Taskfile.yml

# Spinbox Containerd Runtime - Task Runner
#
# Quick Start:
#   task build           # Build everything (shim, kernel, initrd)
#   task clean           # Clean build artifacts
#   task lint            # Lint code
#
# Development:
#   task menuconfig      # Configure kernel (requires KERNEL_VERSION and KERNEL_ARCH)
#
# Requirements:
#   - Go 1.23+
#   - Docker with buildx

version: '3'

silent: true

output: "prefixed"

vars:
  GO: go
  DOCKER: docker
  BUILDX: "{{.DOCKER}} buildx"
  MODULE_NAME:
    sh: go list -m
  ROOT_DIR:
    sh: pwd
  ARCH:
    sh: uname -m
  OS:
    sh: uname -s
  OUTPUT_DIR: _output
  BIN_DIR: bin
  SCRIPTS_DIR: hack
  BUILDKIT_CACHE_DIR: '{{.BUILDKIT_CACHE_DIR | default "/var/lib/spin-stack-buildkit-cache"}}'
  BUILDKIT_CACHE_KERNEL: '{{.BUILDKIT_CACHE_DIR}}/kernel'
  BUILDKIT_CACHE_INITRD: '{{.BUILDKIT_CACHE_DIR}}/initrd'
  BUILDKIT_CACHE_QEMU: '{{.BUILDKIT_CACHE_DIR}}/qemu'

  # Version info (set via environment or computed)
  VERSION:
    sh: echo "${VERSION:-$(git describe --tags --exact-match 2>/dev/null || git rev-parse --short HEAD 2>/dev/null || echo dev)}"
  GIT_COMMIT:
    sh: git rev-parse HEAD 2>/dev/null || echo "unknown"
  BUILD_DATE:
    sh: date -u +"%Y-%m-%dT%H:%M:%SZ"

  # Build flags with version info
  VERSION_PKG: "github.com/spin-stack/spinbox/internal/version"
  VERSION_LDFLAGS: "-X {{.VERSION_PKG}}.Version={{.VERSION}} -X {{.VERSION_PKG}}.GitCommit={{.GIT_COMMIT}} -X {{.VERSION_PKG}}.BuildDate={{.BUILD_DATE}}"
  LDFLAGS: "-s -w {{.VERSION_LDFLAGS}}"
  GO_BUILDTAGS: "no_grpc"
  GO_TAGS: '-tags "{{.GO_BUILDTAGS}}"'
  GO_LDFLAGS: "-ldflags '{{.LDFLAGS}}'"

  # Static build flags
  GO_STATIC_BUILDTAGS: "osusergo netgo static_build no_grpc"
  GO_STATIC_TAGS: '-tags "{{.GO_STATIC_BUILDTAGS}}"'
  GO_STATIC_LDFLAGS: "-ldflags '-extldflags \"-static\" {{.LDFLAGS}}'"

tasks:
  # ==========================================================================
  # Build Tasks
  # ==========================================================================

  build:go:
    internal: true
    cmds:
      - |
        set -eou pipefail
        echo "🐳 Building {{.NAME}}..."
        mkdir -p {{.OUTPUT_DIR}}
        CGO_ENABLED=0 GOOS=linux GOARCH=amd64 {{.GO}} build {{.GO_STATIC_TAGS}} {{.GO_STATIC_LDFLAGS}} -o {{.OUTPUT_DIR}}/{{.OUT}} {{.PKG}}
        echo "✓ {{.NAME}} built: {{.OUTPUT_DIR}}/{{.OUT}} (static)"

  build:
    desc: Build all components (shim, commit tool, kernel, initrd, QEMU)
    deps:
      - build:shim
      - build:commit
      - build:kernel
      - build:initrd
      - build:qemu
    cmds:
      - cmd: 'echo "✓ Build complete"'

  build:shim:
    desc: Build containerd shim binary (static, Linux x86_64)
    sources:
      - cmd/containerd-shim-spinbox-v1/**
      - internal/**
      - pkg/**
      - go.mod
      - go.sum
    generates:
      - "{{.OUTPUT_DIR}}/containerd-shim-spinbox-v1"
    cmds:
      - task: build:go
        vars:
          NAME: containerd-shim-spinbox-v1
          OUT: containerd-shim-spinbox-v1
          PKG: ./cmd/containerd-shim-spinbox-v1
          GO_STATIC_TAGS: '-tags "osusergo netgo static_build"'

  build:commit:
    desc: Build spinbox-commit binary (static, Linux x86_64)
    sources:
      - cmd/spinbox-commit/**
      - go.mod
      - go.sum
    generates:
      - "{{.OUTPUT_DIR}}/spinbox-commit"
    cmds:
      - task: build:go
        vars:
          NAME: spinbox-commit
          OUT: spinbox-commit
          PKG: ./cmd/spinbox-commit
          GO_STATIC_TAGS: '-tags "osusergo netgo static_build"'

  build:vminitd:
    desc: Build vminitd binary (static, Linux x86_64)
    sources:
      - cmd/vminitd/**
      - internal/**
      - pkg/**
      - go.mod
      - go.sum
    generates:
      - "{{.OUTPUT_DIR}}/vminitd"
    cmds:
      - task: build:go
        vars:
          NAME: vminitd
          OUT: vminitd
          PKG: ./cmd/vminitd
          GO_STATIC_TAGS: '-tags "osusergo netgo static_build"'

  build:initrd:
    desc: Build initrd image
    cmds:
      - |
        set -eou pipefail
        echo "🐳 Building initrd..."
        # Use git commit SHA to bust vminitd cache and prevent stale builds
        COMMIT_SHA=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
        {{.BUILDX}} build \
          --file Dockerfile \
          --target initrd \
          --platform linux/amd64 \
          --cache-from type=local,src={{.BUILDKIT_CACHE_INITRD}} \
          --cache-to type=local,dest={{.BUILDKIT_CACHE_INITRD}},mode=max,compression=zstd \
          --build-arg KERNEL_VERSION=7.1 \
          --build-arg KERNEL_ARCH=x86_64 \
          --build-arg KERNEL_NPROC=8 \
          --build-arg VMINITD_CACHE_BUST="${COMMIT_SHA}" \
          --output type=local,dest={{.OUTPUT_DIR}} \
          .
        echo "✓ Initrd built: _output/spinbox-initrd (commit: ${COMMIT_SHA})"

  build:kernel:
    desc: Build kernel
    cmds:
      - |
        set -eou pipefail
        echo "🐳 Building kernel..."
        {{.BUILDX}} build \
          --file Dockerfile \
          --target kernel \
          --platform linux/amd64 \
          --cache-from type=local,src={{.BUILDKIT_CACHE_KERNEL}} \
          --cache-to type=local,dest={{.BUILDKIT_CACHE_KERNEL}},mode=max,compression=zstd \
          --build-arg KERNEL_VERSION=7.1 \
          --build-arg KERNEL_ARCH=x86_64 \
          --build-arg KERNEL_NPROC=8 \
          --output type=local,dest={{.OUTPUT_DIR}} \
          .
        echo "✓ Kernel built: _output/spinbox-kernel-x86_64"

  build:qemu:
    desc: Build QEMU binaries and firmware (qemu-system-x86_64, BIOS files)
    cmds:
      - |
        set -eou pipefail
        echo "🐳 Building QEMU..."
        {{.BUILDX}} build \
          --file Dockerfile.qemu \
          --target extract \
          --platform linux/amd64 \
          --cache-from type=local,src={{.BUILDKIT_CACHE_QEMU}} \
          --cache-to type=local,dest={{.BUILDKIT_CACHE_QEMU}},mode=max,compression=zstd \
          --build-arg QEMU_VERSION=11.0.1 \
          --build-arg QEMU_JOBS=8 \
          --output type=local,dest={{.OUTPUT_DIR}} \
          .
        echo "✓ QEMU built: _output/bin/qemu-system-x86_64"
        echo "✓ QEMU firmware: _output/share/spin-stack/qemu/"

  # ==========================================================================
  # Development Tasks
  # ==========================================================================

  menuconfig:
    desc: Configure kernel (requires KERNEL_VERSION and KERNEL_ARCH env vars)
    preconditions:
      - sh: "[ -n \"${KERNEL_VERSION:-}\" ]"
        msg: "KERNEL_VERSION environment variable must be set"
      - sh: "[ -n \"${KERNEL_ARCH:-}\" ]"
        msg: "KERNEL_ARCH environment variable must be set"
    interactive: true
    cmds:
      - |
        set -eou pipefail
        echo "🐳 Building menuconfig environment..."
        {{.BUILDX}} build \
          --file Dockerfile \
          --target kernel-build-base \
          --platform linux/amd64 \
          --cache-from type=local,src={{.BUILDKIT_CACHE_KERNEL}} \
          --cache-to type=local,dest={{.BUILDKIT_CACHE_KERNEL}},mode=max,compression=zstd \
          --build-arg KERNEL_VERSION=${KERNEL_VERSION} \
          --build-arg KERNEL_ARCH=${KERNEL_ARCH} \
          --build-arg KERNEL_NPROC=${KERNEL_NPROC:-8} \
          --output type=docker,name=spinbox-menuconfig \
          .
        echo "🐳 Starting kernel menuconfig..."
        echo "   Use arrow keys to navigate, Space to select, Enter to confirm"
        echo "   Press '/' to search for options"
        echo ""
      - |
        {{.DOCKER}} run --rm -it \
          -v ./build/kernel:/config \
          -w /usr/src/linux \
          -e KCONFIG_CONFIG=/config/config-${KERNEL_VERSION}-${KERNEL_ARCH} \
          -e TERM=${TERM:-xterm-256color} \
          spinbox-menuconfig \
          bash -c "make ARCH=${KERNEL_ARCH} menuconfig && cp .config /config/config-${KERNEL_VERSION}-${KERNEL_ARCH}"

  # ==========================================================================
  # Validation Tasks
  # ==========================================================================

  validate:
    desc: Run all validation checks
    cmds:
      - task: lint
      - task: verify:vendor

  lint:
    desc: Lint code
    cmds:
      - |
        set -eou pipefail
        echo "🔍 Running golangci-lint with config: .golangci.yml"
        GOOS=linux golangci-lint run --config .golangci.yml ./...
        echo "✓ Linting passed"

  integration:
    desc: Build release tarball and run containerd integration test
    vars:
      VERSION: '{{.VERSION | default "ci"}}'
      INTEGRATION_IMAGE: '{{.INTEGRATION_IMAGE | default "ghcr.io/spin-stack/spinbox/sandbox:latest"}}'
      INTEGRATION_RUNTIME: '{{.INTEGRATION_RUNTIME | default "io.containerd.spinbox.v1"}}'
      INTEGRATION_SNAPSHOTTER: '{{.INTEGRATION_SNAPSHOTTER | default "spin-erofs"}}'
    cmds:
      - task: release
        vars:
          VERSION: "{{.VERSION}}"
      - |
        set -eou pipefail
        VERSION="{{.VERSION}}"
        RELEASE_NAME="spinbox-${VERSION}-linux-x86_64"
        TARBALL="{{.OUTPUT_DIR}}/release/${RELEASE_NAME}.tar.gz"

        if [ ! -f "${TARBALL}" ]; then
          echo "👹 Error: release tarball not found: ${TARBALL}"
          exit 1
        fi

        WORKDIR="$(mktemp -d)"
        trap 'rm -rf "${WORKDIR}"' EXIT

        echo "📦 Verifying QEMU firmware in build output..."
        if [ -d "{{.OUTPUT_DIR}}/share/spin-stack/qemu" ]; then
          ls -la "{{.OUTPUT_DIR}}/share/spin-stack/qemu"
        else
          echo "👹 Error: {{.OUTPUT_DIR}}/share/spin-stack/qemu not found"
          exit 1
        fi

        TARBALL_LIST="${WORKDIR}/tar.list"
        if ! tar -tzf "${TARBALL}" > "${TARBALL_LIST}"; then
          echo "👹 Error: failed to read tarball contents"
          exit 1
        fi

        if ! grep -q "usr/share/spin-stack/qemu/bios-256k.bin" "${TARBALL_LIST}"; then
          echo "👹 Error: bios-256k.bin missing from release tarball"
          grep "usr/share/spin-stack/qemu" "${TARBALL_LIST}" || true
          exit 1
        fi

        tar -xzf "${TARBALL}" -C "${WORKDIR}"

        SUDO="${SUDO:-sudo}"
        ${SUDO} systemctl stop spinbox || true
        ${SUDO} systemctl stop spinbox-buildkit || true
        ${SUDO} systemctl stop spinbox-erofs-snapshotter.service || true
        ${SUDO} "${WORKDIR}/${RELEASE_NAME}/install.sh"
        ${SUDO} systemctl enable --now spinbox
        ${SUDO} systemctl reset-failed spinbox || true
        ${SUDO} systemctl enable --now spinbox-erofs-snapshotter.service
        ${SUDO} systemctl reset-failed spinbox-erofs-snapshotter.service || true

        if [ ! -e /dev/vsock ]; then
          echo "👹 Error: /dev/vsock not found"
          ${SUDO} lsmod | grep vhost_vsock || true
          exit 1
        fi

        echo "✓ /dev/vsock present"
        ${SUDO} lsmod | grep vhost_vsock || true

        SOCKET="/var/run/spin-stack/containerd.sock"

        for _ in $(seq 1 30); do
          if [ -S "${SOCKET}" ]; then
            break
          fi
          sleep 1
        done

        if [ ! -S "${SOCKET}" ]; then
          echo "👹 Error: containerd socket not ready"
          ${SUDO} systemctl status spinbox || true
          exit 1
        fi

        CTR_BIN="/usr/share/spin-stack/bin/ctr"
        CTR_NAMESPACE="spinbox-ci"
        CTR_ID="qbx-ci-$(date +%s)"

        ${SUDO} "${CTR_BIN}" \
          --address "${SOCKET}" \
          --namespace "${CTR_NAMESPACE}" \
          images pull \
          --snapshotter "{{.INTEGRATION_SNAPSHOTTER}}" \
          "{{.INTEGRATION_IMAGE}}"

        cleanup_ctr() {
          # Kill the task
          ${SUDO} "${CTR_BIN}" --address "${SOCKET}" --namespace "${CTR_NAMESPACE}" tasks kill --signal SIGKILL "${CTR_ID}" >/dev/null 2>&1 || true
          # Wait for task to stop (max 10 seconds)
          for _ in $(seq 1 10); do
            TASK_STATUS=$(${SUDO} "${CTR_BIN}" --address "${SOCKET}" --namespace "${CTR_NAMESPACE}" tasks list 2>/dev/null | awk -v id="${CTR_ID}" 'NR>1 && $1==id {print $3}')
            if [ -z "${TASK_STATUS}" ] || [ "${TASK_STATUS}" = "STOPPED" ]; then
              break
            fi
            sleep 1
          done
          ${SUDO} "${CTR_BIN}" --address "${SOCKET}" --namespace "${CTR_NAMESPACE}" tasks delete "${CTR_ID}" >/dev/null 2>&1 || true
          ${SUDO} "${CTR_BIN}" --address "${SOCKET}" --namespace "${CTR_NAMESPACE}" containers delete "${CTR_ID}" >/dev/null 2>&1 || true
        }
        trap 'cleanup_ctr' EXIT

        ${SUDO} "${CTR_BIN}" \
          --address "${SOCKET}" \
          --namespace "${CTR_NAMESPACE}" \
          containers create --privileged \
          --snapshotter "{{.INTEGRATION_SNAPSHOTTER}}" \
          --runtime "{{.INTEGRATION_RUNTIME}}" \
          "{{.INTEGRATION_IMAGE}}" \
          "${CTR_ID}" \
          /sbin/init

        ${SUDO} "${CTR_BIN}" \
          --address "${SOCKET}" \
          --namespace "${CTR_NAMESPACE}" \
          tasks start --detach \
          "${CTR_ID}"

        STATUS=""
        for _ in $(seq 1 30); do
          STATUS=$(${SUDO} "${CTR_BIN}" --address "${SOCKET}" --namespace "${CTR_NAMESPACE}" tasks list 2>/dev/null | awk -v id="${CTR_ID}" 'NR>1 && $1==id {print $3}')
          if [ "${STATUS}" = "RUNNING" ]; then
            break
          fi
          sleep 1
        done

        if [ "${STATUS}" != "RUNNING" ]; then
          echo "👹 Error: task did not reach RUNNING state (status=${STATUS:-unknown})"
          ${SUDO} "${CTR_BIN}" --address "${SOCKET}" --namespace "${CTR_NAMESPACE}" tasks info "${CTR_ID}" || true
          ${SUDO} "${CTR_BIN}" --address "${SOCKET}" --namespace "${CTR_NAMESPACE}" tasks list || true
          echo "---- spinbox logs ----"
          ${SUDO} journalctl -u spinbox --no-pager -n 200 || true
          echo "---- spinbox qemu.log (latest) ----"
          QEMU_LOG=$(ls -1t /var/log/spin-stack/*/qemu.log 2>/dev/null | head -n 1 || true)
          if [ -n "${QEMU_LOG:-}" ]; then
            ${SUDO} tail -n 200 "${QEMU_LOG}" || true
          else
            echo "No qemu.log found under /var/log/spin-stack/"
          fi
          echo "---- spinbox console.log (latest) ----"
          CONSOLE_LOG=$(ls -1t /var/log/spin-stack/*/console.log 2>/dev/null | head -n 1 || true)
          if [ -n "${CONSOLE_LOG:-}" ]; then
            ${SUDO} tail -n 200 "${CONSOLE_LOG}" || true
          else
            echo "No console.log found under /var/log/spin-stack/"
          fi
          exit 1
        fi

        cleanup_ctr
        trap - EXIT

        TEST_ID="qbx-ci-$(date +%s)"
        ${SUDO} env \
          PATH="${PATH}" \
          SPINBOX_CONTAINERD_SOCKET="${SOCKET}" \
          SPINBOX_IMAGE="{{.INTEGRATION_IMAGE}}" \
          SPINBOX_RUNTIME="{{.INTEGRATION_RUNTIME}}" \
          SPINBOX_SNAPSHOTTER="{{.INTEGRATION_SNAPSHOTTER}}" \
          SPINBOX_FIFO_DIR="/run/spin-stack/containerd/fifo" \
          SPINBOX_TEST_ID="${TEST_ID}" \
          go test -v -tags=integration -count=1 ./integration -test.v || {
            echo "---- spinbox logs for ${TEST_ID} ----"
            ${SUDO} journalctl -u spinbox --no-pager -n 200 | grep "${TEST_ID}" || true
            echo "---- spinbox logs ----"
            ${SUDO} journalctl -u spinbox --no-pager -n 200 || true
            echo "---- spinbox qemu.log (latest) ----"
            QEMU_LOG=$(ls -1t /var/log/spin-stack/*/qemu.log 2>/dev/null | head -n 1 || true)
            if [ -n "${QEMU_LOG:-}" ]; then
              ${SUDO} tail -n 200 "${QEMU_LOG}" || true
            else
              echo "No qemu.log found under /var/log/spin-stack/"
            fi
            echo "---- spinbox console.log (latest) ----"
            CONSOLE_LOG=$(ls -1t /var/log/spin-stack/*/console.log 2>/dev/null | head -n 1 || true)
            if [ -n "${CONSOLE_LOG:-}" ]; then
              ${SUDO} tail -n 200 "${CONSOLE_LOG}" || true
            else
              echo "No console.log found under /var/log/spin-stack/"
            fi
            exit 1
          }

        if [ "${CLEANUP:-0}" = "1" ]; then
          ${SUDO} systemctl stop spinbox || true
          ${SUDO} systemctl stop spinbox-erofs-snapshotter.service || true
          ${SUDO} "${WORKDIR}/${RELEASE_NAME}/uninstall.sh" || true
        fi

  # ==========================================================================
  # Setup and Tool Installation
  # ==========================================================================

  setup:
    desc: Install all required development tools
    cmds:
      - |
        set -eou pipefail
        {{.SCRIPTS_DIR}}/setup

  setup:cache:
    desc: Setup BuildKit cache directory with proper permissions
    cmds:
      - |
        set -eou pipefail
        {{.SCRIPTS_DIR}}/setup-buildkit-cache

  # ==========================================================================
  # Protobuf Tasks (optional)
  # ==========================================================================

  protos:
    desc: Generate protobuf files
    sources:
      - api/**/*.proto
      - go.mod
      - go.sum
    generates:
      - api/**/*.pb.go
    cmds:
      - |
        set -eou pipefail
        echo "🐳 Generating protobufs..."

        # protobuild requires GOPATH mode - ensure symlinks exist
        MODULE_PATH=$(grep '^module ' go.mod | awk '{print $2}')
        GOPATH_DIR="${HOME}/go/src/${MODULE_PATH}"

        if [ ! -d "${GOPATH_DIR}" ]; then
          echo "  → Creating GOPATH symlink for protobuild..."
          mkdir -p "$(dirname "${GOPATH_DIR}")"
          ln -sfn "$(pwd)" "${GOPATH_DIR}"
          echo "    ✓ Symlink created: ${GOPATH_DIR} -> $(pwd)"
        fi

        # Create symlink for containerd/api dependency (needed for proto imports)
        CONTAINERD_API_DIR="${HOME}/go/src/github.com/containerd/containerd/api"
        if [ ! -d "${CONTAINERD_API_DIR}" ]; then
          echo "  → Creating containerd/api symlink for proto imports..."
          CONTAINERD_API_MOD=$(go list -m -f '{{.Dir}}' github.com/containerd/containerd/api)
          mkdir -p "$(dirname "${CONTAINERD_API_DIR}")"
          ln -sfn "${CONTAINERD_API_MOD}" "${CONTAINERD_API_DIR}"
          echo "    ✓ Symlink created: ${CONTAINERD_API_DIR}"
        fi

        # Save original directory
        ORIGINAL_DIR="$(pwd)"

        # Run protobuild from GOPATH location (required for correct import paths)
        # Note: We must run in a subshell with PWD set to prevent symlink resolution
        (
          cd "${GOPATH_DIR}/api"
          export PATH="${GOPATH_DIR}/bin:${HOME}/go/bin:${PATH}"
          export PWD="${GOPATH_DIR}/api"

          # Run protobuild - it should use GOPATH paths
          protobuild --quiet ${MODULE_PATH}/api/...
        )

        # Fix Go acronyms in generated files
        go-fix-acronym -w -a '^Os' $(find api/ -name '*.pb.go')
        go-fix-acronym -w -a '(Id|Io|Uuid|Os)$$' $(find api/ -name '*.pb.go')

        echo "✓ Protobufs generated"

  check:protos:
    desc: Check if protobufs need regeneration
    cmds:
      - task: protos
      - |
        set -eou pipefail
        echo "🐳 Checking protobuf changes..."
        if [ -n "$(git status --short | grep '.pb.go')" ]; then
          echo "👹 Error: Protobuf files are out of date"
          echo "   Run 'task protos' to regenerate"
          exit 1
        fi
        echo "✓ Protobufs are up to date"

  # ==========================================================================
  # Cleanup Tasks
  # ==========================================================================

  clean:
    desc: Clean build artifacts
    cmds:
      - |
        set -eou pipefail
        echo "🧹 Cleaning build artifacts..."
        rm -rf {{.OUTPUT_DIR}}
        echo "✓ Clean complete"

  # ==========================================================================
  # Utility Tasks
  # ==========================================================================

  setup:buildx:
    desc: Setup Docker Buildx builder for spinbox
    cmds:
      - |
        set -eou pipefail
        BUILDER_NAME="spinbox-builder"

        if docker buildx inspect "${BUILDER_NAME}" &>/dev/null; then
          echo "✓ Builder '${BUILDER_NAME}' already exists"
          docker buildx use "${BUILDER_NAME}"
        else
          echo "→ Creating builder '${BUILDER_NAME}'..."
          docker buildx create \
            --name "${BUILDER_NAME}" \
            --driver docker-container \
            --driver-opt network=host \
            --driver-opt image=moby/buildkit:latest \
            --buildkitd-flags '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host' \
            --use
          docker buildx inspect --bootstrap
          echo "✓ Builder '${BUILDER_NAME}' created and active"
        fi

  verify:vendor:
    desc: Verify go.mod/go.sum are up to date
    cmds:
      - |
        set -eou pipefail
        echo "🐳 Verifying vendor files..."
        TMPDIR=$(mktemp -d)
        trap "rm -rf $TMPDIR" EXIT

        cp -R . $TMPDIR/spinbox
        cd $TMPDIR/spinbox
        {{.GO}} mod tidy
        {{.GO}} mod verify

        if ! diff -u go.mod "{{.ROOT_DIR}}/go.mod"; then
          echo "👹 Error: go.mod is out of date"
          echo "   Run 'go mod tidy' to update"
          exit 1
        fi

        if ! diff -u go.sum "{{.ROOT_DIR}}/go.sum"; then
          echo "👹 Error: go.sum is out of date"
          echo "   Run 'go mod tidy' to update"
          exit 1
        fi

        echo "✓ Vendor files are up to date"

  # ==========================================================================
  # All-in-one Tasks
  # ==========================================================================

  all:
    desc: Build and validate everything
    cmds:
      - task: build
      - task: validate
      - cmd: echo "✓ All tasks complete"

  default:
    desc: Default task (build everything)
    cmds:
      - task: build

  # ==========================================================================
  # Release Tasks
  # ==========================================================================

  release:
    desc: Create release tarball
    vars:
      VERSION:
        sh: echo "${VERSION:-$(git describe --tags --exact-match 2>/dev/null || git rev-parse --short HEAD 2>/dev/null || echo dev)}"
    cmds:
      - task: build
      - |
        set -eou pipefail
        VERSION="{{.VERSION}}" {{.SCRIPTS_DIR}}/release

  release:image:
    desc: Build and push sandbox image to GitHub Container Registry
    vars:
      VERSION:
        sh: echo "${VERSION:-$(git describe --tags --exact-match 2>/dev/null || git rev-parse --short HEAD 2>/dev/null || echo dev)}"
      GITHUB_REPOSITORY: '{{.GITHUB_REPOSITORY | default "spin-stack/spinbox"}}'
      IMAGE: 'ghcr.io/{{.GITHUB_REPOSITORY}}/sandbox'
    cmds:
      - |
        set -eou pipefail
        echo "Building {{.IMAGE}}:{{.VERSION}}"
        {{.DOCKER}} build --platform linux/amd64 \
          --label "org.opencontainers.image.version={{.VERSION}}" \
          --label "org.opencontainers.image.source=https://github.com/{{.GITHUB_REPOSITORY}}" \
          --label "org.opencontainers.image.description=Sandbox image for spinbox" \
          -t {{.IMAGE}}:{{.VERSION}} \
          images/sandbox
      - |
        set -eou pipefail
        echo "Tagging {{.IMAGE}}:{{.VERSION}} as latest"
        {{.DOCKER}} tag {{.IMAGE}}:{{.VERSION}} {{.IMAGE}}:latest
      - |
        set -eou pipefail
        echo "Pushing {{.IMAGE}}:{{.VERSION}}"
        {{.DOCKER}} push {{.IMAGE}}:{{.VERSION}}
        {{.DOCKER}} push {{.IMAGE}}:latest
        echo ""
        echo "Released:"
        echo "  {{.IMAGE}}:{{.VERSION}}"
        echo "  {{.IMAGE}}:latest"