justfile

default_cli := "contrast.cli"
default_deploy_target := "openssl"
default_platform := "${default_platform}"
default_set := "${set}"
workspace_dir := "workspace"
default_collateral_proxy := "http://collateral-proxy.default.svc"

# Undeploy, rebuild, deploy.
default target=default_deploy_target platform=default_platform cli=default_cli: soft-clean coordinator initializer openssl port-forwarder service-mesh-proxy memdump debugshell (deploy target cli platform) set-manifest verify (wait-for-workload target)

# Build and push a container image.
push target set=default_set:
    #!/usr/bin/env bash
    set -euo pipefail
    mkdir -p {{ workspace_dir }}
    echo "Pushing container $container_registry/contrast/{{ target }}"
    nix run -L .#{{ set }}.scripts.containers.push-{{ target }} -- "$container_registry/contrast/{{ target }}" "{{ workspace_dir }}/just.containerlookup" "{{ workspace_dir }}/layers-cache.json"

coordinator: (push "coordinator")

openssl: (push "openssl")

port-forwarder: (push "port-forwarder")

service-mesh-proxy: (push "service-mesh-proxy")

initializer: (push "initializer")

memdump: (push "memdump")

debugshell: (push "debugshell")

k8s-log-collector: (push "k8s-log-collector")

strongswan: (push "strongswan")

large-compressed: (push "large-compressed")

# Download all logs (pod logs + host journal). Deploys the log-collector if not already running.
download-logs set=default_set:
    #!/usr/bin/env bash
    set -euo pipefail
    # Only push if not already pushed (e.g. by _e2e).
    if ! grep -q "k8s-log-collector" "{{ workspace_dir }}/just.containerlookup" 2>/dev/null; then
      just k8s-log-collector
    fi
    namespace_file="{{ workspace_dir }}/just.namespace"
    if [[ ! -f "$namespace_file" ]]; then
      echo "No namespace file found at $namespace_file. Deploy something first." >&2
      exit 1
    fi
    nix run .#{{ set }}.scripts.get-logs -- download "$namespace_file"

containerd-reproducer set=default_set:
    #!/usr/bin/env bash
    set -euo pipefail
    read tag digest < <(nix run -L .#{{ set }}.scripts.containers.push-containerd-reproducer -- $container_registry | tail -n 1)
    echo "ghcr.io/edgelesssys/contrast/containerd-reproducer:latest-tag=$container_registry/contrast/containerd-reproducer:$tag" >> {{ workspace_dir }}/just.containerlookup
    echo "ghcr.io/edgelesssys/contrast/containerd-reproducer:latest-digest=$container_registry/contrast/containerd-reproducer@$digest" >> {{ workspace_dir }}/just.containerlookup

# Build the node-installer, containerize and push it.
node-installer platform=default_platform:
    #!/usr/bin/env bash
    set -euo pipefail
    case {{ platform }} in
        "Metal-QEMU-SNP"|"Metal-QEMU-TDX"|"Metal-QEMU-Insecure")
            just push "node-installer-kata"
        ;;
        "Metal-QEMU-SNP-GPU"|"Metal-QEMU-TDX-GPU"|"Metal-QEMU-Insecure-GPU")
            just push "node-installer-kata-gpu"
        ;;
        *)
            echo "Unsupported platform: {{ platform }}"
            exit 1
        ;;
    esac

# Get all used platform names in a comma-separated string
collect-platforms platform=default_platform set=default_set:
    #!/usr/bin/env bash
    set -euo pipefail
    deployment=$( [[ -e "./{{ workspace_dir }}/deployment" ]] && printf '%s' "./{{ workspace_dir }}/deployment" || printf '' )
    nix shell .#{{ set }}.contrast.resourcegen --command resourcegen \
        --platform {{ platform }} \
        --deployment "$deployment" \
        collect-platforms

# Some e2e tests require a specific Nix package set and/or debug to build correctly. Auto-select these based on the test name.
e2e target=default_deploy_target platform=default_platform set=default_set:
    #!/usr/bin/env bash
    set -euo pipefail
    declare -A required_sets=(
        [badaml-vuln]=badaml+no-aml-sandbox
        [badaml-sandbox]=badaml
    )
    declare -A required_debug=(
        [badaml-vuln]=true
        [badaml-sandbox]=true
    )
    RESOLVED_SET="{{ set }}"
    if [[ -v "required_sets[{{ target }}]" ]]; then
        RESOLVED_SET="${required_sets[{{ target }}]}"
    fi
    RESOLVED_DEBUG="${debug:-false}"
    if [[ -v "required_debug[{{ target }}]" ]]; then
        RESOLVED_DEBUG="${required_debug[{{ target }}]}"
    fi
    echo "Using set=$RESOLVED_SET, debug=$RESOLVED_DEBUG for test '{{ target }}'"
    set="$RESOLVED_SET" debug="$RESOLVED_DEBUG" just _e2e {{ target }} {{ platform }}

_e2e target=default_deploy_target platform=default_platform set=default_set: soft-clean coordinator initializer openssl port-forwarder service-mesh-proxy memdump debugshell k8s-log-collector strongswan large-compressed (node-installer platform)
    #!/usr/bin/env bash
    set -euo pipefail
    if [[ {{ target }} == "gpu" ]] ; then
        just request-fifo-ticket 90m
    fi
    if [[ -n "${contrast_ghcr_read:-}" ]]; then
        export CONTRAST_GHCR_READ="$contrast_ghcr_read"
    fi
    if [[ {{ target }} == "multi-runtime-class" ]]; then
        # both are required
        just push "node-installer-kata"
        just push "node-installer-kata-gpu"
    fi
    if [[ {{ target }} == "containerd-11644-reproducer" ]]; then
        just containerd-reproducer
    fi
    get_logs=$(nix build .#{{ set }}.scripts.get-logs --no-link --print-out-paths)
    # get-logs start waits until the namespace file is created, then spawns self-cleaning background tasks and exits.
    "$get_logs/bin/get-logs" start ./{{ workspace_dir }}/just.namespace &
    nix shell .#{{ set }}.contrast.e2e --command {{ target }}.test -test.v \
            --image-replacements ./{{ workspace_dir }}/just.containerlookup \
            --genpolicy-cache-path ./{{ workspace_dir }}/layers-cache.json \
            --namespace-file ./{{ workspace_dir }}/just.namespace \
            --platform {{ platform }} \
            --node-installer-target-conf-type "${node_installer_target_conf_type}" \
            --namespace-suffix=${namespace_suffix-} \
            --sync-ticket-file ./{{ workspace_dir }}/just.sync-ticket \
            --insecure-enable-debug-shell-access=${debug:-false}

# Run additional tests for a PR. Set `post` to `true` to auto-post the comment.
e2e-ci target platforms="all" post="false" set="testcase-default" debug_shell="false" skip_undeploy="false":
    #!/usr/bin/env bash
    set -euo pipefail
    platforms="{{ platforms }}"
    case "$platforms" in
        "all")
            platforms="Metal-QEMU-SNP,Metal-QEMU-TDX,Metal-QEMU-SNP-GPU,Metal-QEMU-TDX-GPU"
            ;;
        "snp")
            platforms="Metal-QEMU-SNP,Metal-QEMU-SNP-GPU"
            ;;
        "tdx")
            platforms="Metal-QEMU-TDX,Metal-QEMU-TDX-GPU"
            ;;
        "gpu")
            platforms="Metal-QEMU-SNP-GPU,Metal-QEMU-TDX-GPU"
            ;;
        *)
            ;;
    esac

    pr_number=""
    branch=$(git branch --show-current)
    if [[ "{{ post }}" == "true" ]]; then
        pr_number=$(gh pr view --json number --jq '.number' 2>/dev/null || true)
        if [[ -z "$pr_number" ]]; then
            echo "error: could not auto-detect PR for branch '$branch'" >&2
            exit 1
        fi
    fi

    results=()
    IFS=',' read -ra platform_list <<< "$platforms"
    for platform in "${platform_list[@]}"; do
        run_url=$(gh workflow run e2e_manual.yml \
            --ref "$branch" \
            -f "test-name={{ target }}" \
            -f "platform=$platform" \
            -f "set={{ set }}" \
            -f "skip-undeploy={{ skip_undeploy }}" \
            -f "debug-shell={{ debug_shell }}" \
            2>&1 | grep -oE 'https://[^ ]+/actions/runs/[0-9]+' || echo "")
        line="- [ ] [$platform, {{ target }}]($run_url)"
        results+=("$line")
        echo "$line"
    done

    if [[ -n "$pr_number" ]]; then
        echo ""
        comment=$(printf '%s\n' "${results[@]}")
        gh pr comment "$pr_number" --body "$comment"
        echo "Posted comment to PR #$pr_number"
    fi

e2e-release source platform=default_platform set=default_set: soft-clean k8s-log-collector
    #!/usr/bin/env bash
    set -euo pipefail
    nix build .#{{ set }}.scripts.get-logs
    mkdir -p ./{{ workspace_dir }}
    # get-logs start waits until the namespace file is created, then spawns self-cleaning background tasks and exits.
    nix run .#{{ set }}.scripts.get-logs start ./{{ workspace_dir }}/just.namespace &
    trap "kubectl delete -f ./{{ workspace_dir }}/log-collector.yaml; rm -f ./{{ workspace_dir }}/just.namespace" EXIT

    # Decide the artifact source from the argument: an https:// URL is fetched from S3, anything else is treated as a Github release tag.
    if [[ "{{ source }}" == https://* ]]; then
        source_args=(--s3-base-url "{{ source }}")
    else
        source_args=(--tag "{{ source }}")
    fi
    nix shell .#{{ set }}.contrast.e2e --command release.test -test.v \
            "${source_args[@]}" \
            --platform {{ platform }} \
            --node-installer-target-conf ${node_installer_target_conf_type} \
            --namespace-file ./{{ workspace_dir }}/just.namespace \
            --use-loadbalancer=true

# Generate policies, apply Kubernetes manifests.
deploy target=default_deploy_target cli=default_cli platform=default_platform: (populate target platform) (runtime target platform) (write-namespace target) (apply "runtime" platform) (generate cli platform) (apply target platform)

# Populate the workspace with a runtime class deployment
runtime target=default_deploy_target platform=default_platform set=default_set:
    #!/usr/bin/env bash
    set -euo pipefail
    platforms=$(just collect-platforms)
    IFS=',' read -ra PLATFORMS <<< "$platforms"
    for platform in "${PLATFORMS[@]}"; do
        just node-installer "$platform"
    done

    mkdir -p ./{{ workspace_dir }}/runtime
    if [[ "${node_installer_target_conf_type}" != "none" ]]; then
        nix shell .#{{ set }}.contrast.resourcegen --command resourcegen \
            --image-replacements ./{{ workspace_dir }}/just.containerlookup \
            --namespace {{ target }}${namespace_suffix-} \
            --node-installer-target-conf-type ${node_installer_target_conf_type} \
            --platform {{ platform }} \
            node-installer-target-conf > ./{{ workspace_dir }}/runtime/target-conf.yml
    fi

    nix shell .#{{ set }}.contrast.resourcegen --command resourcegen \
        --image-replacements ./{{ workspace_dir }}/just.containerlookup \
        --namespace {{ target }}${namespace_suffix-} \
        --node-installer-target-conf-type ${node_installer_target_conf_type} \
        --platform "$platforms" \
        runtime > "./{{ workspace_dir }}/runtime/runtime.yml"

# Populate the workspace with a Kubernetes deployment
populate target=default_deploy_target platform=default_platform set=default_set:
    #!/usr/bin/env bash
    set -euo pipefail
    mkdir -p ./{{ workspace_dir }}
    mkdir -p ./{{ workspace_dir }}/deployment
    target="{{ target }}"
    if [[ "${target}" == "custom" ]]; then
        target=""
        cp -r ./.custom/* ./{{ workspace_dir }}/deployment/
        ns="{{ target }}${namespace_suffix-}"
        for file in ./{{ workspace_dir }}/deployment/*.yml; do
            env ns="$ns" yq -i '.metadata.namespace = strenv(ns)' "$file"
        done
    fi
    if [[ -f ./{{ workspace_dir }}/deployment/deployment.yml ]]; then
        echo "---" >> ./{{ workspace_dir }}/deployment/deployment.yml
    fi
    dmesgFlag=""
    # For debug, we already add the debugshell container which exposes the full journal.
    if [[ "${debug:-}" != "true" ]]; then
        dmesgFlag="--add-dmesg"
    fi
    gpuFlags=()
    if [[ "{{ platform }}" == *-GPU ]]; then
        gpuClass=$(kubectl get nodes -o json | jq -er '
            [
                .items[].status.allocatable
                | to_entries[]
                | select(.value != "0")
                | .key
                | select(
                    . == "nvidia.com/GB100_B200"
                    or . == "nvidia.com/GB110_B300_SXM6_AC"
                    or . == "nvidia.com/GH100_H100_PCIE"
                    or . == "nvidia.com/pgpu"
                )
            ]
            | unique
            | first // error("no supported GPU resource is allocatable")
        ')
        gpuFlags=("--gpu-class" "$gpuClass")
    fi
    storageClassFlags=()
    storageClass=$(kubectl get storageclass -l ci.contrast.edgeless.systems/is-default-class=true -o "jsonpath={.items[*]['metadata.name']}")
    if [[ -n "$storageClass" ]]; then
        storageClassFlags=("--storage-class" "$storageClass")
    fi
    nix shell .#{{ set }}.contrast.resourcegen --command resourcegen \
        --image-replacements ./{{ workspace_dir }}/just.containerlookup \
        --namespace {{ target }}${namespace_suffix-} \
        --add-port-forwarders \
        --add-logging \
        ${dmesgFlag} \
        "${gpuFlags[@]}" \
        "${storageClassFlags[@]}" \
        --platform {{ platform }} \
        ${target} coordinator >> ./{{ workspace_dir }}/deployment/deployment.yml

# Write the namespace so it can be read by other scripts
write-namespace target=default_deploy_target:
    echo "{{ target }}${namespace_suffix-}" >> ./{{ workspace_dir }}/just.namespace

# Generate policies, update manifest.
generate cli=default_cli platform=default_platform set=default_set collateral_proxy=default_collateral_proxy:
    #!/usr/bin/env bash
    set -euo pipefail
    debugFlag=""
    if [[ "${debug:-}" == "true" ]]; then
        debugFlag="--insecure-enable-debug-shell-access"
    fi
    patch=$(mktemp)
    kubectl -n default get cm bm-tcb-specs -o jsonpath="{.data['specs']}" > "$patch"
    nix run -L .#{{ set }}.{{ cli }} -- generate \
        --workspace-dir ./{{ workspace_dir }} \
        --image-replacements ./{{ workspace_dir }}/just.containerlookup \
        --reference-values {{ platform }} \
        --reference-value-patches "$patch" \
        --purge-empty-reference-values \
        --collateral-proxy "{{ collateral_proxy }}" \
        ${debugFlag} \
        ./{{ workspace_dir }}/deployment/

# Apply Kubernetes manifests from /deployment
apply target=default_deploy_target platform=default_platform:
    #!/usr/bin/env bash
    set -euo pipefail
    ns=$(tail -1 ./{{ workspace_dir }}/just.namespace)
    kubectl create namespace $ns --dry-run=client -o yaml | kubectl apply -f -
    case {{ target }} in
        "runtime")
            if [[ -f ./{{ workspace_dir }}/runtime/target-conf.yml ]]; then
                kubectl apply -f ./{{ workspace_dir }}/runtime/target-conf.yml
            fi
            if kubectl get secret -n default contrast-e2e-registry-auth >/dev/null 2>&1; then
              kubectl get secret -n default contrast-e2e-registry-auth -o 'jsonpath={.data.contrast-imagepuller\.toml}' \
              | base64 -d \
              | kubectl create secret generic -n "$ns" contrast-node-installer-imagepuller-config --from-file=contrast-imagepuller.toml=/dev/stdin
            elif [[ -n "${contrast_ghcr_read:-}" ]]; then
                cat > "./{{ workspace_dir }}/contrast-imagepuller.toml" <<EOF
    [registries]
    [registries."ghcr.io."]
    auth = "$(printf "user-not-required-here:%s" "$contrast_ghcr_read" | base64 -w0)"
    EOF
                kubectl create secret generic contrast-node-installer-imagepuller-config \
                    --from-file "contrast-imagepuller.toml"="./{{ workspace_dir }}/contrast-imagepuller.toml" \
                    --namespace $(tail -1 ./{{ workspace_dir }}/just.namespace)
            fi
            kubectl apply -f ./{{ workspace_dir }}/runtime/runtime.yml
        ;;
        *)
            if [[ {{ target }} == "gpu" || {{ target }} == "custom" && {{ platform }} == *-GPU ]] ; then
                just request-fifo-ticket 90m
                trap 'just release-fifo-ticket' ERR
                kubectl label ns $(tail -1 ./{{ workspace_dir }}/just.namespace) contrast.edgeless.systems/sync-ticket=$(cat ./{{ workspace_dir }}/just.sync-ticket) --overwrite
            fi
            kubectl apply -f ./{{ workspace_dir }}/deployment
        ;;
    esac

# Delete Kubernetes manifests.
undeploy:
    #!/usr/bin/env bash
    set -euo pipefail
    if [[ ! -d ./{{ workspace_dir }} ]]; then
        echo "No workspace directory found, nothing to undeploy."
        exit 0
    fi
    if [[ ! -f ./{{ workspace_dir }}/just.namespace ]]; then
        echo "No namespace file found, nothing to undeploy."
        exit 0
    fi
    ns=$(cat ./{{ workspace_dir }}/just.namespace)
    kubectl delete namespace $ns --ignore-not-found --timeout 10m
    rm -f ./{{ workspace_dir }}/just.namespace
    just release-fifo-ticket

# Set the manifest at the coordinator.
set-manifest cli=default_cli set=default_set:
    #!/usr/bin/env bash
    set -euo pipefail
    ns=$(tail -1 ./{{ workspace_dir }}/just.namespace)
    nix run -L .#{{ set }}.scripts.kubectl-wait-coordinator -- $ns
    nix run -L .#{{ set }}.scripts.kubectl-wait-ready -- $ns port-forwarder-coordinator
    kubectl -n $ns port-forward pod/port-forwarder-coordinator 1313 &
    PID=$!
    trap 'kill $PID 2>/dev/null; wait $PID 2>/dev/null || true' EXIT
    nix run -L .#{{ set }}.scripts.wait-for-port-listen -- 1313
    nix run -L .#{{ set }}.{{ cli }} -- set \
        --workspace-dir ./{{ workspace_dir }} \
        -c localhost:1313 \
        ./{{ workspace_dir }}/deployment/

# Verify the Coordinator.
verify cli=default_cli set=default_set:
    #!/usr/bin/env bash
    set -euo pipefail
    rm -rf ./{{ workspace_dir }}/verify
    ns=$(tail -1 ./{{ workspace_dir }}/just.namespace)
    nix run -L .#{{ set }}.scripts.kubectl-wait-coordinator -- $ns
    kubectl -n $ns port-forward pod/port-forwarder-coordinator 1314:1313 &
    PID=$!
    trap 'kill $PID 2>/dev/null; wait $PID 2>/dev/null || true' EXIT
    nix run -L .#{{ set }}.scripts.wait-for-port-listen -- 1314
    nix run -L .#{{ set }}.{{ cli }} -- verify \
        --workspace-dir ./{{ workspace_dir }} \
        -c localhost:1314

# Recover the Coordinator.
recover cli=default_cli set=default_set:
    #!/usr/bin/env bash
    set -euo pipefail
    ns=$(tail -1 ./{{ workspace_dir }}/just.namespace)
    nix run -L .#{{ set }}.scripts.kubectl-wait-coordinator -- $ns
    nix run -L .#{{ set }}.scripts.kubectl-wait-ready -- $ns port-forwarder-coordinator
    kubectl -n $ns port-forward pod/port-forwarder-coordinator 1313 &
    PID=$!
    trap 'kill $PID 2>/dev/null; wait $PID 2>/dev/null || true' EXIT
    nix run -L .#{{ set }}.scripts.wait-for-port-listen -- 1313
    nix run -L .#{{ set }}.{{ cli }} -- recover \
        --workspace-dir ./{{ workspace_dir }} \
        -c localhost:1313

# Wait for workloads to become ready.
wait-for-workload target=default_deploy_target set=default_set:
    #!/usr/bin/env bash
    set -euo pipefail
    ns=$(tail -1 ./{{ workspace_dir }}/just.namespace)
    case {{ target }} in
        "openssl")
            nix run -L .#{{ set }}.scripts.kubectl-wait-ready -- $ns openssl-backend
            nix run -L .#{{ set }}.scripts.kubectl-wait-ready -- $ns openssl-frontend
        ;;
        "emojivoto" | "emojivoto-sm-ingress")
            nix run -L .#{{ set }}.scripts.kubectl-wait-ready -- $ns emoji
            nix run -L .#{{ set }}.scripts.kubectl-wait-ready -- $ns vote-bot
            nix run -L .#{{ set }}.scripts.kubectl-wait-ready -- $ns voting
            nix run -L .#{{ set }}.scripts.kubectl-wait-ready -- $ns web
        ;;
        "volume-stateful-set")
            nix run .#{{ set }}.scripts.kubectl-wait-ready -- $ns volume-tester
        ;;
        "mysql")
            nix run .#{{ set }}.scripts.kubectl-wait-ready -- $ns mysql-backend
            nix run .#{{ set }}.scripts.kubectl-wait-ready -- $ns mysql-client
        ;;
        "vault")
            nix run .#{{ set }}.scripts.kubectl-wait-ready -- $ns vault
        ;;
        "gpu")
            nix run .#{{ set }}.scripts.kubectl-wait-ready -- $ns gpu-tester
        ;;
        "custom")
            :
        ;;
        *)
            echo "Please register workloads of new targets in wait-for-workload"
            exit 1
        ;;
    esac

# Provision the collateral-proxy singleton in "default" from the published release manifest.
collateral-proxy-bootstrap:
    #!/usr/bin/env bash
    set -euo pipefail
    manifest=$(curl -fsSL https://github.com/edgelesssys/collateral-proxy/releases/latest/download/collateral-proxy.yml)
    # These clusters have no Kubernetes default StorageClass, so inject the labeled one into the StatefulSet's volumeClaimTemplates.
    storageClass=$(kubectl get storageclass -l ci.contrast.edgeless.systems/is-default-class=true -o "jsonpath={.items[*]['metadata.name']}")
    if [[ -n "$storageClass" ]]; then
        manifest=$(env sc="$storageClass" yq '(select(.kind == "StatefulSet").spec.volumeClaimTemplates[].spec.storageClassName) = strenv(sc)' <<<"$manifest")
    fi
    kubectl -n default apply --server-side --force-conflicts -f - <<<"$manifest"
    kubectl -n default rollout status statefulset/collateral-proxy --timeout=120s

# Wipe the existing collateral-proxy and bootstrap a fresh one.
collateral-proxy-redeploy:
    #!/usr/bin/env bash
    set -euo pipefail
    kubectl -n default delete --ignore-not-found --wait=true \
        statefulset/collateral-proxy svc/collateral-proxy pvc/state-collateral-proxy-0
    just collateral-proxy-bootstrap

# Print the collateral-proxy /metrics endpoint.
collateral-proxy-stats:
    kubectl get --raw "/api/v1/namespaces/default/services/collateral-proxy:80/proxy/metrics"

request-fifo-ticket duration="":
    #!/usr/bin/env bash
    set -euo pipefail
    if [[ -f ./{{ workspace_dir }}/just.sync-ticket ]]; then
        echo "Sync ticket already exists, not requesting a new one."
        exit 1
    fi
    flags=()
    if [[ -n "{{ duration }}" ]]; then
        flags=(--duration {{ duration }})
    fi
    ticket=$(nix run .#base.scripts.get-sync-ticket -- "${flags[@]}")
    mkdir -p ./{{ workspace_dir }}
    echo $ticket > ./{{ workspace_dir }}/just.sync-ticket

release-fifo-ticket:
    #!/usr/bin/env bash
    set -euo pipefail
    if [[ ! -f ./{{ workspace_dir }}/just.sync-ticket ]]; then
        echo "No sync ticket found, nothing to release."
        exit 0
    fi
    ticket=$(cat ./{{ workspace_dir }}/just.sync-ticket)
    nix run .#base.scripts.release-sync-ticket ${ticket}
    rm ./{{ workspace_dir }}/just.sync-ticket

# Load the kubeconfig for the given platform.
get-credentials platform=default_platform:
    #!/usr/bin/env bash
    set -euo pipefail
    case {{ platform }} in
        "Metal-QEMU-TDX"|"olimar")
            nix run -L .#base.scripts.get-credentials "projects/796962942582/secrets/olimar-kubeconfig/versions/latest" Metal-QEMU-TDX k3s
        ;;
        "Metal-QEMU-TDX-GPU"|"dgx-007")
            nix run -L .#base.scripts.get-credentials "projects/796962942582/secrets/dgx-007-kubeconfig/versions/latest" Metal-QEMU-TDX-GPU none
        ;;
        "Metal-QEMU-SNP"|"palutena")
            nix run -L .#base.scripts.get-credentials "projects/796962942582/secrets/palutena-kubeconfig/versions/latest" Metal-QEMU-SNP none
        ;;
        "Metal-QEMU-SNP-GPU"|"discovery")
            nix run -L .#base.scripts.get-credentials "projects/796962942582/secrets/discovery-kubeconf/versions/latest" Metal-QEMU-SNP-GPU k3s
        ;;
        "dev"|"hetzner-ax162-snp")
            nix run -L .#base.scripts.get-credentials "projects/796962942582/secrets/hetzner-ax162-snp-kubeconfig/versions/latest" Metal-QEMU-SNP k3s
        ;;
        *)
            echo "Unsupported platform: {{ platform }}"
            exit 1
        ;;
    esac

# Load the kubeconfig from the dev cluster.
get-credentials-dev:
    just get-credentials dev

# Get the Github token with read access to Contrast's ghcr.io packages.
get-ghcr-read-token:
    #!/usr/bin/env bash
    set -euo pipefail
    token=$(nix run -L .#base.scripts.get-ghcr-read-token "projects/796962942582/secrets/ghcr-read-token/versions/latest")
    sed -i "s/^contrast_ghcr_read=.*/contrast_ghcr_read=\"${token}\"/" justfile.env

# Run code generators.
codegen:
    nix run -L .#base.scripts.generate

# Format code.
fmt:
    nix fmt

# Lint code.
lint:
    nix run -L .#base.scripts.golangci-lint -- run

# Run Go unit tests.
unit:
    CGO_ENABLED=1 go test -tags=contrast_unstable_api -v -race ./...

# Run the policy test suite.
policy: initializer
    #!/usr/bin/env bash
    set -euo pipefail
    echo "Running policy tests..."
    nix run -L .#base.policy-test -- --image-replacements ./{{ workspace_dir }}/just.containerlookup

# Check links.
check-links config="external":
    nix run .#base.nixpkgs.lychee -- --config tools/lychee/config-{{ config }}.toml .

# Serve the docs site locally. Unreleased changes from docs/docs/ live at http://localhost:3000/contrast/next/.
docs:
    nix develop .#docs --command bash -c 'cd docs && yarn install && yarn start'

demodir version="latest": undeploy
    #!/usr/bin/env bash
    set -euo pipefail
    v="$(echo {{ version }} | sed 's/\./-/g')"
    nix develop -u DIRENV_DIR -u DIRENV_FILE -u DIRENV_DIFF -u DIRENV_WATCHES .#base.demo-$v

# Remove deployment specific files.
soft-clean: undeploy
    rm -rf ./{{ workspace_dir }}

# Cleanup all auxiliary files, caches etc.
clean: soft-clean
    rm -rf ./{{ workspace_dir }}.cache
    rm -rf ./layers_cache
    rm -f ./layers-cache.json

# Template for the justfile.env file.

rctemplate := '''
# Container registry to push images to, i.e ghcr.io/<your username>
container_registry=""
# Platform to deploy on
default_platform="Metal-QEMU-SNP"
# Node installer target config map to deploy.
node_installer_target_conf_type="k3s"
# Enable insecure debug features like debug shell access.
debug="false"
# Set of packages to use.
set="base"
# Namespace suffix, can be empty. Will be used when patching namespaces.
namespace_suffix=""
# Cache directory for the CLI.
CONTRAST_CACHE_DIR="./workspace.cache"
# Log level for the CLI.
CONTRAST_LOG_LEVEL=""
# A Github token with read access to the Contrast ghcr.io packages.
# Should be set by running just get-ghcr-read-token.
contrast_ghcr_read=""
# A GitHub token with `Contents: Read and write` on edgelesssys/contrast.
# Create a fine-grained PAT scoped to the repo.
#
# Used by:
#   - e2e-release: write permission is needed to see DRAFT releases
#   - just fmt / treefmt: zizmor calls the GitHub API; errors out
#     without a token.
GH_TOKEN=""
'''

# Developer onboarding.
onboard:
    @ [[ -f "./justfile.env" ]] && echo "justfile.env already exists" && exit 1 || true
    @echo '{{ rctemplate }}' > ./justfile.env
    @just get-ghcr-read-token
    @echo "Created ./justfile.env. Please fill it out."

# Just configuration.

set dotenv-filename := "justfile.env"
set dotenv-load
set shell := ["bash", "-uc"]