feat: migrate mage gobuild to a mise task

.mise/tasks/build/go

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+#MISE description="Builds the application binary via 'go build'."
+
+set -euo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
+LIB_DIR="$DIR/../../../shell/lib"
+
+# shellcheck source=../../../shell/lib/bootstrap.sh
+source "$LIB_DIR/bootstrap.sh"
+# shellcheck source=../../../shell/lib/logging.sh
+source "$LIB_DIR/logging.sh"
+# shellcheck source=../../../shell/lib/shell.sh
+source "$LIB_DIR/shell.sh"
+# shellcheck source=../../../shell/lib/box.sh
+source "$LIB_DIR/box.sh"
+# shellcheck source=../../../shell/lib/secrets.sh
+source "$LIB_DIR/secrets.sh"
+
+ensure_bash_5_or_greater
+
+if [[ -d cmd ]]; then
+  buildPath="./cmd"
+elif [[ -d plugin ]]; then
+  buildPath="./plugin"
+else
+  warn "This repository produces no artifacts (no 'cmd' or 'plugin' directory found)"
+  exit 0
+fi
+
+mkdir -p bin
+
+# CGO_ENABLED: honor an already-set value (Makefile override, or a direct
+# caller like the CircleCI orb that doesn't go through Makefile at all);
+# otherwise derive it from service.yaml's enableCgo argument via the same
+# get_cgo_enabled helper shell/cgo-enabled.sh uses.
+: "${CGO_ENABLED:=$(get_cgo_enabled)}"
+export CGO_ENABLED
+
+appName="$(get_app_name)"
+
+read_secret_or_warn() {
+  local path="$1" label="$2"
+  local val
+  val="$(read_local_secret "$path" "$appName" 2>/dev/null || true)"
+  if [[ -z $val ]]; then
+    warn "Failed to get $label api key (did you run .bootstrap/shell/devconfig.sh?)" >&2
+  fi
+  echo "$val"
+}
+
+honeycombKey="$(read_secret_or_warn "honeycomb/apiKey" honeycomb)"
+teleforkKey="$(read_secret_or_warn "telefork/api-keys/default" telefork)"
+
+ldflags="-X github.com/getoutreach/gobox/pkg/app.Version=$(get_app_version)"
+ldflags+=" -X main.HoneycombTracingKey=${honeycombKey}"
+ldflags+=" -X main.TeleforkAPIKey=${teleforkKey}"
+if [[ -z ${DLV_PORT:-} ]]; then
+  ldflags+=" -w -s"
+fi
+
+goFlags=""
+if [[ -z ${KUBERNETES_SERVICE_HOST:-} ]]; then
+  goFlags="-tags=or_dev"
+fi
+
+args=(build -v -o bin -ldflags "$ldflags")
+if [[ -n ${GC_FLAGS:-} ]]; then
+  args+=(-gcflags "$GC_FLAGS")
+fi
+if [[ ${SKIP_TRIMPATH:-} != "true" ]]; then
+  args+=(-trimpath)
+fi
+args+=("$buildPath/...")
+
+envArgs=(GOFLAGS="$goFlags" GOPRIVATE="github.com/$(get_box_field org)/*")
+if [[ -n ${BUILD_FOR_GOOS:-} ]]; then
+  envArgs+=(GOOS="$BUILD_FOR_GOOS")
+fi
+
+info "Building..."
+env "${envArgs[@]}" go "${args[@]}"

orbs/shared/jobs/save_e2e_cache.yaml

@@ -69,7 +69,7 @@ steps:
             install_e2e_tools: true
         - run:
             name: Build to populate Go build/module caches
-            command: make build
+            command: mise run --quiet build:go
         # E2E cache with mise tool installs and Go caches for machine-executor jobs
         - save_cache:
             key: v1-e2e-daily-cache-{{ arch }}-{{ epoch }}

root/Magefile.go

@@ -58,70 +58,3 @@ func ensureBinDirExists(cwd string) (string, error) {
 	}
 	return binDir, nil
 }
-
-// GoBuild builds a Go project
-func Gobuild(ctx context.Context) error {
-	cwd, err := os.Getwd()
-	if err != nil {
-		return err
-	}
-
-	// TODO(jaredallard)[DT-2796]: This is a hack to get around the fact that plugins
-	// still don't implement the commands framework. Can remove when DT-2796 is done.
-	_, cmdErr := os.Stat("cmd")
-	_, pluginDirErr := os.Stat("plugin")
-	if cmdErr != nil && pluginDirErr != nil {
-		log.Warn().Msg("This repository produces no artifacts (no 'cmd' or 'plugin' directory found)")
-		return nil
-	}
-	binDir, err := ensureBinDirExists(cwd)
-	if err != nil {
-		return err
-	}
-
-	honeycombKey, err := readSecret(ctx, "honeycomb/apiKey")
-	if err != nil {
-		log.Warn().Err(err).Msg("Failed to get honeycomb api key (did you run .bootstrap/shell/devconfig.sh?)")
-	}
-
-	teleforkKey, err := readSecret(ctx, "telefork/api-keys/default")
-	if err != nil {
-		log.Warn().Err(err).Msg("Failed to get telefork api key (did you run .bootstrap/shell/devconfig.sh?)")
-	}
-
-	ldFlags := getLDFlagsStringFromMap(map[string]string{
-		"github.com/getoutreach/gobox/pkg/app.Version": getAppVersion(),
-		"main.HoneycombTracingKey":                     string(honeycombKey),
-		"main.TeleforkAPIKey":                          string(teleforkKey),
-	})
-	if os.Getenv("DLV_PORT") == "" {
-		// When not running in DLV, strip out symbols
-		ldFlags += "-w -s"
-	}
-
-	log.Info().Msg("Building...")
-
-	// TODO(jaredallard)[DT-2796]: This is a hack to get around the fact that plugins
-	// still don't implement the commands framework. Can remove when DT-2796 is done.
-	buildPath := "./cmd"
-	if pluginDirErr == nil {
-		buildPath = "./plugin"
-	}
-
-	args := []string{"build", "-v", "-o", binDir, "-ldflags", ldFlags}
-	if gcFlags := os.Getenv("GC_FLAGS"); gcFlags != "" {
-		args = append(args, "-gcflags", gcFlags)
-	}
-
-	// SKIP_TRIMPATH is used for devspace binary sync, where you want to have same file paths for delve to work correctly
-	if os.Getenv("SKIP_TRIMPATH") == "true" {
-		log.Debug().Msg("Skipping trimpath argument for go build")
-	} else {
-		// Build with -trimpath to ensure we have consistent module filenames embedded.
-		args = append(args, "-trimpath")
-	}
-
-	args = append(args, buildPath+"/...")
-
-	return runGoCommand(log, args...)
-}

root/Makefile

@@ -107,7 +107,8 @@ pre-commit: fmt
 
 ## build:           run codegen and build application binary
 .PHONY: build
-build:: pre-build gobuild
+build:: pre-build
+	@CGO_ENABLED=$(CGO_ENABLED) mise run --quiet build:go
 
 ## lint:            run code linters
 .PHONY: lint
@@ -157,10 +158,10 @@ gogenerate:: pre-gogenerate
 	@$(LOG) info "Running gogenerate"
 	@GOPROXY=$(GOPROXY) GOPRIVATE=$(GOPRIVATE) $(GO) generate ./...
 
-## gobuild:         build application binary
+## gobuild:         [DEPRECATED] build application binary
 .PHONY: gobuild
 gobuild:
-	@CGO_ENABLED=$(CGO_ENABLED) $(MAGE_CMD) gobuild
+	@./scripts/shell-wrapper.sh deprecated-task.sh gobuild build:go
 
 ## grpcui:          run grpcui for an already locally running service
 .PHONY: grpcui
@@ -181,7 +182,7 @@ devspace-watch:
 ## devspace:               build sources for linux with debugging symbols. To be used with devspace using `devenv apps run --sync-binaries .`
 .PHONY: devspace
 devspace:
-	@DEVBOX_LOGFMT="$(LOGFMT)" BUILD_FOR_GOOS="linux" CGO_ENABLED=$(CGO_ENABLED) SKIP_TRIMPATH="true" SKIP_STARTING_APP="true" DLV_PORT=42097 GC_FLAGS="all=-N -l" $(MAGE_CMD) gobuild
+	@DEVBOX_LOGFMT="$(LOGFMT)" BUILD_FOR_GOOS="linux" CGO_ENABLED=$(CGO_ENABLED) SKIP_TRIMPATH="true" SKIP_STARTING_APP="true" DLV_PORT=42097 GC_FLAGS="all=-N -l" mise run --quiet build:go
 	@DEVBOX_LOGFMT="$(LOGFMT)" BUILD_FOR_GOOS="linux" CGO_ENABLED=$(CGO_ENABLED) $(MAGE_CMD) e2etestbuild
 	@echo "Use 'devenv apps run --sync-binaries .' to sync binaries to devspace pod"
 

root/go.go

@@ -86,12 +86,3 @@ func runGoCommand(log zerolog.Logger, args ...string) error {
 
 	return sh.RunWith(vars, "go", args...)
 }
-
-// getLDFlagsStringFromMap returns a string of all the ldflags from the given map
-func getLDFlagsStringFromMap(ldflags map[string]string) string {
-	ldFlags := ""
-	for k, v := range ldflags {
-		ldFlags += fmt.Sprintf("-X %s=%s ", k, v)
-	}
-	return ldFlags
-}

shell/cgo-enabled.sh

@@ -4,13 +4,8 @@
 # value for the CGO_ENABLED environment variable. Defaults to disabled.
 
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
-YQ="$DIR/yq.sh"
 
 # shellcheck source=./lib/bootstrap.sh
 source "$DIR/lib/bootstrap.sh"
 
-if [[ "$("$YQ" -r ".arguments.enableCgo" <"$(get_service_yaml)")" == "true" ]]; then
-  echo "1"
-else
-  echo "0"
-fi
+get_cgo_enabled

shell/lib/bootstrap.sh

@@ -94,6 +94,16 @@ has_feature() {
   return 1
 }
 
+# get_cgo_enabled returns "1" if service.yaml has explicitly enabled cgo
+# via its enableCgo argument, or "0" otherwise.
+get_cgo_enabled() {
+  if has_feature "enableCgo"; then
+    echo "1"
+  else
+    echo "0"
+  fi
+}
+
 get_service_yaml() {
   if [[ -e "service.yaml" ]]; then
     echo "service.yaml"

shell/lib/bootstrap_test.bats

@@ -68,6 +68,32 @@ EOF
   assert_output "baz"
 }
 
+@test "get_cgo_enabled returns 1 when service.yaml enables cgo" {
+  cat >"$REPOPATH"/service.yaml <<EOF
+arguments:
+  enableCgo: true
+EOF
+  run get_cgo_enabled
+  assert_output "1"
+}
+
+@test "get_cgo_enabled returns 0 when service.yaml does not enable cgo" {
+  cat >"$REPOPATH"/service.yaml <<EOF
+arguments:
+  enableCgo: false
+EOF
+  run get_cgo_enabled
+  assert_output "0"
+}
+
+@test "get_cgo_enabled returns 0 when enableCgo is unset" {
+  cat >"$REPOPATH"/service.yaml <<EOF
+arguments:
+EOF
+  run get_cgo_enabled
+  assert_output "0"
+}
+
 @test "stencil_module_version returns the version from stencil.lock" {
   # Create a mock stencil.lock file
   cat >"$REPOPATH"/stencil.lock <<EOF

shell/lib/secrets.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Read local secret material written by devconfig.sh.
+
+LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
+
+# shellcheck source=./bootstrap.sh
+source "$LIB_DIR/bootstrap.sh"
+
+# OUTREACH_SECRETS_DIR is the first well-known location read_local_secret
+# checks. Overridable (like box.sh's BOXPATH) so tests don't have to write
+# into the real /run/secrets/outreach.io.
+OUTREACH_SECRETS_DIR="${OUTREACH_SECRETS_DIR:-/run/secrets/outreach.io}"
+
+# OUTREACH_LOCAL_SECRETS_DIR is the base of the second, fallback location
+# read_local_secret checks. Defaults to ~/.outreach (like devconfig.sh's
+# convention), but is independently overridable (like OUTREACH_SECRETS_DIR
+# above) so tests can point it elsewhere without reassigning the real
+# $HOME (which mise's shims resolve tools against).
+OUTREACH_LOCAL_SECRETS_DIR="${OUTREACH_LOCAL_SECRETS_DIR:-$HOME/.outreach}"
+
+# read_local_secret reads a secret from the well-known local paths used by
+# devconfig.sh: $OUTREACH_SECRETS_DIR/<path>, falling back to
+# $OUTREACH_LOCAL_SECRETS_DIR/<appName>/<path>. Prints nothing and returns
+# non-zero if not found in either location. appName defaults to
+# get_app_name, but can be passed explicitly to avoid re-invoking it when
+# reading multiple secrets in the same script.
+read_local_secret() {
+  local path="$1"
+  local appName="${2:-$(get_app_name)}"
+
+  local candidates=(
+    "$OUTREACH_SECRETS_DIR/$path"
+    "$OUTREACH_LOCAL_SECRETS_DIR/$appName/$path"
+  )
+  for candidate in "${candidates[@]}"; do
+    if [[ -e $candidate ]]; then
+      cat "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}