Taskfile.yaml

version: "3"

vars:
  IMAGE: wekai
  TAG: '{{.TAG | default "dev"}}'
  REPLAY_IMAGE: '{{.REPLAY_IMAGE | default "quay.io/weka.io/wekai:replay-40d-oct14-337a03810637"}}'
  REGISTRY: '{{.REGISTRY | default "quay.io/weka.io/wekai"}}'
  REPLAY_REGISTRY: '{{.REPLAY_REGISTRY | default "quay.io/weka.io/wekai"}}'
  HELM_REGISTRY: '{{.HELM_REGISTRY | default "quay.io/weka.io/helm"}}'
  BINARY: wekai
  ROUTER_REGISTRY: '{{.ROUTER_REGISTRY | default "quay.io/weka.io/wekai-router"}}'
  # First-party Go source. vendor/ is excluded deliberately: it is generated,
  # not committed, and gofmt has no business rewriting it.
  GO_DIRS: "benchmark chart cli config kvcache llm router tools"

tasks:
  build:
    desc: "Build the wekai binary locally (module github.com/weka/wekai)"
    cmds:
      - go build -o wekai .

  # --- Developer and CI contract. `task verify` is the single definition of
  # "this is good"; ci.yml runs it. These were a separate Makefile, which meant
  # two build vocabularies for one repo.

  help:
    desc: "List available tasks"
    cmds:
      - task --list

  fmt:
    desc: "Format first-party Go source in place"
    cmds:
      - gofmt -l -w {{.GO_DIRS}} *.go

  fmt-check:
    desc: "Fail if any first-party Go file is not gofmt'd"
    cmds:
      # vendor/ is excluded deliberately: it is generated, not committed, and
      # gofmt has no business rewriting it.
      - |
        out=$(gofmt -l {{.GO_DIRS}} *.go)
        if [ -n "$out" ]; then echo "not gofmt'd:"; echo "$out"; exit 1; fi

  vet:
    desc: "go vet the whole module"
    cmds:
      - go vet ./...

  test:
    desc: "Run the test suite (matches what release.yml gates on)"
    cmds:
      - go test ./...

  test:race:
    desc: "Run the test suite with the race detector"
    cmds:
      - go test -race ./...

  fences:
    desc: "Run only the router's architectural invariant fences"
    cmds:
      - go test ./router/hack/... -v

  verify:
    desc: "Everything CI gates on: gofmt, vet, and the suite under -race"
    cmds:
      - task: fmt-check
      - task: vet
      - task: test:race

  test:live:
    desc: "Live tests against real hosted providers (needs OPENAI_API_KEY / ANTHROPIC_API_KEY / GEMINI_API_KEY)"
    cmds:
      # Kept out of `verify` on purpose: these call third-party APIs, so they
      # are neither hermetic nor deterministic. Each pool skips if its key is
      # absent. Only /models is called, never a completion.
      - WEKAI_LIVE=1 go test ./router/serve/ -run 'RealHosted|Hosted' -count=1 -v

  perf:k8s:
    desc: "Measure the router's own throughput ceiling in k3d: 8 zero-latency backends, load stepped until it plateaus"
    cmds:
      # Everything downstream is neutralised, so the plateau is the ROUTER's.
      # Override with STEPS, STEP_DURATION, SESSIONS, PREFIX_TOKENS, ROUTER_CPU;
      # KEEP=1 leaves the cluster up for poking at.
      - bash hack/k8s-perf/run.sh

  fuzz:
    desc: "Fuzz the router's JSON scanner, which parses untrusted request bodies (FUZZTIME=60s)"
    vars:
      FUZZTIME: '{{.FUZZTIME | default "60s"}}'
    cmds:
      # A differential fuzz against encoding/json, plus a termination property.
      # The seed corpus already caught a remote DoS: a 15-byte body that looped
      # forever with unbounded allocation.
      - go test ./router/internal/jsonscan/ -run=NONE -fuzz=FuzzFieldsAgreesWithEncodingJSON -fuzztime={{.FUZZTIME}}
      - go test ./router/internal/jsonscan/ -run=NONE -fuzz=FuzzArrayTerminates -fuzztime={{.FUZZTIME}}

  bench:
    desc: "Run benchmarks"
    cmds:
      - go test -run=NONE -bench=. -benchmem ./kvcache/ ./router/...

  vulncheck:
    desc: "Scan dependencies for known vulnerabilities"
    cmds:
      - go run golang.org/x/vuln/cmd/govulncheck@latest ./...

  router:run:
    desc: "Run the router locally against a backend at :8000"
    cmds:
      - go run . router serve --listen 127.0.0.1:8080 --metrics-listen 127.0.0.1:29000
        --backends http://127.0.0.1:8000 --log-format text

  clean:
    desc: "Remove build artifacts"
    cmds:
      - rm -f {{.BINARY}}
      - rm -rf dist

  # Three router build paths, in increasing order of what they need:
  #
  #   router:image   plain docker build. No Dagger. Use when Dagger cannot run.
  #   router:build   image + packaged chart via the release's OWN code, no push,
  #                  no credentials. Needs a working Dagger engine.
  #   router:push    the release itself: publishes image and chart. Credentials.
  #
  # Chart TEMPLATE correctness needs none of them — `go test ./chart/` renders
  # and asserts with helm alone.

  e2e:k8s:
    desc: "End-to-end test in a throwaway k3d cluster: builds both images, side-loads them (no registry), helm installs chart/router against a mock vLLM fleet, and asserts the pod passes its own probes and routes a request. KEEP=1 to leave the cluster up."
    cmds:
      - ./hack/k8s-e2e/run.sh

  router:image:
    desc: "Build the router image with plain docker build (no Dagger). TAG=... to override."
    cmds:
      - docker build -f Dockerfile.router -t {{.ROUTER_REGISTRY}}:{{.TAG}} .

  router:build:
    desc: "Build the router image and package chart/router locally — no push, no credentials (dagger call build-router). Runs the SAME packaging a release does, so a chart checked here cannot differ from the published one."
    cmds:
      - dagger call build-router --source=. export --path=./dist

  router:push:
    desc: "Publish the router image, then package+push chart/router pinned to it (dagger call push-router-helm). Override ROUTER_REGISTRY=... and HELM_REGISTRY=... as needed."
    cmds:
      - >-
        dagger call push-router-helm
        --source=.
        --registry="{{.ROUTER_REGISTRY}}"
        --helm-registry="{{.HELM_REGISTRY}}"
        --helm-username=env://QUAY_USERNAME
        --helm-password=env://QUAY_PASSWORD

  docker:build:
    desc: "Build the wekai replay image locally (no push). Override TAG=... and REPLAY_IMAGE=... as needed."
    cmds:
      - >-
        docker build
        --build-arg REPLAY_IMAGE={{.REPLAY_IMAGE}}
        -t {{.IMAGE}}:{{.TAG}}
        .

  replay:push:
    desc: "Push a replay JSONL as a layer image (tag replay-<hash>, or replay-<LABEL>-<hash> with LABEL=40d-oct14) into the wekai quay repo (dagger call push-replay). Override REPLAY_REGISTRY=... as needed."
    requires:
      vars: [REPLAY]
    cmds:
      - >-
        dagger call push-replay
        --replay="{{.REPLAY}}"
        --registry="{{.REPLAY_REGISTRY}}"
        {{if .LABEL}}--label="{{.LABEL}}"{{end}}

  app:push:
    desc: "Build (from this repo's Dockerfile) and publish the wekai image (dagger call publish). Override REGISTRY=... and REPLAY_IMAGE=... as needed."
    cmds:
      - >-
        dagger call publish
        --source=.
        --registry="{{.REGISTRY}}"
        --replay-image="{{.REPLAY_IMAGE}}"

  helm:push:
    desc: "Publish the wekai image, then package+push chart/wekai pinned to it (dagger call push-helm). Override REGISTRY=..., HELM_REGISTRY=..., and REPLAY_IMAGE=... as needed."
    cmds:
      - >-
        dagger call push-helm
        --source=.
        --registry="{{.REGISTRY}}"
        --replay-image="{{.REPLAY_IMAGE}}"
        --helm-registry="{{.HELM_REGISTRY}}"
        --helm-username=env://QUAY_USERNAME
        --helm-password=env://QUAY_PASSWORD