Taskfile.yml

# Taskfile for agent-uri repository
# https://taskfile.dev

version: '3'

vars:
  RESULTS_DIR: results

tasks:
  default:
    desc: Show available tasks
    cmds:
      - task --list

  # Evaluation tasks
  eval-expressiveness:
    desc: Run capability expressiveness evaluation (Eval 1)
    cmds:
      - mkdir -p {{.RESULTS_DIR}}
      - cargo run --release --package agent-uri-eval --example run_expressiveness

  eval-discovery:
    desc: Run discovery precision evaluation (Eval 2)
    cmds:
      - mkdir -p {{.RESULTS_DIR}}
      - cargo run --release --package agent-uri-eval --example run_discovery

  eval-scalability:
    desc: Run scalability microbenchmarks (Eval 5)
    cmds:
      - mkdir -p {{.RESULTS_DIR}}
      - cargo bench --workspace 2>&1 | tee {{.RESULTS_DIR}}/eval5_scalability.txt

  eval-all:
    desc: Run all evaluations
    cmds:
      - task: eval-expressiveness
      - task: eval-discovery
      - task: eval-scalability

  # Benchmark tasks
  bench:
    desc: Run all Criterion benchmarks
    cmds:
      - cargo bench --workspace

  # Formal verification
  kani:
    desc: Run Kani formal proofs
    cmds:
      # Kani is a tool, not a dependency: the harnesses are gated on
      # `#[cfg(kani)]`, which only `cargo kani` sets, and it supplies the `kani`
      # crate itself. Install it once with:
      #   cargo install --locked kani-verifier && cargo kani setup
      #
      # Only the two crates that carry harnesses; the CI `kani` job runs the
      # same set weekly.
      - cargo kani -p agent-uri -p agent-uri-attestation

  # Fuzzing
  #
  # libFuzzer writes what it finds to the *first* corpus directory it is given,
  # so the working corpus (gitignored) is named first and the checked-in seeds
  # second, where they are read and never written.
  fuzz:
    desc: Fuzz every parser entry point and the verifier for a minute each (needs nightly + cargo-fuzz)
    cmds:
      - task: fuzz-parsers
      - task: fuzz-verifier

  fuzz-parsers:
    desc: Fuzz every parser entry point for a minute each
    dir: agent-uri
    cmds:
      - for target in parse_uri parse_trust_root parse_query parse_fragment parse_agent_id; do cargo +nightly fuzz run "$target" "fuzz/corpus/$target" "fuzz/seeds/$target" -- -max_total_time=60 -rss_limit_mb=4096 || exit 1; done

  fuzz-verifier:
    desc: Fuzz the attestation verifier for a minute per target
    dir: agent-uri-attestation
    cmds:
      - for target in verify_token verify_signed_claims; do cargo +nightly fuzz run "$target" "fuzz/corpus/$target" "fuzz/seeds/$target" -- -max_total_time=60 -rss_limit_mb=4096 || exit 1; done

  fuzz-build:
    desc: Build the fuzz targets without running them
    cmds:
      - cargo +nightly fuzz build --fuzz-dir agent-uri/fuzz
      - cargo +nightly fuzz build --fuzz-dir agent-uri-attestation/fuzz

  # Memory safety checks
  miri:
    desc: Run Miri memory safety checks
    cmds:
      # Scoped to the crates whose tests are pure computation. The DHT, libp2p,
      # and CLI suites test against tokio, real sockets, and the filesystem,
      # none of which Miri can execute.
      #
      # Isolation is off because the attestation tests read the clock. That
      # weakens none of the undefined-behaviour checks this is run for.
      # The CI `miri` job runs the same command weekly.
      - MIRIFLAGS=-Zmiri-disable-isolation cargo +nightly miri test -p agent-uri -p agent-uri-attestation --lib

  # Development tasks
  check:
    desc: Run cargo check on all packages
    cmds:
      - cargo check --workspace --all-targets

  test:
    desc: Run all tests
    cmds:
      - cargo nextest run --workspace

  clippy:
    desc: Run clippy with warnings as errors
    cmds:
      - cargo clippy --workspace --all-targets -- -D warnings

  fmt:
    desc: Format all code
    cmds:
      - cargo fmt --all

  fmt-check:
    desc: Check formatting without making changes
    cmds:
      - cargo fmt --all -- --check

  msrv:
    desc: Build on the oldest toolchain the workspace claims to support
    cmds:
      # Reads the version from the manifest so there is one place to change it.
      # Builds rather than tests: the MSRV is a promise about compiling this
      # workspace's code, and the dev-dependencies have higher floors of their
      # own that no consumer inherits.
      - |
        version=$(grep -m1 -oE '^rust-version = "[0-9]+(\.[0-9]+){1,2}"' Cargo.toml \
          | grep -oE '[0-9]+(\.[0-9]+){1,2}')
        rustup toolchain install "$version" --profile minimal
        cargo "+$version" build --workspace --all-features

  deny:
    desc: Run cargo-deny checks (advisories, licenses, bans, sources)
    cmds:
      - cargo deny check

  audit:
    desc: Run cargo-audit against the RustSec advisory database
    cmds:
      - cargo audit

  security:
    desc: Run all supply-chain checks (cargo-deny + cargo-audit)
    cmds:
      - task: deny
      - task: audit

  # CI tasks
  ci:
    desc: Run all CI checks (fmt, clippy, test)
    cmds:
      - task: fmt-check
      - task: clippy
      - task: test

  # Clean tasks
  clean:
    desc: Clean build artifacts
    cmds:
      - cargo clean

  clean-results:
    desc: Clean evaluation results
    cmds:
      - rm -rf {{.RESULTS_DIR}}