgo       → Run tests excluding CGO packages
#   task lint             → Run linter
#   task verify           → fmt + lint + test

tasks:
  default:
    desc: Show available tasks
    cmds:
      - task --list

  # =============================================================================
  # Development Build (requires system libkrun-devel)
  # =============================================================================

  build-dev:
    desc: Build runner for development (requires libkrun-devel on system)
    platforms: [linux]
    env:
      CGO_ENABLED: "1"
    cmds:
      - mkdir -p bin
      - go build -ldflags "{{.LDFLAGS}}" -o bin/{{.RUNNER_NAME}} ./runner/cmd/go-microvm-runner
    sources:
      - ./**/*.go
      - go.mod
      - go.sum
    generates:
      - bin/{{.RUNNER_NAME}}

  build-dev-darwin:
    desc: Build runner for development on macOS (requires Homebrew libkrun)
    platforms: [darwin]
    cmds:
      - mkdir -p bin
      - CGO_ENABLED=1 go build -ldflags "{{.LDFLAGS}}" -o bin/{{.RUNNER_NAME}} ./runner/cmd/go-microvm-runner
      # Hypervisor.framework requires entitlements
      - codesign --entitlements assets/entitlements.plist --force -s - bin/{{.RUNNER_NAME}}

  build-runner-darwin:
    desc: Build runner + copy Homebrew dylibs for macOS packaging
    platforms: [darwin]
    cmds:
      - task: build-dev-darwin
      # Copy all required dylibs from Homebrew
      - cp -f $(brew --prefix libkrun)/lib/libkrun.{{.LIBKRUN_MAJOR}}.dylib bin/
      - cp -f $(brew --prefix libkrunfw)/lib/libkrunfw.{{.LIBKRUNFW_MAJOR}}.dylib bin/
      - cp -f $(brew --prefix libepoxy)/lib/libepoxy.0.dylib bin/
      - cp -f $(brew --prefix virglrenderer)/lib/libvirglrenderer.1.dylib bin/
      - cp -f $(brew --prefix molten-vk)/lib/libMoltenVK.dylib bin/
      # Rewrite LC_ID_DYLIB (each dylib's own identity) for portable bundles
      - install_name_tool -id @loader_path/libkrun.{{.LIBKRUN_MAJOR}}.dylib bin/libkrun.{{.LIBKRUN_MAJOR}}.dylib
      - install_name_tool -id @loader_path/libkrunfw.{{.LIBKRUNFW_MAJOR}}.dylib bin/libkrunfw.{{.LIBKRUNFW_MAJOR}}.dylib
      - install_name_tool -id @loader_path/libepoxy.0.dylib bin/libepoxy.0.dylib
      - install_name_tool -id @loader_path/libvirglrenderer.1.dylib bin/libvirglrenderer.1.dylib
      - install_name_tool -id @loader_path/libMoltenVK.dylib bin/libMoltenVK.dylib
      # Rewrite go-microvm-runner → libkrun reference
      - >-
        install_name_tool -change
        /opt/homebrew/opt/libkrun/lib/libkrun.{{.LIBKRUN_MAJOR}}.dylib
        @loader_path/libkrun.{{.LIBKRUN_MAJOR}}.dylib
        bin/{{.RUNNER_NAME}}
      # Rewrite libkrun → libepoxy, virglrenderer references
      - >-
        install_name_tool -change
        /opt/homebrew/opt/libepoxy/lib/libepoxy.0.dylib
        @loader_path/libepoxy.0.dylib
        bin/libkrun.{{.LIBKRUN_MAJOR}}.dylib
      - >-
        install_name_tool -change
        /opt/homebrew/opt/virglrenderer/lib/libvirglrenderer.1.dylib
        @loader_path/libvirglrenderer.1.dylib
        bin/libkrun.{{.LIBKRUN_MAJOR}}.dylib
      # Rewrite virglrenderer → MoltenVK, libepoxy references
      - >-
        install_name_tool -change
        /opt/homebrew/opt/molten-vk/lib/libMoltenVK.dylib
        @loader_path/libMoltenVK.dylib
        bin/libvirglrenderer.1.dylib
      - >-
        install_name_tool -change
        /opt/homebrew/opt/libepoxy/lib/libepoxy.0.dylib
        @loader_path/libepoxy.0.dylib
        bin/libvirglrenderer.1.dylib
      # Remove stale Homebrew rpaths (ignore errors if none exist)
      - for f in bin/libkrun.{{.LIBKRUN_MAJOR}}.dylib bin/libkrunfw.{{.LIBKRUNFW_MAJOR}}.dylib bin/libepoxy.0.dylib bin/libvirglrenderer.1.dylib bin/libMoltenVK.dylib; do
          for rp in $(otool -l "$f" 2>/dev/null | grep -A2 LC_RPATH | grep 'path /opt/homebrew' | awk '{print $2}'); do
            install_name_tool -delete_rpath "$rp" "$f" 2>/dev/null || true;
          done;
        done
      # Code-sign dylibs ad-hoc (no entitlements), then runner last with entitlements
      - codesign --force -s - bin/libMoltenVK.dylib
      - codesign --force -s - bin/libepoxy.0.dylib
      - codesign --force -s - bin/libvirglrenderer.1.dylib
      - codesign --force -s - bin/libkrunfw.{{.LIBKRUNFW_MAJOR}}.dylib
      - codesign --force -s - bin/libkrun.{{.LIBKRUN_MAJOR}}.dylib
      - codesign --entitlements assets/entitlements.plist --force -s - bin/{{.RUNNER_NAME}}
      # Verify no Homebrew references remain in bundled files
      - |
        for f in bin/{{.RUNNER_NAME}} bin/libkrun.{{.LIBKRUN_MAJOR}}.dylib bin/libkrunfw.{{.LIBKRUNFW_MAJOR}}.dylib bin/libepoxy.0.dylib bin/libvirglrenderer.1.dylib bin/libMoltenVK.dylib; do
          if otool -L "$f" | grep -q /opt/homebrew; then
            echo "FAIL: $f still references /opt/homebrew"
            otool -L "$f" | grep /opt/homebrew
            exit 1
          fi
        done
    generates:
      - bin/{{.RUNNER_NAME}}
      - bin/libkrun.{{.LIBKRUN_MAJOR}}.dylib
      - bin/libkrunfw.{{.LIBKRUNFW_MAJOR}}.dylib
      - bin/libepoxy.0.dylib
      - bin/libvirglrenderer.1.dylib
      - bin/libMoltenVK.dylib

  build-dev-race:
    desc: Build runner with race detector (requires libkrun-devel)
    env:
      CGO_ENABLED: "1"
    cmds:
      - mkdir -p bin
      - go build -race -ldflags "{{.LDFLAGS}}" -o bin/{{.RUNNER_NAME}} ./runner/cmd/go-microvm-runner

  # =============================================================================
  # Standard Tasks
  # =============================================================================

  test:
    desc: Run unit tests
    cmds:
      - go test -v -race ./...

  test-nocgo:
    desc: Run unit tests excluding CGO packages
    cmds:
      - go test -v -race $(go list ./... | grep -v krun | grep -v go-microvm-runner)

  test-coverage:
    desc: Run tests with coverage
    cmds:
      - go test -v -race -coverprofile=coverage.out ./...
      - go tool cover -html=coverage.out -o coverage.html
      - echo "Coverage report generated at coverage.html"

  lint:
    desc: Run linter
    cmds:
      - golangci-lint run --allow-parallel-runners ./...

  lint-fix:
    desc: Run linter and fix issues
    cmds:
      - golangci-lint run --allow-parallel-runners --fix ./...

  fmt:
    desc: Format code
    cmds:
      - go fmt ./...
      - goimports -w .

  tidy:
    desc: Tidy go modules
    cmds:
      - go mod tidy

  build-nocgo:
    desc: Verify compilation of pure Go packages (no CGO)
    env:
      CGO_ENABLED: "0"
    cmds:
      - go build $(go list ./... | grep -v krun | grep -v go-microvm-runner)

  verify:
    desc: Verify code (fmt, lint, test)
    cmds:
      - task: fmt
      - task: lint
      - task: test

  version:
    desc: Print version information
    cmds:
      - 'echo "Version: {{.VERSION}}"'
      - 'echo "Commit: {{.COMMIT}}"'
      - 'echo "Build Date: {{.BUILD_DATE}}"'

  clean:
    desc: Clean build artifacts
    cmds:
      - rm -rf bin/ dist/
      - rm -f coverage.out coverage.html

  # =============================================================================
  # Builder Image
  # =============================================================================

  builder-image-build:
    desc: Build builder image for current platform
    platforms: [linux]
    preconditions:
      - sh: '[ -n "{{.BUILDER_IMAGE_TAG}}" ]'
        msg: "BUILDER_IMAGE_TAG is empty — check that versions.env exists and contains LIBKRUN_VERSION"
    cmds:
      - >-
        {{.CONTAINER_RUNTIME}} build
        --build-arg LIBKRUN_VERSION={{.LIBKRUN_VERSION}}
        --build-arg LIBKRUNFW_VERSION=$(grep '^LIBKRUNFW_VERSION=' versions.env | cut -d= -f2)
        -t {{.BUILDER_IMAGE}}:{{.BUILDER_IMAGE_TAG}}
        -f images/builder/Containerfile
        images/builder

  builder-image-push:
    desc: Push builder image to ghcr.io
    platforms: [linux]
    cmds:
      - '{{.CONTAINER_RUNTIME}} push {{.BUILDER_IMAGE}}:{{.BUILDER_IMAGE_TAG}}'

  # =============================================================================
  # Container-based Build (no system libkrun needed)
  # =============================================================================

  build-runner:
    desc: Build runner + extract libs using builder container
    platforms: [linux]
    preconditions:
      - sh: '[ -n "{{.BUILDER_IMAGE_TAG}}" ]'
        msg: "BUILDER_IMAGE_TAG is empty — check that versions.env exists and contains LIBKRUN_VERSION"
    cmds:
      - mkdir -p bin
      - |
        id=$({{.CONTAINER_RUNTIME}} create {{.BUILDER_IMAGE}}:{{.BUILDER_IMAGE_TAG}})
        {{.CONTAINER_RUNTIME}} cp ${id}:/opt/libkrun-built/libkrun.so.1 bin/
        {{.CONTAINER_RUNTIME}} cp ${id}:/opt/libkrun-built/libkrunfw.so.5 bin/
        {{.CONTAINER_RUNTIME}} rm ${id}
      - >-
        {{.CONTAINER_RUNTIME}} run --rm -v $(pwd):/src:z -w /src
        -e CGO_ENABLED=1
        -e GOTOOLCHAIN=auto
        {{.BUILDER_IMAGE}}:{{.BUILDER_IMAGE_TAG}}
        go build -buildvcs=false -ldflags "{{.LDFLAGS}}" -o bin/{{.RUNNER_NAME}} ./runner/cmd/go-microvm-runner
    generates:
      - bin/{{.RUNNER_NAME}}
      - bin/libkrun.so.1
      - bin/libkrunfw.so.5

  # =============================================================================
  # Release Packaging
  # =============================================================================

  package-runtime:
    desc: Package runtime tarball (runner + libkrun)
    vars:
      TAG: '{{.TAG | default .VERSION}}'
    cmds:
      - mkdir -p dist
      - |
        staging="go-microvm-runtime-linux-{{.HOST_ARCH}}"
        mkdir -p "${staging}"
        cp bin/go-microvm-runner bin/libkrun.so.1 "${staging}/"
        echo "{{.TAG}}" > "${staging}/VERSION"
        tar czf "dist/${staging}.tar.gz" "${staging}"
        rm -rf "${staging}"

  package-firmware:
    desc: Package firmware tarball (libkrunfw, GPL-licensed)
    vars:
      TAG: '{{.TAG | default .VERSION}}'
    cmds:
      - mkdir -p dist
      - |
        staging="go-microvm-firmware-linux-{{.HOST_ARCH}}"
        mkdir -p "${staging}"
        cp bin/libkrunfw.so.5 "${staging}/"
        echo "{{.TAG}}" > "${staging}/VERSION"
        cat > "${staging}/LICENSE-GPL" <<'LICEOF'
        libkrunfw is licensed under the GNU General Public License v2.0 (GPL-2.0).
        See https://github.com/containers/libkrunfw for full license text.
        LICEOF
        tar czf "dist/${staging}.tar.gz" "${staging}"
        rm -rf "${staging}"

  package-runtime-darwin:
    desc: Package macOS runtime tarball (runner + libkrun + GPU dylibs)
    platforms: [darwin]
    vars:
      TAG: '{{.TAG | default .VERSION}}'
    cmds:
      - mkdir -p dist
      - |
        staging="go-microvm-runtime-darwin-{{.HOST_ARCH}}"
        mkdir -p "${staging}"
        cp bin/go-microvm-runner bin/libkrun.{{.LIBKRUN_MAJOR}}.dylib \
           bin/libepoxy.0.dylib bin/libvirglrenderer.1.dylib bin/libMoltenVK.dylib \
           "${staging}/"
        echo "{{.TAG}}" > "${staging}/VERSION"
        tar czf "dist/${staging}.tar.gz" "${staging}"
        rm -rf "${staging}"

  package-firmware-darwin:
    desc: Package macOS firmware tarball (libkrunfw, GPL-licensed)
    platforms: [darwin]
    vars:
      TAG: '{{.TAG | default .VERSION}}'
    cmds:
      - mkdir -p dist
      - |
        staging="go-microvm-firmware-darwin-{{.HOST_ARCH}}"
        mkdir -p "${staging}"
        cp bin/libkrunfw.{{.LIBKRUNFW_MAJOR}}.dylib "${staging}/"
        echo "{{.TAG}}" > "${staging}/VERSION"
        cat > "${staging}/LICENSE-GPL" <<'LICEOF'
        libkrunfw is licensed under the GNU General Public License v2.0 (GPL-2.0).
        See https://github.com/containers/libkrunfw for full license text.
        LICEOF
        tar czf "dist/${staging}.tar.gz" "${staging}"
        rm -rf "${staging}"

  # =============================================================================
  # Fetch Pre-built Artifacts
  # =============================================================================

  fetch-runtime:
    desc: Download pre-built runtime tarball from GitHub Release
    vars:
      RELEASE_TAG: '{{.RELEASE_TAG | default .VERSION}}'
    cmds:
      - mkdir -p bin
      - >-
        gh release download {{.RELEASE_TAG}}
        --repo stacklok/go-microvm
        --pattern "go-microvm-runtime-linux-{{.HOST_ARCH}}.tar.gz"
        --dir bin/ --clobber
      - tar -xzf bin/go-microvm-runtime-linux-{{.HOST_ARCH}}.tar.gz -C bin/ --strip-components=1
      - rm -f bin/go-microvm-runtime-linux-{{.HOST_ARCH}}.tar.gz

  fetch-firmware:
    desc: Download pre-built firmware tarball from GitHub Release
    vars:
      RELEASE_TAG: '{{.RELEASE_TAG | default .VERSION}}'
    cmds:
      - mkdir -p bin
      - >-
        gh release download {{.RELEASE_TAG}}
        --repo stacklok/go-microvm
        --pattern "go-microvm-firmware-linux-{{.HOST_ARCH}}.tar.gz"
        --dir bin/ --clobber
      - tar -xzf bin/go-microvm-firmware-linux-{{.HOST_ARCH}}.tar.gz -C bin/ --strip-components=1
      - rm -f bin/go-microvm-firmware-linux-{{.HOST_ARCH}}.tar.gz

  fetch-runtime-darwin:
    desc: Download pre-built macOS runtime tarball from GitHub Release
    vars:
      RELEASE_TAG: '{{.RELEASE_TAG | default .VERSION}}'
    cmds:
      - mkdir -p bin
      - >-
        gh release download {{.RELEASE_TAG}}
        --repo stacklok/go-microvm
        --pattern "go-microvm-runtime-darwin-{{.HOST_ARCH}}.tar.gz"
        --dir bin/ --clobber
      - tar -xzf bin/go-microvm-runtime-darwin-{{.HOST_ARCH}}.tar.gz -C bin/ --strip-components=1
      - rm -f bin/go-microvm-runtime-darwin-{{.HOST_ARCH}}.tar.gz

  fetch-firmware-darwin:
    desc: Download pre-built macOS firmware tarball from GitHub Release
    vars:
      RELEASE_TAG: '{{.RELEASE_TAG | default .VERSION}}'
    cmds:
      - mkdir -p bin
      - >-
        gh release download {{.RELEASE_TAG}}
        --repo stacklok/go-microvm
        --pattern "go-microvm-firmware-darwin-{{.HOST_ARCH}}.tar.gz"
        --dir bin/ --clobber
      - tar -xzf bin/go-microvm-firmware-darwin-{{.HOST_ARCH}}.tar.gz -C bin/ --strip-components=1
      - rm -f bin/go-microvm-firmware-darwin-{{.HOST_ARCH}}.tar.gz

  fetch-runtime-oci:
    desc: Pull pre-built runtime OCI artifact from ghcr.io
    vars:
      RELEASE_TAG: '{{.RELEASE_TAG | default .VERSION}}'
    cmds:
      - mkdir -p bin
      - >-
        oras pull
        ghcr.io/stacklok/go-microvm/runtime:{{.RELEASE_TAG}}-linux-{{.HOST_ARCH}}
        -o bin/
      - tar -xzf bin/go-microvm-runtime-linux-{{.HOST_ARCH}}.tar.gz -C bin/ --strip-components=1
      - rm -f bin/go-microvm-runtime-linux-{{.HOST_ARCH}}.tar.gz

  fetch-firmware-oci:
    desc: Pull pre-built firmware OCI artifact from ghcr.io
    vars:
      RELEASE_TAG: '{{.RELEASE_TAG | default .VERSION}}'
    cmds:
      - mkdir -p bin
      - >-
        oras pull
        ghcr.io/stacklok/go-microvm/firmware:{{.RELEASE_TAG}}-linux-{{.HOST_ARCH}}
        -o bin/
      - tar -xzf bin/go-microvm-firmware-linux-{{.HOST_ARCH}}.tar.gz -C bin/ --strip-components=1
      - rm -f bin/go-microvm-firmware-linux-{{.HOST_ARCH}}.tar.gz