Taskfile.yml

version: "3"

vars:
  NAME:
    sh: grep 'name =' Cargo.toml | head -n 1 | cut -d'"' -f2
  VERSION:
    sh: grep '^version =' Cargo.toml | head -n 1 | cut -d'"' -f2
  HOST_OS:
    sh: uname
  HOST_ARCH:
    sh: uname -m
  # Without the fallback, every task on a machine whose Rust lives in a Nix
  # shell resolves this to nothing and builds paths with a hole in them.
  TARGET_ARCH:
    sh: >-
      rustc -vV 2>/dev/null | sed -n 's/host: //p' | grep .
      || echo "$(uname -m)-unknown-linux-gnu"
  ARCH:
    sh: echo "{{.TARGET_ARCH}}" | cut -d'-' -f1
  IMAGE_NAME: "{{.NAME}}-builder"
  IMAGE_TAG:
    sh: sha256sum Dockerfile | cut -d' ' -f1

tasks:
  default:
    aliases:
      - help
    cmds:
      - go-task --list

  build:debug:
    desc: Build debug build
    cmds:
      - cargo build {{.ARG | default ""}} --target {{.TARGET_ARCH}}

  build:release:
    desc: Build release build
    aliases:
      - build
    cmds:
      - cargo build --release --target {{.TARGET_ARCH}}

  build:all:
    desc: Build release and debug builds
    deps:
      - build:debug
      - build:release

  install:
    desc:
      Build (debug) and install the daemon + polkit rule into /usr without an
      RPM, then restart it via cosmic-session. Fast local-iteration alternative to
      dist:rpm. On a bootc system run `sudo bootc usr-overlay` first if /usr is
      read-only (the overlay is transient and reverts on reboot).
    deps:
      - build:debug
    cmds:
      - sudo install -Dm0755 ./target/{{.TARGET_ARCH}}/debug/{{.NAME}} /usr/bin/{{.NAME}}
      - sudo install -Dm0644 ./data/polkit-1/rules.d/{{.NAME}}.rules
        /usr/share/polkit-1/rules.d/{{.NAME}}.rules
      - sudo install -Dm0644 ./data/system_actions.ron
        /usr/share/cosmic/com.system76.CosmicSettings.Shortcuts/v1/system_actions
      # Relabel so SELinux enforcing mode doesn't refuse to exec a binary that
      # inherited this checkout's user_home_t context.
      - sudo restorecon -R /usr/bin/{{.NAME}} /usr/share/polkit-1 2>/dev/null || true
      # cosmic-session respawns the daemon once the old instance exits. The
      # anchored pattern matches only the daemon, not this task's own shell.
      - pkill -f '^/usr/bin/{{.NAME}}' || true
      - echo "Installed {{.NAME}}; cosmic-session will restart it"

  run:
    desc: Run the daemon from the debug build (conflicts with a running instance)
    deps:
      - build:debug
    requires:
      vars:
        - name: LOG_LEVEL
          enum: [trace, debug, info]
    vars:
      LOG_LEVEL: '{{.LOG_LEVEL | default "info"}}'
    env:
      RUST_LOG: |-
        {{- if eq .LOG_LEVEL "trace" }}
        error,cosmic_settings_daemon=trace
        {{- else if eq .LOG_LEVEL "debug" }}
        error,cosmic_settings_daemon=debug
        {{- else }}
        error,cosmic_settings_daemon=info
        {{- end }}
    cmds:
      - ./target/{{.TARGET_ARCH}}/debug/{{.NAME}} {{.CLI_ARGS}}

  dist:prepare:
    desc: Prepare the project for packaging
    deps:
      - build:release
    sources:
      - target/{{.TARGET_ARCH}}/release/{{.NAME}}
    generates:
      - .cache/{{.NAME}}/usr/bin/{{.NAME}}
    cmds:
      - rm -rf .cache/{{.NAME}}
      - mkdir -p .cache/{{.NAME}}/usr/bin
      - install -Dm0755 "target/{{.TARGET_ARCH}}/release/{{.NAME}}" ".cache/{{.NAME}}/usr/bin/{{.NAME}}"
      - install -Dm0644 "data/system_actions.ron" ".cache/{{.NAME}}/usr/share/cosmic/com.system76.CosmicSettings.Shortcuts/v1/system_actions"
      - install -Dm0644 "data/polkit-1/rules.d/cosmic-settings-daemon.rules" ".cache/{{.NAME}}/usr/share/polkit-1/rules.d/cosmic-settings-daemon.rules"
      - install -Dm0644 "LICENSE" ".cache/{{.NAME}}/usr/share/licenses/{{.NAME}}/LICENSE"
      - mkdir -p dist

  dist:archive:
    desc: Build a tar archive of the project
    deps:
      - dist:prepare
    sources:
      - .cache/{{.NAME}}/**/*
    generates:
      - dist/{{.NAME}}-{{.ARCH}}.tar.gz
    cmds:
      - tar cvfz dist/{{.NAME}}-{{.ARCH}}.tar.gz -C .cache {{.NAME}}

  dist:rpm:
    desc: Build an RPM package
    aliases:
      - rpm
    deps:
      - dist:archive
    sources:
      - dist/{{.NAME}}-{{.ARCH}}.tar.gz
      - pkg/rpm/{{.NAME}}.spec
    generates:
      - dist/{{.NAME}}-{{.VERSION}}-*.{{.ARCH}}.rpm
    preconditions:
      - sh: which rpmbuild
        msg: "Prerequisite utility 'rpmbuild' is not installed"
    cmds:
      - mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
      - cp ./pkg/rpm/{{.NAME}}.spec ~/rpmbuild/SPECS
      - cp dist/{{.NAME}}-{{.ARCH}}.tar.gz ~/rpmbuild/SOURCES/{{.NAME}}.tar.gz
        # A nix-provided rpm has no platform macros: %_arch is unset and %_prefix
        # is its own store path, which silently misplaces every %_bindir file.
      - rpmbuild -bb --target {{.ARCH}} --define "_arch {{.ARCH}}"
        --define '_prefix /usr' ~/rpmbuild/SPECS/{{.NAME}}.spec
      - cp ~/rpmbuild/RPMS/{{.ARCH}}/{{.NAME}}-{{.VERSION}}-*.{{.ARCH}}.rpm dist

  dist:all:
    desc: Build all supported distributable packages
    aliases:
      - dist
    cmds:
      - task: dist:archive
      - task: dist:rpm

  release:
    desc: Publish a new release
    preconditions:
      - sh: which npx
        msg: "Prerequisite utility 'npx' is not installed"
    cmds:
      # The .releaserc.yaml config contains the build commands and publish config
      - npx semantic-release

  repo:update:
    desc: "Upload the release to the package repository"
    vars:
      BUCKET: playtron-dev2-global-os-public
      BUCKET_PATH: repos/playtron-app/{{.ARCH}}
      FILE: "dist/{{.NAME}}-{{.VERSION}}-1.{{.ARCH}}.rpm"
      REPO_NAME: playtron
    preconditions:
      - sh: ls {{.FILE}}
        msg: "File to upload does not exist: {{.FILE}}"
      - sh: env | grep -q '^PACKAGES_UPLOAD_TOKEN='
        msg: "PACKAGES_UPLOAD_TOKEN environment variable is not set"
    cmds:
      # TODO: Remove S3 uploads after repository switch
      - echo "Uploading {{.FILE}} to s3://{{.BUCKET}}/{{.BUCKET_PATH}}/$(basename {{.FILE}})"
      - aws s3 cp {{.FILE}} s3://{{.BUCKET}}/{{.BUCKET_PATH}}/$(basename "{{.FILE}}")
      - echo "Publishing {{.FILE}} to 'https://packages.playtron.one/rpm/{{.REPO_NAME}}/packages/{{.NAME}}-{{.VERSION}}-1.{{.ARCH}}.rpm'"
      - "curl -H 'Authorization: Bearer {{.PACKAGES_UPLOAD_TOKEN}}' -T {{.FILE}} 'https://packages.playtron.one/rpm/{{.REPO_NAME}}/packages/{{.NAME}}-{{.VERSION}}-1.{{.ARCH}}.rpm'"

  test:all:
    desc: Run all tests
    aliases:
      - test
    cmds:
      - cargo test -- --show-output

  test:one:
    desc: Run a single test - E.g. go-task test:one TEST=<test>
    requires:
      vars:
        - TEST
    cmds:
      - RUST_BACKTRACE=1 cargo test {{.TEST}} -- --exact --show-output --include-ignored

  clean:
    desc: Remove build artifacts
    cmds:
      - rm -rf target .cache dist builder

  deploy:nix:
    desc: >-
      Deploy to a NixOS (Kora) host - build this checkout's RPM, then install it
      into the device's user profile.
      E.g. go-task deploy:nix HOST=ericky@192.168.1.220
    aliases:
      - deploy:nixos
    requires:
      vars:
        - name: HOST
    vars:
      # The checkout /etc/nixos's `kora` flake input points at on the device.
      KORA_DIR: '{{.KORA_DIR | default "~/dev/kora-nix-poc"}}'
      # device builds on {{.HOST}} itself, so it links against the glibc it will
      # run on. nix, container and host build here and are checked against it.
      BUILDER: '{{.BUILDER | default "device"}}'
      REMOTE_DIR: /tmp/{{.NAME}}-nix
      STAGE: .cache/nix
      # Started once at login and not respawned, so a kill ends it for good.
      RESTART: '{{.RESTART | default "false"}}'
    preconditions:
      - sh: which rsync
        msg: "Prerequisite utility 'rsync' is not installed"
      - sh: ssh -o BatchMode=yes -o ConnectTimeout=10 {{.HOST}} true
        msg: "Cannot reach {{.HOST}} over SSH without a password. Set up key auth first."
      - sh: ssh {{.HOST}} 'test -e /run/current-system'
        msg: "{{.HOST}} is not a NixOS host."
      - sh: ssh {{.HOST}} 'test -d {{.KORA_DIR}}'
        msg: >-
          No kora checkout at {{.KORA_DIR}} on {{.HOST}}. Point KORA_DIR at the one
          /etc/nixos's `kora` flake input uses.
      # Every builder packages in the dev shell this repo's flake describes.
      - sh: test -f flake.nix
        msg: "No flake.nix in this checkout, so there is no dev shell to build in."
      - sh: '[ "{{.BUILDER}}" != "device" ] || ssh {{.HOST}} "command -v nix git rsync >/dev/null"'
        msg: >-
          BUILDER=device builds on {{.HOST}}, which needs nix, git and rsync.
          Build here instead with BUILDER=nix or BUILDER=container.
      - sh: '[ "{{.BUILDER}}" != "nix" ] || command -v nix'
        msg: >-
          BUILDER=nix needs the 'nix' command on this machine. Drop it to build
          on {{.HOST}} instead, or use BUILDER=container.
    cmds:
      - task: deploy:nix:rpm
        vars:
          HOST: '{{.HOST}}'
          BUILDER: '{{.BUILDER}}'
          KORA_DIR: '{{.KORA_DIR}}'
          REMOTE_DIR: '{{.REMOTE_DIR}}'
          STAGE: '{{.STAGE}}'
          SHELL_ATTR: '.#deploy'
      # By regex: the element is named after the derivation, not the attribute,
      # and there is no replace - the previous deploy goes first.
      - |
        ssh {{.HOST}} 'nix profile remove --regex "^{{.NAME}}(-.*)?$" >/dev/null 2>&1 || true
          nix profile add --impure --file {{.REMOTE_DIR}}/dev.nix {{.NAME}}'
      # comm truncates to 15 chars - exactly `cosmic-settings`, another binary -
      # so confirm against /proc/<pid>/exe before signalling anything.
      - |
        case "{{.RESTART}}" in
          true|yes)
            echo "Killing the daemon - cosmic-session does not start a replacement."
            ssh {{.HOST}} 'for p in $(pgrep -x "$(printf %.15s {{.NAME}})" 2>/dev/null); do
              case "$(readlink -f /proc/$p/exe)" in */{{.NAME}}) kill "$p" ;; esac
            done' ;;
          *)
            echo "Not restarting. Log out and back in on {{.HOST}} to pick it up." ;;
        esac
      - |
        echo "Done. {{.NAME}} is in {{.HOST}}'s user profile."
        echo "cosmic-session resolves it by name and ~/.nix-profile/bin outranks"
        echo "the system closure, so the next session starts this build."
        echo "Undo it on the device with:"
        echo "  nix profile remove --regex '^{{.NAME}}(-.*)?\$'"

  deploy:nix:rpm:
    internal: true
    desc: >-
      Build the RPM and leave it, with the dev.nix wrapping it, in REMOTE_DIR on
      HOST - where every BUILDER finishes, so the install step need not care.
    vars:
      GOTASK:
        sh: command -v go-task || command -v task
      RPM_TARGET: '{{.RPM_TARGET | default "dist:rpm"}}'
      PROFILE: '{{.PROFILE | default "release"}}'
      SHELL_ATTR: '{{.SHELL_ATTR | default ""}}'
      # Home-relative, and its own directory: --delete into a tree you also work
      # in would discard uncommitted work. target/ survives between deploys.
      SRC_DIR: '{{.SRC_DIR | default (printf ".cache/kora-deploy/%s" .NAME)}}'
    cmds:
      - |
        set -e
        case "{{.BUILDER}}" in
        device)
          ssh {{.HOST}} 'mkdir -p {{.SRC_DIR}} {{.REMOTE_DIR}}'
          # .git goes too: nix reads a checkout through git, so .gitignore is what
          # keeps target/ out of the copy it takes into the store.
          rsync -a --delete \
            --exclude 'target/' --exclude '.cache/' --exclude 'dist/' --exclude 'result' \
            ./ {{.HOST}}:{{.SRC_DIR}}/
          # Quoted: what survives go-task's templating expands on the device.
          ssh {{.HOST}} bash -s <<'REMOTE'
        set -e
        cd {{.SRC_DIR}}
        # A flake's source is its tracked files; a new uncommitted one is not.
        git add -AN . >/dev/null 2>&1 || true
        nix develop {{.SHELL_ATTR}} --command task {{.RPM_TARGET}}
        rpm=$(ls dist/{{.NAME}}-{{.VERSION}}-*.rpm | tail -n1)
        cp "$rpm" {{.REMOTE_DIR}}/
        # getFlake takes no `~`, so resolve it rather than write it.
        sed -e "s|@KORA_DIR@|$(cd {{.KORA_DIR}} && pwd)|g" \
            -e "s|@SRC@|{{.REMOTE_DIR}}/$(basename "$rpm")|g" \
            -e "s|@NAME@|{{.NAME}}|g" \
            pkg/nix/dev-package.nix.in > {{.REMOTE_DIR}}/dev.nix
        REMOTE
          ;;
        nix|container|host)
          case "{{.BUILDER}}" in
            nix)
              nix develop {{.SHELL_ATTR}} --command task {{.RPM_TARGET}} ;;
            container)
              {{.GOTASK}} docker:run TARGET={{.RPM_TARGET}} ARCH={{.ARCH}} TARGET_ARCH={{.TARGET_ARCH}} ;;
            host)
              {{.GOTASK}} {{.RPM_TARGET}} ;;
          esac
          # ld.so rejects a too-new glibc symbol version at exec and no patching
          # fixes it. Only the builders that run here can get this wrong.
          bin=target/{{.TARGET_ARCH}}/{{.PROFILE}}/{{.NAME}}
          need=$(objdump -T "$bin" | grep -o 'GLIBC_[0-9.]*' | sort -V | tail -n1)
          have=GLIBC_$(ssh {{.HOST}} 'ldd --version | head -n1 | sed "s/.* //"')
          if [ "$(printf '%s\n%s\n' "$need" "$have" | sort -V | tail -n1)" != "$have" ]; then
            echo "error: this build needs $need, {{.HOST}} provides $have. Wants:" >&2
            objdump -T "$bin" | grep -F "($need)" >&2
            echo "Drop BUILDER: the default builds on {{.HOST}} itself." >&2
            exit 1
          fi
          echo "glibc: this build needs $need, {{.HOST}} has $have"

          rm -rf {{.STAGE}}
          mkdir -p {{.STAGE}}
          rpm=$(ls dist/{{.NAME}}-{{.VERSION}}-*.{{.ARCH}}.rpm | tail -n1)
          cp "$rpm" {{.STAGE}}/
          kora=$(ssh {{.HOST}} 'cd {{.KORA_DIR}} && pwd')
          sed -e "s|@KORA_DIR@|$kora|g" \
              -e "s|@SRC@|{{.REMOTE_DIR}}/$(basename "$rpm")|g" \
              -e "s|@NAME@|{{.NAME}}|g" \
              pkg/nix/dev-package.nix.in > {{.STAGE}}/dev.nix
          ssh {{.HOST}} 'mkdir -p {{.REMOTE_DIR}}'
          # --delete so an older deploy's RPM does not sit there being confusing;
          # nix has already copied the one it used into the store.
          rsync -a --delete {{.STAGE}}/ {{.HOST}}:{{.REMOTE_DIR}}/
          ;;
        *)
          echo "error: unknown BUILDER '{{.BUILDER}}'; use device, nix, container or host" >&2
          exit 1 ;;
        esac

  nix:run:
    desc: Run a task in the native Nix development shell
    summary: |
      Run a task inside the shell `flake.nix` describes, without entering it:

        go-task nix:run TARGET=build:debug
        go-task nix:run TARGET=test:all

      Uses `.#deploy`, the same shell `deploy:nix` packages in, rather than
      `.#default`: this flake's lock is from 2023-12, so the crane/fenix shell
      resolves a toolchain years behind rust-toolchain.toml.
    aliases:
      - in-nix
    preconditions:
      - sh: which nix
        msg: "Prerequisite utility 'nix' is not installed"
    requires:
      vars:
        - TARGET
    cmds:
      # The inner `task` re-derives everything, where there is a compiler to ask.
      - nix develop .#deploy --command task {{.TARGET}}

  docker:build:
    desc: Build the container image used for the `docker:run` target
    preconditions:
      - sh: which docker
        msg: "Prerequisite utility 'docker' is not installed"
    status:
      - docker images | grep {{.IMAGE_NAME}} | grep {{.IMAGE_TAG}}
    cmds:
      - docker build -t {{.IMAGE_NAME}}:{{.IMAGE_TAG}} .

  docker:run:
    desc: Run tasks inside Docker. E.g. go-task docker:run TARGET=build TARGET_ARCH=x86_64-unknown-linux-gnu
    aliases:
      - in-docker
    deps:
      - docker:build
    preconditions:
      - sh: which docker
        msg: "Prerequisite utility 'docker' is not installed"
    vars:
      UID:
        sh: id -u
      GID:
        sh: id -g
      PWD:
        sh: pwd
      SSH_KEY:
        sh: echo "${SSH_KEY}"
      # Rootless podman maps --user onto a subuid that cannot read the mounted
      # checkout, and SELinux denies the labels. Real Docker needs neither.
      PODMAN_OPTS:
        sh: >-
          docker --version 2>/dev/null | grep -qi podman &&
          echo "--userns=keep-id --security-opt label=disable" || true
    requires:
      vars:
        - TARGET
    cmds:
      - mkdir -p .cache/home
      - mkdir -p .cache/var/lib/rpm
      # A /etc/passwd entry is required so the correct ~/.ssh path is used
      - echo -e "build:x:{{.UID}}:{{.GID}}::/home/build:/bin/bash" > .cache/passwd
      # Use the SSH key from the host
      - |
        mkdir -p .cache/.ssh
        {{ if ne .SSH_KEY "" }}
          echo "{{.SSH_KEY}}" > .cache/.ssh/id_ed25519
          chmod 600 .cache/.ssh/id_ed25519
        {{ else }}
          cp ~/.ssh/* .cache/.ssh
        {{ end }}
      - |
        docker run --rm {{.PODMAN_OPTS}} \
          -v "{{.PWD}}:{{.PWD}}" \
          -v "{{.PWD}}/.cache/home:/home/build" \
          -v "{{.PWD}}/.cache/var/lib/rpm:/var/lib/rpm" \
          -v "{{.PWD}}/.cache/.ssh:/home/build/.ssh" \
          -v "{{.PWD}}/.cache/passwd:/etc/passwd" \
          --workdir "{{.PWD}}" \
          -e HOME=/home/build \
          -e CARGO_HOME=/home/build/.cargo \
          -e BUILD_TYPE=${BUILD_TYPE} \
          -e PKG_CONFIG_SYSROOT_DIR="/usr/{{.ARCH}}-linux-gnu" \
          -e CARGO_NET_GIT_FETCH_WITH_CLI=true \
          -e GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" \
          --user {{.UID}}:{{.GID}} \
          {{.IMAGE_NAME}}:{{.IMAGE_TAG}} \
          task {{.TARGET}} ARCH={{.ARCH}} TARGET_ARCH={{.TARGET_ARCH}}