Tasks

Every task target, the single entry point for local work, git hooks and CI.

Generated from Taskfile.yml on every build. The delivery pipeline page explains how they fit together.

check#

Task	What it does
`task check`	Full local pipeline, identical to CI

dco#

Task	What it does
`task dco`	DCO sign-off check (D-5) on the commits in BASE..HEAD, e.g. task dco BASE=origin/main HEAD=HEAD

default#

Task	What it does
`task default`	List all tasks

e2e#

Task	What it does
`task e2e`	End-to-end tests (test/e2e) on a local kind or k3d cluster, after task e2e:images; refuses non-local clusters

fmt#

Task	What it does
`task fmt`	Format Go code (gofumpt, goimports) in every Go module

gen#

Task	What it does
`task gen`	Generate the operator’s deepcopy code, CRDs (deploy/crds) and Role (deploy/operator) with controller-gen

hooks#

Task	What it does
`task hooks`	Install git hooks (lefthook); hooks only call task targets

lint#

Task	What it does
`task lint`	Strict lint (.golangci.yml) of every Go module

merge-driver#

Task	What it does
`task merge-driver`	Register kibi’s merge driver for the .kb files named in .gitattributes

proto#

Task	What it does
`task proto`	Contract checks (buf lint and format, breaking changes, generated code up to date)

setup#

Task	What it does
`task setup`	One-time setup per clone (pinned tools, kibi, git hooks, kibi merge driver)

test#

Task	What it does
`task test`	Unit, replay-integration, envtest and tooling tests (offline once `task tools` has run)

tools#

Task	What it does
`task tools`	Install the pinned Go tools into .bin/

vuln#

Task	What it does
`task vuln`	Vulnerability checks (govulncheck, npm audit)

check#

Task	What it does
`task check:commit`	Pre-commit pipeline (like check, with kibi on staged changes)

ci#

Task	What it does
`task ci:images`	JSON list of the images CI builds (cmd//Dockerfile, plugins//Dockerfile), e.g. task ci:images PREFIX=ghcr.io/owner/openfief

demo#

Task	What it does
`task demo:down`	Delete every resource of the demo ENV and its DNS records; needs CONFIRM=<ENV>, e.g. task demo:down ENV=demo CONFIRM=demo
`task demo:plan`	What `task demo:up` would create in Hetzner Cloud and the monthly cost against DEMO_BUDGET_EUR, without changing anything, e.g. task demo:plan ENV=demo
`task demo:recreate`	Delete and create the demo machine ENV again from the current cloud-init; needs CONFIRM=<ENV>, e.g. task demo:recreate ENV=demo CONFIRM=demo
`task demo:status`	Show the demo machine ENV and the monthly cost of all OpenFief resources in the project, e.g. task demo:status ENV=demo
`task demo:up`	Create the demo machine ENV in Hetzner Cloud, or what is missing of it, within DEMO_BUDGET_EUR, and point its DNS name at it (HCLOUD_TOKEN, optional CLOUDFLARE_API_TOKEN), e.g. task demo:up ENV=demo
`task demo:validate`	Build the demo’s GitOps manifests (deploy/demo) offline and check that every image is pinned by digest

deploy#

Task	What it does
`task deploy:demo`	Publish deploy/demo/openfief, pinned to the signed digests of TAG, as the signed artifact Flux on the demo follows (CI only; needs cosign and a GHCR login), e.g. task deploy:demo TAG=sha-1a2b3c4 REPO=owner/openfief

dns#

Task	What it does
`task dns:site`	Point <DEMO_DOMAIN> (A and AAAA) and www (CNAME) at GitHub Pages, DNS-only, with the verification TXT when GITHUB_PAGES_CHALLENGE is set; changes only records commented managed-by=openfief-site and deletes the retired managed-by=openfief-docs record (CLOUDFLARE_API_TOKEN), e.g. task dns:site
`task dns:site:plan`	What `task dns:site` would change in the website’s DNS records at <DEMO_DOMAIN> and www.<DEMO_DOMAIN>, without changing anything (CLOUDFLARE_API_TOKEN), e.g. task dns:site:plan

docs#

Task	What it does
`task docs:build`	Build the docs site into site/public; fails on a broken link, a diagram that doesn’t render or a stale reference
`task docs:check`	ID checks for the design documents
`task docs:fresh`	Staleness gate over a pushed range: covered code changed only with its docs pages or a Docs-Unchanged trailer, e.g. task docs:fresh BASE=origin/main
`task docs:fresh:commit`	Staleness gate for the commit being written (commit-msg hook), e.g. task docs:fresh:commit MSG=.git/COMMIT_EDITMSG
`task docs:gen`	Generate the docs site’s reference and status pages into site/.gen (docs/dev/docs.md)
`task docs:refs`	Fail if a docs page names a kibi entity or a task that doesn’t exist
`task docs:serve`	Preview the docs site at http://localhost:1313/openfief/ (run task docs:build first for diagrams and generated pages)

e2e#

Task	What it does
`task e2e:images`	Build the core, operator, egress-proxy and demo-seed images from this checkout (Docker) and load them into the local e2e cluster, e.g. task e2e:images CLUSTER=k3d
`task e2e:k3s-image`	The k3s image the k3d e2e cluster runs: the demo machine’s pinned K3S_VERSION (CI passes it to k3d)

fmt#

Task	What it does
`task fmt:check`	Fail if Go code is not formatted

gen#

Task	What it does
`task gen:check`	Fail if generated code or manifests differ from what `task gen` writes

image#

Task	What it does
`task image:sign`	Keyless cosign signature of a pushed image (CI only, D-17), e.g. task image:sign IMAGE=ghcr.io/owner/openfief/x@sha256:…

kibi#

Task	What it does
`task kibi:check`	Validate the whole requirements knowledge base
`task kibi:doctor`	Diagnose the kibi setup
`task kibi:install`	Install the pinned kibi packages (npm ci)
`task kibi:report`	Requirement health report in kibi-report/ (the docs site publishes it at /requirements/)
`task kibi:search`	Search requirements, e.g. task kibi:search – egress proxy
`task kibi:staged`	kibi checks on staged changes (what the pre-commit hook runs)
`task kibi:status`	Show kibi branch and knowledge-base status
`task kibi:sync`	Compile this branch’s knowledge base (hooks run it after checkout, merge and rebase; CI sets KIBI_BRANCH)

lint#

Task	What it does
`task lint:ci`	Lint the GitHub Actions workflows (actionlint, offline)

plugins#

Task	What it does
`task plugins:labels`	Write each first-party plugin’s manifest label (D-42) into plugins/<name>/Dockerfile from its manifest.json
`task plugins:labels:check`	Fail if a plugin’s Dockerfile label, or a demo Plugin’s spec.manifest, differs from plugins/<name>/manifest.json

proto#

Task	What it does
`task proto:breaking`	Fail on breaking contract changes against a base revision (PROTO_BASE or DOCS_BASE, default HEAD), e.g. PROTO_BASE=origin/main task proto:breaking
`task proto:check`	Fail if sdk/go/gen or gen/openapi is not what proto:gen generates
`task proto:gen`	Generate the Go code for the contracts into sdk/go/gen and the read API’s OpenAPI into gen/openapi (pinned local plugins, no remote BSR)
`task proto:lint`	Lint and format-check the protobuf contracts (buf, STANDARD rules)

release#

Task	What it does
`task release:assets`	Package the CRDs and bootstrap install from deploy/, and the docs site as of this version, into dist/
`task release:check`	Validate a release version for its channel, e.g. task release:check CHANNEL=beta VERSION=2026.11.0-beta.1
`task release:notes`	Release notes from Conventional Commits since the previous release, e.g. task release:notes VERSION=2026.11.0
`task release:publish`	Tag the release and, for stable, publish the GitHub release (CI only, after the dry run)

setup#

Task	What it does
`task setup:ci`	CI setup (pinned tools, kibi, this branch’s knowledge base); no git hooks

test#

Task	What it does
`task test:pg`	PostgreSQL integration tests on a disposable server (OPENFIEF_PG_DSN, or local PostgreSQL binaries), e.g. task test:pg – -run TestAppend

trustroot#

Task	What it does
`task trustroot:update`	Refresh the operator’s bundled Sigstore trust root (D-56) through TUF; review the diff and commit it

Generated from the repository at build time; it cannot go stale.