welder.yaml

schemaVersion: "1.8.1"
projectName: simple-container-api
projectRoot: .
version: ${env:VERSION:0.0.0}
default:
  build:
    args:
      package: github.com/simple-container-com/api
      ld-flags: "-s -w -X=${arg:package}/internal/build.Version=${project:version}"
profiles:
  skip-tools:
  skip-embeddings:
    build:
      env:
        SKIP_EMBEDDINGS: "true"
  skip-test:
    activation:
      skip-tests: true
    build:
      env:
        SKIP_TESTS: "true"
modules:
  - name: api
    build:
      steps:
        - task: clean
        - task: tools
        - task: generate-schemas
        - task: linters
        - task: fmt
        - task: test
        - task: build-all
        - task: build-github-actions
        - task: build-github-actions-staging
        - task: docker-login
        - task: build-cloud-helpers
        - task: build-docs
    deploy:
      environments:
        prod:
          autoDeploy: true
      steps:
        - task: deploy
    dockerImages:
      - name: kubectl
        dockerFile: ${project:root}/kubectl.Dockerfile
        tags:
          - simplecontainer/kubectl:latest
          - simplecontainer/kubectl:${project:version}
      - name: caddy
        dockerFile: ${project:root}/caddy.Dockerfile
        tags:
          - simplecontainer/caddy:latest
          - simplecontainer/caddy:${project:version}
      - name: github-actions
        dockerFile: ${project:root}/github-actions.Dockerfile
        tags:
          - simplecontainer/github-actions:latest
          - simplecontainer/github-actions:${project:version}
      - name: github-actions-staging
        dockerFile: ${project:root}/github-actions-staging.Dockerfile
        tags:
          - simplecontainer/github-actions:staging
      - name: cloud-helpers-aws
        dockerFile: ${project:root}/cloud-helpers.aws.Dockerfile
        tags:
          - simplecontainer/cloud-helpers:aws-latest
          - simplecontainer/cloud-helpers:aws-${project:version}
        runAfterPush:
          tasks:
            - tag-release
tasks:
  clean:
    runOn: host
    script:
      - mkdir -p ${project:root}/dist
      - rm -fR ${project:root}/dist/*
      - mkdir -p ${project:root}/.sc/stacks/dist/bundle
      - rm -fR ${project:root}/.sc/stacks/dist/bundle/*
      - mkdir -p ${project:root}/docs/site
      - rm -fR ${project:root}/docs/site/*
      - mkdir -p ${project:root}/docs/schemas
      - rm -fR ${project:root}/docs/schemas/*
  tools:
    runOn: host
    runIf: "!${profile:skip-tools.active}"
    script:
      - cat tools.go | grep _ | awk -F'"' '{print $2}' | xargs -tI % go get %
      - go mod download
      - go generate -tags tools
      - go mod tidy
  fmt:
    runOn: host
    script:
      - go mod tidy
      - ${project:root}/bin/gofumpt -l -w ./
      - ${project:root}/bin/golangci-lint run --fix --timeout 3m -v
  linters:
    runOn: host
    script:
      - ${project:root}/bin/golangci-lint run --fast --timeout 5m -v
  build-all:
    runOn: host
    script:
      - go build ./...
      - welder run build -a os=linux -a arch=amd64
      - welder run build -a os=darwin -a arch=arm64
      - welder run build -a os=darwin -a arch=amd64
      - cp ${project:root}/sc.sh ${project:root}/.sc/stacks/dist/bundle/sc.sh
      - sed -i -e 's/VERSION="0\.0\.0"/VERSION="${project:version}"/g' ${project:root}/.sc/stacks/dist/bundle/sc.sh
      - echo "${project:version}" > ${project:root}/.sc/stacks/dist/bundle/version
      - cp ${project:root}/.sc/stacks/dist/site/* ${project:root}/.sc/stacks/dist/bundle/
  docker-login:
    runOn: host
    # `sc` is provisioned on the runner by the install-sc composite action
    # before welder is invoked (see .github/workflows/*.yaml).
    script:
      - sc secrets reveal
      - sc stack secret-get -s dist dockerhub-cicd-token | docker login --username simplecontainer --password-stdin
  build-cloud-helpers:
    runOn: host
    env:
      CGO_ENABLED: "0" # static, host-libc-independent build for reproducibility
    script:
      - go build -trimpath -buildvcs=false -ldflags "${arg:ld-flags}" -o ${project:root}/dist/cloud-helpers ./cmd/cloud-helpers
  build-github-actions:
    runOn: host
    env:
      CGO_ENABLED: "0" # static, host-libc-independent build for reproducibility
    script:
      - echo "Building GitHub Actions binary..."
      - go build -trimpath -buildvcs=false -ldflags "${arg:ld-flags}" -o ${project:root}/dist/github-actions ./cmd/github-actions
      - echo "✅ GitHub Actions binary built successfully"
  test:
    runOn: host
    script:
      - if [ "${SKIP_TESTS}" != 'true' ]; then go test ./...; else echo "Skipping tests"; fi
  coverage:
    runOn: host
    description: |
      Aggregate test-coverage measurement against the targets documented in
      docs/TESTING.md ("Coverage scope"). Two numbers are produced:
        * included-set (dist/cover.out) — the documented unit-testable core,
          the denominator the OpenSSF statement-coverage criterion is judged on.
        * full-set (dist/cover.full.out) — the whole repo, unfiltered, kept
          visible for transparency.
      The included set excludes, by design (each contributes ~0% and would hide
      real gains): cmd/*/main.go + pkg/cmd/* (CLI entry points), pkg/**/mocks/
      + pkg/util/test/ (generated / hand-written test doubles), pkg/api/tests/*
      (test fixtures), pkg/clouds/pulumi/* (thin Pulumi SDK orchestration,
      covered by e2e_*_test.go), pkg/assistant/* (experimental LLM subsystem),
      pkg/githubactions/* (GitHub Action runtime entry point),
      pkg/clouds/aws/helpers/* (cloud-helpers Lambda runtime entry point), and
      pkg/provisioner/* (provision orchestration). These are behaviourally
      tested via integration/e2e runs, not unit statements. The exclusion globs
      below MUST stay in sync with the docs/TESTING.md table.
    script:
      - echo "Running test suite with coverage profile..."
      - go test -coverprofile=${project:root}/dist/cover.raw.out -covermode=atomic ./...
      - echo "Recording full-set (unfiltered) profile..."
      - cp ${project:root}/dist/cover.raw.out ${project:root}/dist/cover.full.out
      - echo "Filtering down to the documented included set..."
      - grep -vE '/cmd/[^/]+/main\.go|/mocks/|/pkg/util/test/|/pkg/api/tests/|/pkg/clouds/pulumi/|/pkg/assistant/|/pkg/cmd/|/pkg/githubactions/|/pkg/clouds/aws/helpers/|/pkg/provisioner/' ${project:root}/dist/cover.raw.out > ${project:root}/dist/cover.out
      - echo "--- Included-set coverage by package ---"
      - go tool cover -func=${project:root}/dist/cover.out | tail -40
      - echo "--- Aggregates ---"
      - go tool cover -func=${project:root}/dist/cover.out | awk '/^total:/ {print "Included-set statement coverage:", $NF}'
      - go tool cover -func=${project:root}/dist/cover.full.out | awk '/^total:/ {print "Full-set statement coverage:", $NF}'
  generate-schemas:
    runOn: host
    script:
      - echo "Generating JSON Schema files for Simple Container resources..."
      - go build -o ${project:root}/bin/schema-gen ./cmd/schema-gen
      - ${project:root}/bin/schema-gen ${project:root}/docs/schemas
      - echo "Successfully generated JSON Schema files in docs/schemas/"
  generate-embeddings:
    runOn: host
    script:
      - echo "🚀 Generating OpenAI embeddings for AI Assistant..."
      - mkdir -p ${project:root}/pkg/assistant/embeddings/vectors
      - |
        # Build the embeddings generator tool
        echo "🔨 Building embeddings generator..."
        cd ${project:root}
        mkdir -p bin
        go mod download
        go build -o ${project:root}/bin/generate-embeddings ${project:root}/cmd/generate-embeddings
        
        # Check if build succeeded
        if [ ! -f "${project:root}/bin/generate-embeddings" ]; then
          echo "❌ Failed to build embeddings generator binary"
          exit 1
        fi
        echo "✅ Successfully built embeddings generator"
        
        # Get OpenAI API key from secrets or environment (build-time)  
        echo "🔑 Retrieving OpenAI API key..."
        OPENAI_KEY=""
        
        # Try to get from Simple Container secrets - use pre-installed sc first, then local build
        if command -v sc >/dev/null 2>&1; then
          echo "🔍 Using pre-installed sc command to retrieve OpenAI key..."
          OPENAI_KEY=$(sc stack secret-get -s dist openai-api-key 2>/dev/null || echo "")
        elif [ -f "${project:root}/bin/sc" ]; then
          echo "🔍 Using locally built sc binary to retrieve OpenAI key..."
          OPENAI_KEY=$(${project:root}/bin/sc stack secret-get -s dist openai-api-key 2>/dev/null || echo "")
        fi
        
        # Fall back to environment variable
        if [ -z "$OPENAI_KEY" ]; then
          echo "🔍 No OpenAI key found in secrets, checking environment variable..."
          OPENAI_KEY=$OPENAI_API_KEY
        fi
        
        # Set embedding model from environment variable or use default
        EMBEDDING_MODEL=${SIMPLE_CONTAINER_EMBEDDING_MODEL:-text-embedding-3-small}
        
        if [ -n "$OPENAI_KEY" ]; then
          echo "✨ Generating OpenAI embeddings using model: $EMBEDDING_MODEL"
          if ! ${project:root}/bin/generate-embeddings \
            -openai-key "$OPENAI_KEY" \
            -model "$EMBEDDING_MODEL" \
            -output ${project:root}/pkg/assistant/embeddings/vectors/prebuilt_embeddings_openai.json \
            -verbose; then
            echo "❌ Failed to generate OpenAI embeddings"
            exit 1
          fi
          
          echo "🏠 Generating local embeddings as fallback..."
          if ! ${project:root}/bin/generate-embeddings \
            -local \
            -output ${project:root}/pkg/assistant/embeddings/vectors/prebuilt_embeddings_local.json \
            -verbose; then
            echo "❌ Failed to generate local embeddings"
            exit 1
          fi
          echo "✅ Generated both OpenAI and local embeddings for optimal reliability"
        else
          echo "⚠️  OpenAI API key not found in secrets or environment"
          echo "🏠 Generating local embeddings only..."
          if ! ${project:root}/bin/generate-embeddings \
            -local \
            -output ${project:root}/pkg/assistant/embeddings/vectors/prebuilt_embeddings_local.json \
            -verbose; then
            echo "❌ Failed to generate local embeddings"
            exit 1
          fi
          echo "💡 To enable OpenAI embeddings: sc secrets add openai-api-key or export OPENAI_API_KEY=your-key"
          echo "💡 Set embedding model with: export SIMPLE_CONTAINER_EMBEDDING_MODEL=text-embedding-3-large"
        fi
        
        echo "✅ Embeddings generation completed"
  build:
    runOn: host
    env:
      GOOS: ${arg:os:linux}
      GOARCH: ${arg:arch:amd64}
      CGO_ENABLED: "0"
    script:
      - echo "Building for ${GOOS}/${GOARCH}..."
      - if [ "${GOOS}" = "windows" ]; then export EXT=".exe"; else export EXT=""; fi
      - go build -trimpath -buildvcs=false -ldflags "${arg:ld-flags}" -o ${project:root}/dist/${GOOS}-${GOARCH}/sc${EXT} ./cmd/sc
      - cd ${project:root}/dist/${GOOS}-${GOARCH} && tar --sort=name --mtime='@0' --owner=0 --group=0 --numeric-owner --mode='u=rwx,go=rx' -cf - sc${EXT} | gzip -9 -n > sc-${GOOS}-${GOARCH}.tar.gz
      - mv ${project:root}/dist/${GOOS}-${GOARCH}/sc-${GOOS}-${GOARCH}.tar.gz ${project:root}/.sc/stacks/dist/bundle/sc-${GOOS}-${GOARCH}.tar.gz
      - cp ${project:root}/.sc/stacks/dist/bundle/sc-${GOOS}-${GOARCH}.tar.gz ${project:root}/.sc/stacks/dist/bundle/sc-${GOOS}-${GOARCH}-v${project:version}.tar.gz
  deploy:
    runOn: host
    script:
      - ${project:root}/bin/sc secrets reveal
      - ${project:root}/bin/sc deploy -s dist -e prod --skip-refresh
      - ${project:root}/bin/sc deploy -s docs -e prod --skip-refresh
  tag-release:
    runOn: host
    script:
      - git tag ${project:version} || echo "Already set tag ${project:version}"
      - git push -f origin ${project:version} || echo "Tag ${project:version} already exists in origin"
  build-docs:
    image: python:3.9.18
    workDir: ${project:root}/docs
    script:
      - pip install -r requirements.txt
      - PATH=${PATH}:~/.local/bin mkdocs build
  debug-aws-cloud-helpers:
    runOn: host
    env:
      AWS_LAMBDA_FUNCTION_TIMEOUT: 60
      SIMPLE_CONTAINER_STARTUP_DELAY: 10s
      SIMPLE_CONTAINER_CLOUD_HELPER_TYPE: sc-helper-aws-cloudwatch-alert-lambda
    script:
      - go build -gcflags="all=-N -l" -o ${project:root}/dist/cloud-helpers ./cmd/cloud-helpers
      - aws-lambda-rie ${project:root}/bin/dlv --listen=:2345 --headless=true --api-version=2 --accept-multiclient exec ${project:root}/dist/cloud-helpers
  rebuild:
    runOn: host
    script:
      - welder run generate-schemas
      - if [ "${SKIP_EMBEDDINGS}" != 'true' ]; then welder run generate-embeddings; else echo "Skipping embeddings"; fi
      - go build -ldflags "-s -w -X=${arg:package}/internal/build.Version=$(date '+0.0.0-pre%Y.%m.%d.%H.%M.%S')" -o ${project:root}/bin/sc ./cmd/sc && mkdir -p ~/.local/bin &&  cp -f ./bin/sc ~/.local/bin/sc
  build-github-actions-staging:
    runOn: host
    env:
      CGO_ENABLED: "0"
      GOOS: "linux"
      GOARCH: "amd64"
    script:
      - echo "Building static github-actions binary for staging (Alpine compatible)..."
      - mkdir -p ${project:root}/bin
      - go build -trimpath -buildvcs=false -ldflags "${arg:ld-flags}" -a -installsuffix cgo -o ${project:root}/bin/github-actions ./cmd/github-actions
  build-github-actions-staging-push:
    runOn: host
    script:
      - welder run build-github-actions-staging
      - welder docker build --push github-actions-staging