tasks.toml

# grouped tasks

["setup"]
depends = ["*:setup"]

["check"]
depends = ["*:check"]

["fix"]
depends = ["*:fix"]

["test"]
depends = ["*:test"]

# git hooks

["git-hooks:pre-commit"]
hide = true
depends = ["check"]

["git-hooks:commit-msg"]
hide = true
dir = "{{config_root}}"
usage = 'arg "<commit_msg_file>"'
run = '''
#!/usr/bin/env bash
set -euo pipefail

COMMIT_MSG_FILE="{{arg(name="commit_msg_file")}}"
TEMP_FILE=$(mktemp)
trap 'rm -f "$TEMP_FILE"' EXIT

HAS_AI_TRAILER=false
if grep -qi -E '^Co-authored-by:.*(Claude|Cursor|anthropic|cursor)' "$COMMIT_MSG_FILE"; then
  HAS_AI_TRAILER=true
fi

grep -viE -e '^Co-authored-by:.*(Claude|Cursor|anthropic|cursor)' -e '^Made-with:' "$COMMIT_MSG_FILE" > "$TEMP_FILE" || true

awk '/^[[:space:]]*$/{buf=buf $0 ORS; next} {if(buf) printf "%s",buf; buf=""; print}' "$TEMP_FILE" > "$COMMIT_MSG_FILE"

if [ "$HAS_AI_TRAILER" = true ]; then
  echo "" >> "$COMMIT_MSG_FILE"
  echo "Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>" >> "$COMMIT_MSG_FILE"
fi
'''

# common tasks

## setup

["common:setup"]
depends = ["common:setup:*"]

["common:setup:git-hooks"]
hide = true
dir = "{{config_root}}"
run = """
#!/bin/bash
test ! -d .git && exit 0
cat >.git/hooks/pre-commit <<'HOOK'
#!/bin/sh
{{ mise_bin }} run git-hooks:pre-commit
HOOK
chmod +x .git/hooks/pre-commit
cat >.git/hooks/commit-msg <<'HOOK'
#!/bin/sh
{{ mise_bin }} run git-hooks:commit-msg -- "$1"
HOOK
chmod +x .git/hooks/commit-msg
"""
sources = [".git/hooks/pre-commit", ".git/hooks/commit-msg"]
outputs = { auto = true }

["common:setup:pnpm"]
hide = true
dir = "{{config_root}}"
run = "pnpm install"
sources = [
  "pnpm-lock.yaml",
  "pnpm-workspace.yaml",
  "apps/*/package.json",
  "docs/package.json",
  "agents/*/*/package.json",
]
outputs = { auto = true }

## check

["common:check"]
depends = ["common:check:*"]

["common:check:license"]
dir = "{{config_root}}"
run = "addlicense -check -l apache -s=only -c '© BeeAI a Series of LF Projects, LLC' $(fd '\\.(py|[jt]sx?|html|s?css)$')"

["common:check:version"]
dir = "{{config_root}}"
run = '''
#!/usr/bin/env bash
set -euo pipefail
version=$(
  {
    yq -r .version              helm/Chart.yaml
    yq -r .appVersion           helm/Chart.yaml
    yq -r .project.version      apps/agentstack-cli/pyproject.toml
    yq -r .project.version      apps/agentstack-sdk-py/pyproject.toml
    yq -r .version              apps/agentstack-sdk-ts/package.json
    yq -r .project.version      apps/agentstack-server/pyproject.toml
    yq -r .version              apps/agentstack-ui/package.json
    yq -r .version              apps/beeai-web/package.json
    yq -r '.providers[].location | split(":")[-1]' agent-registry.yaml
  } | sort -u
)
if [[ $(wc -l <<<"$version") -ne 1 ]]; then echo "ERROR: Version mismatch detected: $(echo $version)" >&2; exit 1; fi
if ! [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$ ]]; then echo "ERROR: $version is not valid semver (X.Y.Z or X.Y.Z-rcN)" >&2; exit 1; fi
if [[ "${GITHUB_REF:-}" == refs/tags/* ]] && [[ $GITHUB_REF != "refs/tags/v$version" ]]; then echo "ERROR: GITHUB_REF '$GITHUB_REF' does not match 'refs/tags/v$version'" >&2; exit 1; fi
'''

## fix

["common:fix"]
depends = ["common:fix:*"]

["common:fix:license"]
dir = "{{config_root}}"
run = "addlicense -l apache -s=only -c '© BeeAI a Series of LF Projects, LLC' $(fd '\\.(py|[jt]sx?|html|s?css)$')"

## test

["common:test"]
run = "true" # Empty tests in case there are no tests

# platform tasks

["agentstack:start"]
depends = [
  "agentstack-server:build",
  "supergateway:build",
  "keycloak-theme:build",
  "microshift-vm:build:qemu",
]
raw = true
dir = "{{config_root}}"
run = """
#!/bin/bash
set -euxo pipefail

if [[ "$*" != *"--set externalRegistry="* ]]; then
  latest_tag=$(git ls-remote --tags $(git remote get-url origin) 'v*' | grep -o 'refs/tags/v[0-9]*\\.[0-9]*\\.[0-9]*$' | sed 's|refs/tags/||' | sort -V | tail -n 1)
  export AGENTSTACK__AGENT_REGISTRY="https://github.com/i-am-bee/agentstack@$latest_tag#path=agent-registry.yaml"
  echo "Using agents from: $AGENTSTACK__AGENT_REGISTRY\n  use --set externalRegistry=<null|github-url> to override this."
fi

if [[ ! "$*" =~ 'ui.enabled=false' ]]; then
    {{ mise_bin }} run agentstack-ui:build
    UI_TAG="--set ui.image.tag=local"
fi

if [[ -n "${CI-}" ]]; then
  PULL_MODE="hybrid"
elif [[ -n "${SKIP_PULL-}" ]]; then
  PULL_MODE="skip"
else
  PULL_MODE="host"
fi

ARCH=$(uname -m | sed -e 's/arm64/aarch64/' -e 's/amd64/x86_64/')
{{ mise_bin }} run agentstack-cli:run -- platform start -v \
    --lima-image={{config_root}}/apps/microshift-vm/dist/$ARCH/microshift-vm-$ARCH.qcow2 \
    --image-pull-mode="$PULL_MODE" \
    --set auth.nextauthDevUrl="http://localhost:3000" \
    --set image.tag=local \
    --set keycloak.image.tag=local \
    ${UI_TAG-} "$@"
"""

["agentstack:delete"]
run = "{{ mise_bin }} run agentstack-cli:run -- platform delete"

["agentstack:stop"]
run = "{{ mise_bin }} run agentstack-cli:run -- platform stop"

["agentstack:stop-all"]
usage = 'flag "--except <except>" default=""'
run = """
#!/bin/bash
# Stop all lima VMs

EXCEPT="${usage_except?}"

{% raw %}
TO_STOP="$(LIMA_HOME=~/.agentstack/lima limactl list -f '{{.Name}};{{.Status}}' | grep -v "Stopped" | cut -d';' -f1 2>/dev/null | sed '/^[^a-z]*$/d' | sed "/^$EXCEPT$/d")"
{% endraw %}

{% raw %}
echo "$TO_STOP" | xargs -rn 1 -I"{}" mise run agentstack-cli:run -- platform stop --vm-name="{}"
{% endraw %}
"""

["agentstack:shell"]
raw = true
dir = "{{cwd}}"
usage = 'flag "--vm-name <vm_name>" default="agentstack"'
run = """
cat <<EOF
deactivate () {
  export PS1="\\${__OLD_PS1:-}"

  # Restore LIMA_HOME to its original state (set or unset)
  [[ -n "\\${__OLD_LIMA_HOME:-}" ]] && export LIMA_HOME="\\$__OLD_LIMA_HOME" || unset LIMA_HOME
  [[ -n "\\${__OLD_KUBECONFIG:-}" ]] && export KUBECONFIG="\\$__OLD_KUBECONFIG" || unset KUBECONFIG
  [[ -n "\\${__OLD_ADMIN_PASSWORD:-}" ]] && export AGENTSTACK__ADMIN_PASSWORD="\\$__OLD_ADMIN_PASSWORD" || unset AGENTSTACK__ADMIN_PASSWORD

  # Clean up the backup values
  unset __OLD_PS1
  unset __OLD_LIMA_HOME
  unset __OLD_KUBECONFIG
  unset __OLD_ADMIN_PASSWORD
  unset -f deactivate
  echo "Environment for '${usage_vm_name?}' deactivated."
}

while [[ -n "\\${__OLD_PS1:-}" ]]; do
  deactivate;
done

echo "Activating environment for '${usage_vm_name?}'..."

export __OLD_PS1="\\${PS1:-}"
export __OLD_LIMA_HOME="\\${LIMA_HOME:-}"
export __OLD_KUBECONFIG="\\${KUBECONFIG:-}"

export KUBECONFIG="\\${AGENTSTACK__HOME:-\\${HOME}/.agentstack}/lima/${usage_vm_name?}/copied-from-guest/kubeconfig.yaml"
export LIMA_HOME=\\${AGENTSTACK__HOME:-\\${HOME}/.agentstack}/lima
export PS1="(${usage_vm_name?}) \\${__OLD_PS1}"
EOF
"""

# release tasks

["release:set-version"]
description = "Update version fields in the current branch in all the relevant places and commit"
usage = '''
arg "<version>" help="The new version to set (format: X.Y.Z or X.Y.Z-rcW)"
'''
dir = "{{config_root}}"
run = '''
#!/bin/bash
set -eu -o pipefail

if [[ -n "$(git status --porcelain)" ]]; then
  echo "ERROR: Working directory not clean"
  exit 1
fi

if ! [[ "$usage_version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)(-rc[0-9]+)?$ ]]; then
  echo "ERROR: Invalid version format: $usage_version"
  echo "Expected format: X.Y.Z or X.Y.Z-rcW (e.g., 1.2.3 or 1.2.3-rc1)"
  exit 1
fi

set -x
yq -i ".version = \"$usage_version\"" helm/Chart.yaml
yq -i ".appVersion = \"$usage_version\"" helm/Chart.yaml
for pyproject in apps/agentstack-sdk-py/pyproject.toml $(fd -t f -g pyproject.toml apps agents); do
  toml set project.version "$usage_version" --toml-path "$pyproject"
  (cd "$(dirname "$pyproject")" && uv lock)
done
for pkg in $(fd -t f -g package.json apps agents); do
  yq -i ".version = \"$usage_version\"" "$pkg"
done
yq -i ".providers[].location |= sub(\":(.*)\$\"; \":\" + \"$usage_version\")" agent-registry.yaml

changelog="docs/development/reference/changelog.mdx"
if [[ -f "$changelog" ]] && grep -q "^## Unreleased" "$changelog"; then
  today=$(date +%Y-%m-%d)
  perl -pi -e "s/^## Unreleased\$/## $usage_version ($today)/" "$changelog"
fi

git add .
git commit --signoff --no-verify -m "bump: v$usage_version"
set +x

echo -e "✅ Pending version in \x1b[36m$(git branch --show-current)\x1b[0m bumped to $usage_version"
'''

["release:new"]
description = "Open a new release by creating a release branch from current main"
dir = "{{config_root}}"
run = '''
#!/bin/bash
set -eu -o pipefail

if [[ -n "$(git status --porcelain)" ]]; then
  echo "ERROR: Working directory not clean"
  exit 1
fi

set -x
git checkout main
git pull
set +x

current_version=$(yq -r '.version' helm/Chart.yaml)
if ! [[ "$current_version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
  echo "ERROR: Invalid version format: $current_version. Expected format: X.Y.Z"
  exit 1
fi
next_version="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.$((${BASH_REMATCH[3]} + 1))"
release_branch="release-v$current_version"

echo ""
echo "⚠️  What will happen:"
echo -e "  - Nothing will be published yet."
echo -e "  - Tip of the \x1b[36mmain\x1b[0m branch will be prepared for release $current_version in \x1b[36m$release_branch\x1b[0m branch."
echo -e "  - Pending version in \x1b[36m$release_branch\x1b[0m will be bumped to ${current_version}-rc1."
echo -e "  - Pending version in \x1b[36mmain\x1b[0m branch will be bumped to $next_version. (This can be bumped more if the next release needs to be minor/major.)"
echo -e "💡 Want to release a different version than $current_version? Cancel, run \x1b[36mmise release:set-version <version>\x1b[0m on the \x1b[36mmain\x1b[0m branch and then re-run this task."
gum confirm "Proceed?"

set -x
git checkout -B $release_branch origin/main
{{ mise_bin }} release:set-version "${current_version}-rc1"
git push --set-upstream origin $release_branch
set +x
echo -e "✅ \x1b[36m$release_branch\x1b[0m branch with pending version ${current_version}-rc1 created."

set -x
git checkout main
{{ mise_bin }} release:set-version "$next_version"
git push
set +x
echo -e "✅ \x1b[36mmain\x1b[0m pending version bumped to $next_version."

git checkout $release_branch

echo -e "💡 Now you can use \x1b[36mmise release:publish-rc\x1b[0m to publish a release candidate ${current_version}-rc1, or \x1b[36mmise release:publish-stable\x1b[0m to publish stable $current_version."
'''

["release:publish-rc"]
description = "Publish the current release branch as a release candidate"
dir = "{{config_root}}"
run = '''
#!/bin/bash
set -eu -o pipefail

if [[ -n "$(git status --porcelain)" ]]; then
  echo "ERROR: Working directory not clean"
  exit 1
fi

release_branch="$(git branch --show-current)"
if [[ "$release_branch" != "release-v"* ]]; then
  echo "ERROR: Not on a 'release-v*' branch"
  exit 1
fi

set -x
git pull
set +x

current_version=$(yq -r '.version' helm/Chart.yaml)
if ! [[ "$current_version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)-rc([0-9]+)$ ]]; then
  echo "ERROR: Current version must be an RC version (X.Y.Z-rcN)"
  echo "Current version: $current_version"
  exit 1
fi

next_version="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.${BASH_REMATCH[3]}-rc$((${BASH_REMATCH[4]} + 1))"

echo ""
echo "⚠️  What will happen:"
echo -e "  - Tip of the \x1b[36m$release_branch\x1b[0m branch will be tagged \x1b[36mv$current_version\x1b[0m and pushed to GitHub."
echo -e "  - GitHub Action triggered by the tag will publish a release candidate \x1b[36m$current_version\x1b[0m."
echo -e "  - Pending version in \x1b[36m$release_branch\x1b[0m branch will be bumped to \x1b[36m$next_version\x1b[0m."
echo -e "  - \x1b[36minstall.sh\x1b[0m on the \x1b[36mmain\x1b[0m branch will be updated to install \x1b[36m$current_version\x1b[0m when set to prerelease mode."
gum confirm "Proceed?"

set -x
git tag "v$current_version"
git push --atomic origin $release_branch "v$current_version"
set +x
echo -e "✅ Pushed tag $current_version to \x1b[36morigin/$release_branch\x1b[0m"

{{ mise_bin }} release:set-version "$next_version"
git push

set -x
git checkout main
git pull
perl -pi -e "s/^(LATEST_AGENTSTACK_VERSION=).*/\${1}$current_version/" install.sh
git add install.sh
git commit --signoff --no-verify -m "chore: update install.sh prerelease version to v$current_version"
git push
set +x
echo -e "✅ Updated \x1b[36minstall.sh\x1b[0m on \x1b[36mmain\x1b[0m to install $current_version when set to prerelease mode"

git checkout $release_branch

echo -e "💡 Check the pipeline progress and result on: https://github.com/i-am-bee/agentstack/actions/workflows/release.yml"
'''

["release:publish-stable"]
description = "Publish the current release branch as a stable release"
dir = "{{config_root}}"
run = '''
#!/bin/bash
set -eu -o pipefail

if [[ -n "$(git status --porcelain)" ]]; then
  echo "ERROR: Working directory not clean"
  exit 1
fi

release_branch="$(git branch --show-current)"
if [[ "$release_branch" != "release-v"* ]]; then
  echo "ERROR: Not on a 'release-v*' branch"
  exit 1
fi

set -x
git pull
set +x

current_version=$(yq -r '.version' helm/Chart.yaml)
publish_version="${current_version%-rc*}"

echo ""
echo "⚠️  What will happen:"
echo -e "  - Pending version in \x1b[36m$release_branch\x1b[0m branch will be bumped to \x1b[36m$publish_version\x1b[0m."
echo -e "  - Tip of the \x1b[36m$release_branch\x1b[0m branch will be tagged \x1b[36mv$publish_version\x1b[0m and pushed to GitHub."
echo -e "  - GitHub Action triggered by the tag will publish a stable release \x1b[36m$publish_version\x1b[0m."
echo -e "  - \x1b[36mdocs/development\x1b[0m on the \x1b[36m$release_branch\x1b[0m branch will become \x1b[36mdocs/stable\x1b[0m on the \x1b[36mmain\x1b[0m branch."
echo -e "  - \x1b[36minstall.sh\x1b[0m on the \x1b[36mmain\x1b[0m branch will be updated to install \x1b[36m$publish_version\x1b[0m by default."
gum confirm "Proceed?"

{{ mise_bin }} release:set-version "$publish_version"

set -x
git tag "v$publish_version"
git push --atomic origin $release_branch "v$publish_version"
set +x
echo -e "✅ Pushed tag $publish_version to \x1b[36morigin/$release_branch\x1b[0m"

set -x
git checkout main
git pull
perl -pi -e "s/^(LATEST_AGENTSTACK_VERSION=).*/\${1}$publish_version/" install.sh
perl -pi -e "s/^(LATEST_STABLE_AGENTSTACK_VERSION=).*/\${1}$publish_version/" install.sh
git add install.sh
git commit --signoff --no-verify -m "chore: update install.sh version to v$publish_version"
git push
set +x
echo -e "✅ Updated \x1b[36minstall.sh\x1b[0m on \x1b[36mmain\x1b[0m to install \x1b[36m$publish_version\x1b[0m by default"

set -x
rm -rf docs/stable docs/development
git restore --source=$release_branch docs/development
mv docs/development docs/stable
git restore --source=main docs/development
find docs/stable -type f \( -name "*.md" -o -name "*.mdx" \) -exec perl -pi -e 's|/development/|/stable/|g' {} +
git show $release_branch:docs/docs.json | \
jq '
  (.navigation.versions[]
   | select(.version == "development")
   | .version = "stable"
   | .groups[] |= (
       if has("pages") then
         .pages |= map(
           if type == "string" then
             sub("^development/"; "stable/")
           elif type == "object" then
             if has("pages") then
               .pages |= map(sub("^development/"; "stable/"))
             else
               . |= with_entries(if .value | type == "string" then .value |= sub("^development/"; "stable/") else . end)
             end
           else
             .
           end
         )
       else
         . |= with_entries(if .value | type == "string" then .value |= sub("^development/"; "stable/") else . end)
       end
     )
  )
' > .new-stable.json
jq --slurpfile new_stable .new-stable.json \
  '.navigation.versions = $new_stable + (.navigation.versions | map(select(.version != "stable")))' \
  docs/docs.json > docs.json.tmp && mv docs.json.tmp docs/docs.json
rm .new-stable.json
git add docs/stable docs/docs.json
git commit --signoff --no-verify -m "docs: publish stable docs for v$publish_version"
git push origin main
set +x
echo -e "✅ Published \x1b[36mstable\x1b[0m docs for \x1b[36mv$publish_version\x1b[0m"

echo "💡 Check the pipeline progress and result on: https://github.com/i-am-bee/agentstack/actions/workflows/release.yml"
'''

["release:checkout"]
description = "Checkout the latest release branch"
dir = "{{config_root}}"
run = '''
#!/bin/bash
set -eu -o pipefail

git fetch origin --tags --quiet

branch=$(git branch -r --sort=-version:refname --format "%(refname:short)" | grep 'origin/release-v' | head -n1 | sed 's|origin/||')

if git rev-parse "${branch/release//}" >/dev/null 2>&1; then
  echo "⚠️  Latest release v$branch already finalized!"
fi

git checkout "$branch"
'''

["release:status"]
description = "Show current release status and latest remote release information"
depends = ["common:check:version"]
dir = "{{config_root}}"
run = '''
#!/bin/bash
set -eu -o pipefail

git fetch origin --tags --quiet

echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "Latest release branch:  $(git branch -r --sort=-version:refname --format "%(refname:short)" | grep 'origin/release-v' | head -n1 | sed 's|origin/||')"
echo "Latest released tag:    $(git ls-remote --tags origin 'v*' | grep -o 'refs/tags/v[0-9]*\.[0-9]*\.[0-9]*\(-rc[0-9]*\)\?$' | sed 's|refs/tags/||' | sort -V | tail -n 1)"
echo "CI status:              https://github.com/i-am-bee/agentstack/actions/workflows/release.yml"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
'''

["example:create"]
description = "Create a new example from template"
dir = "{{config_root}}"
usage = '''
arg "<path>" help="Path relative to examples/ (e.g., agent-integration/multi-turn/basic-history)"
arg "<description>" help="Short description of the example"
'''
run = "examples/create-example.sh {{arg(name=\"path\")}} {{arg(name=\"description\")}}"

# please

["please"]
dir = "{{config_root}}"
run = """
#!/bin/bash
set -eu -o pipefail
{{mise_bin}} uninstall --all
rm -rf **/.venv **/node_modules **/.next
MISE_STATE_DIR="${MISE_STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/mise}"
for d in "task-sources" "task-auto-outputs"; do
  rm -rf "$MISE_STATE_DIR/$d" && mkdir -p "$MISE_STATE_DIR/$d"
done
brew upgrade mise || mise self-update || true
{{mise_bin}} install
{{mise_bin}} run --force setup ::: check
"""

# misc tasks

["yolobox"]
dir = "{{ config_root }}"
description = "experimental dev VM (requires macOS >=15, CPU >=M3)"
usage = 'arg "[name]"'
run = '''
#!/usr/bin/env bash
set -euxo pipefail
VM_NAME="yolobox${usage_name:+-$usage_name}"
export REPO=$(basename $(pwd))

cleanup() {
  limactl stop -f "$VM_NAME" || true
  git remote remove "$VM_NAME" 2>/dev/null || true
  perl -i -ne "print unless m|\QInclude ${LIMA_HOME:-$HOME/.lima}/$VM_NAME/ssh.config\E|" "$HOME/.ssh/config" || true
}
trap cleanup EXIT

if limactl create template:ubuntu --yes --name "$VM_NAME" --plain --vm-type=vz --rosetta --memory 36 --cpus 4 --set '.nestedVirtualization=true'; then
  limactl start "$VM_NAME"
  limactl shell "$VM_NAME" bash -c "
    set -euxo pipefail
    export DEBIAN_FRONTEND=noninteractive
    export GITHUB_TOKEN="${GITHUB_TOKEN-}"
    
    # Git
    sudo mkdir -p /git/$REPO
    sudo chown \$(id -u):\$(id -g) /git/$REPO
    cd /git/$REPO
    git init --initial-branch=\"$(git branch --show-current)\"
    git config receive.denyCurrentBranch updateInstead
    git config user.name \"$(git config user.name)\"
    git config user.email \"$(git config user.email)\"
    
    # Mise
    curl https://mise.run | sh
    eval \"\$(\$HOME/.local/bin/mise activate bash)\"
    echo 'eval \"\$(\$HOME/.local/bin/mise activate bash)\"' >> \$HOME/.bashrc

    # Docker
    sudo mkdir -p /etc/systemd/system/docker.socket.d
    printf '[Socket]\nSocketUser='\$USER | sudo tee /etc/systemd/system/docker.socket.d/override.conf
    curl -fsSL https://get.docker.com | sh
    
    # Lima & Virtualization Support
    sudo apt-get update -qq
    sudo apt-get install -qqy --no-install-recommends ovmf qemu-system-aarch64 qemu-efi-aarch64 qemu-utils ipxe-qemu xorriso
    sudo modprobe kvm
    sudo chmod 666 /dev/kvm
    mise use -g lima@2.0.3

    # Extra tools
    mise use -g kubectl@latest
  "
  git remote add "$VM_NAME" "ssh://lima-$VM_NAME:/git/$REPO"
  git push "$VM_NAME" $(git branch --show-current):$(git branch --show-current)
else
  limactl start "$VM_NAME"
fi
limactl shell "$VM_NAME" bash -c "cd /git/$REPO && mise trust && mise install"
mkdir -p "$HOME/.ssh"
printf "\nInclude ${LIMA_HOME:-$HOME/.lima}/$VM_NAME/ssh.config" >> "$HOME/.ssh/config"
code --new-window --wait --folder-uri "vscode-remote://ssh-remote+lima-$VM_NAME/git/$REPO"
'''

["sync-images-to-ghcr"]
dir = "{{config_root}}"
depends = ["helm:build:dependencies"]
usage = "flag --dryrun"
run = '''
#!/bin/bash

set -euo pipefail
DRY_RUN="${usage_dryrun:-false}"

{% raw %}
echo "Extracting images from helm chart..."

# Extract images from helm chart
images=$(helm template \
  --set phoenix.enabled=true \
  --set encryptionKey=dummy \
  --set auth.enabled=false \
  --set providerBuilds.enabled=true \
  --set localDockerRegistry.enabled=true \
  --set redis.enabled=true \
  ./helm 2>/dev/null | \
    sed -n '/^[[:space:]]*image:/{ /{{/d; s/.*image:[[:space:]]*//p; }' | \
    sed 's/"\([^"]*\)"/\1/' | grep -v 'agentstack')

echo "Found images:"
echo "$images"

# Process each image
echo "$images" | while IFS= read -r ghcr_image; do
  if [[ -z "$ghcr_image" ]]; then
    continue
  fi

  echo "Processing image: $ghcr_image"

  # Check for tag+digest format (e.g. image:tag@digest)
  ghcr_tag_image=""
  if [[ "$ghcr_image" == *":"*"@"* ]]; then
    # Extract the tag version (image:tag)
    ghcr_tag_image=$(echo "$ghcr_image" | sed 's/@.*//')
    
    # Strip tag from main variable (image@digest)
    ghcr_image=$(echo "$ghcr_image" | sed 's/:[^:/]*@/@/')
  fi

  # Remove ghcr.io/i-am-bee/ prefix to get Docker Hub image
  if [[ $ghcr_image =~ ^ghcr\.io/i-am-bee/(.+)$ ]]; then
    dockerhub_image="${BASH_REMATCH[1]}"

    echo "GHCR image: $ghcr_image"
    echo "Docker Hub image: $dockerhub_image"

    # Check if image exists in GHCR
    if docker manifest inspect "$ghcr_image" >/dev/null 2>&1; then
      echo "✅ Image $ghcr_image already exists in GHCR"
      continue
    fi

    echo "❌ Image $ghcr_image not found in GHCR"

    if [[ "$DRY_RUN" == "true" ]]; then
      echo "🔍 DRY RUN: Would sync $dockerhub_image -> $ghcr_image"
      continue
    fi

    # Check if source image exists in Docker Hub
    if ! docker manifest inspect "$dockerhub_image" >/dev/null 2>&1; then
      echo "❌ Source image $dockerhub_image not found in Docker Hub"
      continue
    fi

    echo "🔄 Syncing $dockerhub_image -> $ghcr_image"

    # Copy image with all architectures using skopeo
    skopeo copy --multi-arch all docker://"$dockerhub_image" docker://"$ghcr_image"

    echo "✅ Successfully synced $ghcr_image"

    # Sync the tag version if it exists
    if [[ -n "$ghcr_tag_image" ]]; then
      echo "🏷️  Also syncing tag: $ghcr_tag_image"
      
      if docker manifest inspect "$ghcr_tag_image" >/dev/null 2>&1; then
        echo "✅ Tag $ghcr_tag_image already exists in GHCR"
      else
        if [[ "$DRY_RUN" == "true" ]]; then
          echo "🔍 DRY RUN: Would sync $dockerhub_image -> $ghcr_tag_image"
        else
          skopeo copy --multi-arch all docker://"$dockerhub_image" docker://"$ghcr_tag_image"
          echo "✅ Successfully synced tag $ghcr_tag_image"
        fi
      fi
    fi
  else
    echo "⚠️  Skipping image with unexpected format: $ghcr_image"
  fi
done

echo "Image sync completed!"
{% endraw %}
'''

# security

["security:dependabot:alerts"]
dir = "{{config_root}}"
run = '''
#!/usr/bin/env bash
set -euo pipefail

gh api repos/i-am-bee/agentstack/dependabot/alerts --paginate 2>&1 | uv run python3 -c "
import json, sys
data = []
for line in sys.stdin:
    line = line.strip()
    if line:
        try:
            parsed = json.loads(line)
            if isinstance(parsed, list):
                data.extend(parsed)
            else:
                data.append(parsed)
        except Exception:
            pass

open_alerts = [a for a in data if a.get('state') == 'open']
open_alerts.sort(key=lambda x: x.get('security_advisory', {}).get('cvss', {}).get('score', 0), reverse=True)

print(f'Open Dependabot security alerts: {len(open_alerts)}')

for a in open_alerts:
    adv = a.get('security_advisory', {})
    vuln = a.get('security_vulnerability', {})
    dep = a.get('dependency', {})
    score = adv.get('cvss', {}).get('score', 'N/A')
    severity = adv.get('severity', 'N/A').upper()
    pkg = dep.get('package', {}).get('name', 'N/A')
    ecosystem = dep.get('package', {}).get('ecosystem', 'N/A')
    relationship = dep.get('relationship', 'N/A')
    manifest = dep.get('manifest_path', 'N/A')
    fix = vuln.get('first_patched_version', {})
    fix_ver = fix.get('identifier', 'none') if fix else 'none'
    vuln_range = vuln.get('vulnerable_version_range', 'N/A')
    cve = adv.get('cve_id', 'N/A')
    ghsa = adv.get('ghsa_id', 'N/A')
    cwes = adv.get('cwes', [])
    cwe_str = ', '.join(c['cwe_id'] + ' \u2014 ' + c['name'] for c in cwes)
    created = a.get('created_at', '')[:10]
    summary = adv.get('summary', '')
    description = adv.get('description', '').strip()

    print()
    print(f'---')
    print(f'Alert #{a[\"number\"]}: {pkg} \u2014 {summary}')
    print()
    print(f'- URL: {a[\"html_url\"]}')
    print(f'- Severity: {severity} (CVSS: {score})')
    print(f'- Package: {pkg} ({ecosystem}) \u2014 {relationship}, {manifest}')
    print(f'- Vulnerable Range: {vuln_range} \u2192 Fix: {fix_ver}')
    print(f'- CVE: {cve} | GHSA: {ghsa}')
    if cwe_str:
        print(f'- CWE: {cwe_str}')
    print(f'- Created: {created}')
    print()
    print('Description')
    print()
    print(description)
"
'''