Taskfile.yaml

---
# yaml-language-server: $schema=https://taskfile.dev/schema.json
version: "3"

dotenv: ['.env']

includes:
  aws: "https://raw.githubusercontent.com/CowDogMoo/taskfile-templates/main/aws/Taskfile.yaml"
  github: "https://raw.githubusercontent.com/CowDogMoo/taskfile-templates/main/github/Taskfile.yaml"
  pre-commit: "https://raw.githubusercontent.com/CowDogMoo/taskfile-templates/main/pre-commit/Taskfile.yaml"
  renovate: "https://raw.githubusercontent.com/CowDogMoo/taskfile-templates/main/renovate/Taskfile.yaml"
  secrets: "https://raw.githubusercontent.com/CowDogMoo/taskfile-templates/main/secrets/Taskfile.yaml"  # pragma: allowlist secret
  remote:
    taskfile: .taskfiles/remote/Taskfile.yaml
    optional: true
    vars:
      K8S_NAMESPACE: '{{.K8S_NAMESPACE}}'
  red:
    taskfile: .taskfiles/red/Taskfile.yaml
    optional: true
    vars:
      ARES_CLI: '{{.ARES_CLI}}'
      MODEL: '{{.MODEL}}'
      ARES_CONFIG: '{{.ARES_CONFIG}}'
      MAX_STEPS_RED: '{{.MAX_STEPS_RED}}'
      LOG_DIR: '{{.LOG_DIR}}'
      REPORT_DIR: '{{.REPORT_DIR}}'
      GRAFANA_URL: '{{.GRAFANA_URL}}'
      LOKI_URL: '{{.LOKI_URL}}'
      DREADNODE_SERVER_URL: '{{.DREADNODE_SERVER_URL}}'
      DREADNODE_ORGANIZATION: '{{.DREADNODE_ORGANIZATION}}'
      DREADNODE_WORKSPACE: '{{.DREADNODE_WORKSPACE}}'
      DREADNODE_PROJECT: '{{.DREADNODE_PROJECT}}'
      K8S_NAMESPACE: '{{.K8S_NAMESPACE}}'
      TARGET_PROFILE: '{{.TARGET_PROFILE}}'
      TARGET_REGION: '{{.TARGET_REGION}}'
      TARGET: '{{.TARGET}}'
      DOMAIN: '{{.DOMAIN}}'
      EC2_NAME: '{{.EC2_NAME}}'
      EC2_PROFILE: '{{.EC2_PROFILE}}'
      EC2_REGION: '{{.EC2_REGION}}'
      BLUE_ENABLED: '{{.BLUE_ENABLED}}'
      BLUE_LLM_MODEL: '{{.BLUE_LLM_MODEL}}'
      OTEL_TRACES_ENDPOINT: '{{.OTEL_TRACES_ENDPOINT}}'
  ec2:
    taskfile: .taskfiles/ec2/Taskfile.yaml
    optional: true
    vars:
      EC2_NAME: '{{.EC2_NAME}}'
      EC2_PROFILE: '{{.EC2_PROFILE}}'
      EC2_REGION: '{{.EC2_REGION}}'
      ARES_CONFIG: '{{.ARES_CONFIG}}'
      OTEL_TRACES_ENDPOINT: '{{.OTEL_TRACES_ENDPOINT}}'
      ALLOY_LOKI_ENDPOINT: '{{.ALLOY_LOKI_ENDPOINT}}'
      LOKI_URL: '{{.LOKI_URL}}'
  blue:
    taskfile: .taskfiles/blue/Taskfile.yaml
    optional: true
    vars:
      ARES_CLI: '{{.ARES_CLI}}'
      MODEL: '{{.MODEL}}'
      ARES_CONFIG: '{{.ARES_CONFIG}}'
      MAX_STEPS_BLUE: '{{.MAX_STEPS_BLUE}}'
      MAX_STEPS_BLUE_ONCE: '{{.MAX_STEPS_BLUE_ONCE}}'
      POLL_INTERVAL: '{{.POLL_INTERVAL}}'
      LOG_DIR: '{{.LOG_DIR}}'
      REPORT_DIR: '{{.REPORT_DIR}}'
      GRAFANA_URL: '{{.GRAFANA_URL}}'
      DREADNODE_SERVER_URL: '{{.DREADNODE_SERVER_URL}}'
      DREADNODE_ORGANIZATION: '{{.DREADNODE_ORGANIZATION}}'
      DREADNODE_WORKSPACE: '{{.DREADNODE_WORKSPACE}}'
      DREADNODE_PROJECT: '{{.DREADNODE_PROJECT}}'
      K8S_NAMESPACE: '{{.K8S_NAMESPACE}}'

vars:
  API_DIR: "."
  # Ares configuration
  # MODEL: '{{.MODEL | default "claude-sonnet-4-5-20250929"}}'
  MODEL: '{{.MODEL | default "gpt-5.2"}}'
  GRAFANA_URL: '{{.GRAFANA_URL}}'
  LOKI_URL: '{{.LOKI_URL}}'
  POLL_INTERVAL: '{{.POLL_INTERVAL | default "30"}}'
  MAX_STEPS_BLUE: '{{.MAX_STEPS_BLUE | default "50"}}'
  MAX_STEPS_BLUE_ONCE: '{{.MAX_STEPS_BLUE_ONCE | default "15"}}'  # ~15 min max for once mode
  MAX_STEPS_RED: '{{.MAX_STEPS_RED | default "150"}}'
  REPORT_DIR: '{{.REPORT_DIR | default "./reports"}}'
  LOG_DIR: '{{.LOG_DIR | default "./logs"}}'
  DREADNODE_SERVER_URL: '{{.DREADNODE_SERVER_URL}}'
  DREADNODE_ORGANIZATION: '{{.DREADNODE_ORGANIZATION | default "ares"}}'
  DREADNODE_WORKSPACE: '{{.DREADNODE_WORKSPACE | default "ares-protocol"}}'
  DREADNODE_PROJECT: '{{.DREADNODE_PROJECT | default "ares-soc"}}'
  # Config file (single source of truth for model assignments)
  ARES_CONFIG: '{{.ARES_CONFIG | default "./config/ares.yaml"}}'
  # Rust CLI binary
  ARES_CLI: '{{.ARES_CLI | default "./target/release/ares"}}'
  # Infrastructure
  K8S_NAMESPACE: '{{.K8S_NAMESPACE | default "attack-simulation"}}'
  TARGET_PROFILE: '{{.TARGET_PROFILE | default "lab"}}'
  TARGET_REGION: '{{.TARGET_REGION | default "us-west-1"}}'
  # Red team defaults
  TARGET: '{{.TARGET | default "dreadgoad"}}'
  DOMAIN: '{{.DOMAIN | default "sevenkingdoms.local"}}'
  # Observability
  OTEL_TRACES_ENDPOINT: '{{.OTEL_TRACES_ENDPOINT}}'
  ALLOY_LOKI_ENDPOINT: '{{.ALLOY_LOKI_ENDPOINT}}'
  # EC2 deployment (alternative to K8s)
  EC2_NAME: '{{.EC2_NAME | default "ares-tools"}}'
  EC2_PROFILE: '{{.EC2_PROFILE | default "lab"}}'
  EC2_REGION: '{{.EC2_REGION | default "us-west-1"}}'
  # Blue team (set BLUE_ENABLED=1 to run blue alongside red)
  BLUE_ENABLED: '{{.BLUE_ENABLED | default "0"}}'
  BLUE_LLM_MODEL: '{{.BLUE_LLM_MODEL | default ""}}'

tasks:
  default:
    desc: List all available tasks
    silent: true
    cmds:
      - task --list --sort none

  # Setup and initialization tasks
  check-command:
    internal: true
    silent: true
    vars:
      COMMAND: '{{.CLI_ARGS}}'
    cmds:
      - |
        command -v {{.COMMAND}} >/dev/null 2>&1 || (echo "Command '{{.COMMAND}}' not found. Please install it." && exit 1)

  check-dependencies:
    internal: true
    silent: true
    cmds:
      - task: check-command
        vars: { COMMAND: docker }
      - task: check-command
        vars: { COMMAND: cargo }
      - task: check-command
        vars: { COMMAND: ruby }

  setup-env:
    internal: true
    silent: true
    cmds:
      - cp -n .env.example .env || true

  get-dotenv-value:
    internal: true
    silent: true
    vars:
      KEY: '{{.CLI_ARGS}}'
    cmds:
      - grep '^{{.KEY}}=' .env | sed 's/^{{.KEY}}=//;s/^"//;s/"$//'

  setup-git-hooks:
    desc: Set up Git hooks
    silent: true
    cmds:
      - |
        #!/bin/bash
        set -e
        ln -sf .hooks/post_merge.sh .git/hooks/post-merge
        chmod +x .git/hooks/post-merge
        echo "Post-merge git hooks successfully installed!"

  init:
    desc: Initialize the project
    silent: true
    deps: [check-dependencies]
    cmds:
      - task: setup-env
      - task: setup-git-hooks
      - cargo build
      - task: pre-commit:install
      - echo "Project is ready to go!"

  # Tools and pre-commit tasks
  run-pre-commit:
    desc: Run pre-commit hooks on all files
    silent: true
    cmds:
      - task: pre-commit:update-hooks
      - task: pre-commit:clear-cache
      - task: pre-commit:run-hooks

  clean:
    desc: Clean build artifacts
    silent: true
    cmds:
      - cargo clean

  # Rust CLI tasks
  rust:build:
    desc: Build the Rust CLI binary (debug)
    silent: true
    cmds:
      - cargo build
      - echo "Debug binary built at target/debug/ares"

  rust:release:
    desc: Build the Rust CLI binary (release)
    silent: true
    cmds:
      - cargo build --release
      - echo "Release binary built at target/release/ares"

  rust:test:
    desc: Run Rust tests
    silent: true
    cmds:
      - cargo test

  rust:check:
    desc: Check Rust code compiles without building
    silent: true
    cmds:
      - cargo check

  rust:clean:
    desc: Clean Rust build artifacts
    silent: true
    cmds:
      - cargo clean

  rust:deploy:
    desc: "Cross-compile and deploy Rust binaries to K8s pods"
    cmds:
      - task: remote:rust:deploy:quick

  # GitHub tasks
  create-release:
    desc: Create a release on GitHub
    silent: true
    cmds:
      - task: github:create-release

  # ===========================================================================
  # Ares Blue Team (SOC) Agent Tasks
  # ===========================================================================

  ares:config:check:
    desc: Check configuration and API key access
    silent: true
    cmds:
      - |
        echo "Checking Ares configuration..."
        echo ""
        echo "Environment:"
        echo "  Rust: $(rustc --version 2>/dev/null || echo 'not installed')"
        echo "  ares: $({{.ARES_CLI}} --version 2>/dev/null || echo 'not built — run task rust:release')"
        echo ""
        echo "Configuration:"
        echo "  Platform: {{.DREADNODE_SERVER_URL}}"
        echo "  Project: {{.DREADNODE_PROJECT}}"
        echo "  Model (override): {{.MODEL}}"
        echo "  Config: {{.ARES_CONFIG}}"
        echo "  Grafana: {{.GRAFANA_URL}}"
        echo "  Loki: {{.LOKI_URL}}"
        echo "  Prometheus: {{.PROMETHEUS_URL}}"
        echo ""
        echo "Checking 1Password CLI access..."

        # Check if op is installed
        if ! command -v op >/dev/null 2>&1; then
          echo "  ❌ 1Password CLI (op) not installed"
          echo ""
          echo "Install from: https://developer.1password.com/docs/cli/get-started/"
          exit 1
        fi

        echo "  ✅ 1Password CLI installed: $(op --version)"
        echo ""
        echo "Checking 1Password items..."

        # Check Dreadnode API key
        if op item get "Dreadnode Dev Platform" --fields api-key --reveal >/dev/null 2>&1; then
          echo "  ✅ Dreadnode API key accessible"
        else
          echo "  ❌ Dreadnode API key not found in 1Password"
          echo "     Item: 'Dreadnode Dev Platform'"
          echo "     Field: 'api-key'"
        fi

        # Check Grafana API key
        if op item get "Ares Grafana MCP" --fields grafana-token --reveal >/dev/null 2>&1; then
          echo "  ✅ Grafana API key accessible"
        else
          echo "  ⚠️  Grafana API key not found in 1Password"
          echo "     Item: 'Ares Grafana MCP'"
          echo "     Field: 'grafana-token'"
        fi

        # Check Anthropic API key
        if op item get "Dreadnode Claude" --fields api-key --reveal >/dev/null 2>&1; then
          echo "  ✅ Anthropic API key accessible"
        else
          echo "  ⚠️  Anthropic API key not found in 1Password"
          echo "     Item: 'Dreadnode Claude'"
          echo "     Field: 'dreadnode-personal-api-key'"
        fi

        echo ""
        echo "Configuration check complete"

  ares:config:show:
    desc: Show current configuration (without secrets)
    silent: true
    cmds:
      - |
        echo "Ares Configuration:"
        echo "===================="
        echo "Platform Settings:"
        echo "  Server: {{.DREADNODE_SERVER_URL}}"
        echo "  Project: {{.DREADNODE_PROJECT}}"
        echo ""
        echo "Agent Settings:"
        echo "  Model: {{.MODEL}}"
        echo "  Max Steps (Blue): {{.MAX_STEPS_BLUE}}"
        echo "  Max Steps (Blue Once): {{.MAX_STEPS_BLUE_ONCE}}"
        echo "  Max Steps (Red): {{.MAX_STEPS_RED}}"
        echo "  Poll Interval: {{.POLL_INTERVAL}}s"
        echo ""
        echo "Data Sources:"
        echo "  Grafana: {{.GRAFANA_URL}}"
        echo "  Query Method: Grafana MCP (requires mcp-grafana binary)"
        echo ""
        echo "Output:"
        echo "  Reports: {{.REPORT_DIR}}"

  ares:version:
    desc: Show Ares version information
    silent: true
    cmds:
      - '{{.ARES_CLI}} --version'

  # ===========================================================================
  # Config Management Tasks
  # ===========================================================================

  config:models:
    desc: "Show model assignments from config"
    silent: true
    cmds:
      - '{{.ARES_CLI}} config show --models'

  config:set-model:
    desc: "Set model for a role (usage: task config:set-model -- orchestrator gpt-5.2)"
    silent: true
    cmds:
      - '{{.ARES_CLI}} config set-model {{.CLI_ARGS}}'

  config:set-model-all:
    desc: "Set all roles to the same model (usage: task config:set-model-all -- gpt-5.2)"
    silent: true
    cmds:
      - '{{.ARES_CLI}} config set-model --all {{.CLI_ARGS}}'

  # ===========================================================================
  # Ares Red Team Agent Tasks
  # ===========================================================================

  check-aws-auth:
    internal: true
    silent: true
    vars:
      PROFILE: '{{.PROFILE | default "lab"}}'
      REGION: '{{.REGION | default "us-west-1"}}'
    cmds:
      - |
        # Check if AWS CLI is installed
        if ! command -v aws >/dev/null 2>&1; then
          echo "❌ Error: AWS CLI is not installed"
          echo ""
          echo "The red team orchestration tasks require AWS CLI to access the infrastructure account."
          echo "Install it from: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html"
          exit 1
        fi

        # Check if credentials are configured and valid for the profile
        if ! aws sts get-caller-identity --profile "{{.PROFILE}}" --region "{{.REGION}}" >/dev/null 2>&1; then
          echo "❌ Error: AWS authentication failed for profile '{{.PROFILE}}'"
          echo ""
          echo "You need to authenticate to the infrastructure account before running this task."
          echo ""
          echo "Troubleshooting:"
          echo "  1. Verify your AWS credentials are configured: aws configure --profile {{.PROFILE}}"
          echo "  2. If using SSO, authenticate: aws sso login --profile {{.PROFILE}}"
          echo "  3. Check your profile exists: aws configure list --profile {{.PROFILE}}"
          echo "  4. Verify your credentials are not expired"
          exit 1
        fi

        # Success - show caller identity
        echo "✅ AWS authentication verified"
        aws sts get-caller-identity --profile "{{.PROFILE}}" --region "{{.REGION}}" --output table