Merged in feature/service-accounts-1 (pull request #227)

Support for service accounts with static credentials

* feature complete

* tests and docs

* lint fix

scripts/Taskfile.yml

@@ -25,6 +25,7 @@ includes:
 
 tasks:
   fullsuite:
+    desc: "Generate, build, lint, and run functional tests (incremental by default)"
     vars:
       INCREMENTAL: "{{.INCREMENTAL | default \"true\"}}"
     cmds:
@@ -34,21 +35,31 @@ tasks:
         vars:
           INCREMENTAL: "{{.INCREMENTAL}}"
   fullsuite:ci:
-    - task: fullsuite
-      vars:
-        INCREMENTAL: "false"
+    desc: "Full CI run of fullsuite with INCREMENTAL=false (must pass clean)"
+    cmds:
+      - task: fullsuite
+        vars:
+          INCREMENTAL: "false"
   fullsuite:build:
     internal: true
     cmds:
       - task: build
       - task: lint
-  fullsuite:graph: psrecord "task fullsuite" --plot out/fullsuite.png --interval 0.1 --include-children
+  fullsuite:graph:
+    desc: "Run fullsuite under psrecord and plot CPU/memory to out/fullsuite.png"
+    cmds:
+      - psrecord "task fullsuite" --plot out/fullsuite.png --interval 0.1 --include-children
   precommit:
-    - task: lint
+    desc: "Pre-commit checks (runs all linters) for CI/CD readiness"
+    cmds:
+      - task: lint
   deps:tidy:
-    - go mod tidy
-    - go mod vendor
+    desc: "Run go mod tidy and refresh the vendor directory"
+    cmds:
+      - go mod tidy
+      - go mod vendor
   build:
+    desc: "Generate code and build the queryorchestration docker image"
     deps:
       - build:deps
     cmd:
@@ -60,6 +71,7 @@ tasks:
       - task: deps:tidy
       - task: generate
   generate:
+    desc: "Run all code generators (db, openapi, docs, go generate)"
     run: once
     cmds:
       - task: db:generate
@@ -67,8 +79,12 @@ tasks:
       # NOTE: test:mocks:generate removed - mocks are deprecated
       - task: docs:generate
       - task: go:generate
-  go:generate: go generate ./...
+  go:generate:
+    desc: "Run `go generate ./...` across the module"
+    cmds:
+      - go generate ./...
   lint:
+    desc: "Run every linter (db, go, yaml, json, docker, openapi, compose)"
     cmds:
       - task: db:lint
       - task: go:lint
@@ -78,11 +94,20 @@ tasks:
       - task: openapi:lint
       - task: compose:lint
   go:lint:
-    - golangci-lint run {{.CLI_ARGS}}
-    # - govulncheck ./...
-  yaml:lint: yamllint . -s {{.CLI_ARGS}}
-  json:lint: jsonlint devbox.json -q -s -i {{.CLI_ARGS}}
+    desc: "Run golangci-lint over the module"
+    cmds:
+      - golangci-lint run {{.CLI_ARGS}}
+      # - govulncheck ./...
+  yaml:lint:
+    desc: "Lint all YAML files in the repo with yamllint"
+    cmds:
+      - yamllint . -s {{.CLI_ARGS}}
+  json:lint:
+    desc: "Lint devbox.json with jsonlint"
+    cmds:
+      - jsonlint devbox.json -q -s -i {{.CLI_ARGS}}
   docs:generate:
+    desc: "Regenerate Go package docs under cmd/ via gomarkdoc"
     run: once
     cmds:
       - gomarkdoc --template-file file=docs/templates/root.gotxt ./cmd/...
@@ -90,15 +115,22 @@ tasks:
     desc: "Generate full system docs ($$)"
     cmds:
       - bash docs/ai.generated/prompts/regenerate_docs.sh docs/ai.generated/prompts/prompt.for.system.documentation.generation.md
-  aws:login: aws sso login
+  aws:login:
+    desc: "Authenticate to AWS via SSO (`aws sso login`)"
+    cmds:
+      # Unset AWS_ENDPOINT_URL for this call only — LocalStack override in .env
+      # otherwise redirects the SSO OIDC RegisterClient call to localhost:4566.
+      - env -u AWS_ENDPOINT_URL aws sso login
   aws:textract:credentials:
-    - |
-      sed -i '/^AWS_REGION_TEXTRACT\|^AWS_ACCESS_KEY_ID_TEXTRACT\|^AWS_SECRET_ACCESS_KEY_TEXTRACT\|^AWS_SESSION_TOKEN_TEXTRACT/d' .env
-      echo "AWS_REGION_TEXTRACT=$(aws configure get region --profile $AWS_PROFILE)" >> .env
-      CREDENTIALS_JSON=$(aws configure export-credentials --profile $AWS_PROFILE)
-      echo "AWS_ACCESS_KEY_ID_TEXTRACT=$(echo $CREDENTIALS_JSON | jq -r '.AccessKeyId')" >> .env
-      echo "AWS_SECRET_ACCESS_KEY_TEXTRACT=$(echo $CREDENTIALS_JSON | jq -r '.SecretAccessKey')" >> .env
-      echo "AWS_SESSION_TOKEN_TEXTRACT=$(echo $CREDENTIALS_JSON | jq -r '.SessionToken')" >> .env
+    desc: "Refresh AWS_*_TEXTRACT credentials in .env from the current AWS profile"
+    cmds:
+      - |
+        sed -i '/^AWS_REGION_TEXTRACT\|^AWS_ACCESS_KEY_ID_TEXTRACT\|^AWS_SECRET_ACCESS_KEY_TEXTRACT\|^AWS_SESSION_TOKEN_TEXTRACT/d' .env
+        echo "AWS_REGION_TEXTRACT=$(aws configure get region --profile $AWS_PROFILE)" >> .env
+        CREDENTIALS_JSON=$(aws configure export-credentials --profile $AWS_PROFILE)
+        echo "AWS_ACCESS_KEY_ID_TEXTRACT=$(echo $CREDENTIALS_JSON | jq -r '.AccessKeyId')" >> .env
+        echo "AWS_SECRET_ACCESS_KEY_TEXTRACT=$(echo $CREDENTIALS_JSON | jq -r '.SecretAccessKey')" >> .env
+        echo "AWS_SESSION_TOKEN_TEXTRACT=$(echo $CREDENTIALS_JSON | jq -r '.SessionToken')" >> .env
   dev:queryAPI:
     desc: "Run queryAPI locally with version info"
     vars: