pub fn push_error(&mut self, task: Option<&str>, field: Option<&str>, message: impl Into<String>) {

    self.issues.push(ValidationIssue {

      severity: ValidationSeverity::Error,

      task: task.map(str::to_string),

      field: field.map(str::to_string),

      message: message.into(),

    });

  }

  pub fn push_warning(&mut self, task: Option<&str>, field: Option<&str>, message: impl Into<String>) {

    self.issues.push(ValidationIssue {

      severity: ValidationSeverity::Warning,

      task: task.map(str::to_string),

      field: field.map(str::to_string),

      message: message.into(),

    });

  }

  pub fn has_errors(&self) -> bool {

    self

      .issues

      .iter()

      .any(|issue| issue.severity == ValidationSeverity::Error)

  }

  pub fn sort_issues(&mut self) {

    self.issues.sort_by(|left, right| {

      severity_rank(&left.severity)

        .cmp(&severity_rank(&right.severity))

        .then_with(|| {

          left

            .task

            .as_deref()

            .unwrap_or("")

            .cmp(right.task.as_deref().unwrap_or(""))

        })

        .then_with(|| {

          left

            .field

            .as_deref()

            .unwrap_or("")

            .cmp(right.field.as_deref().unwrap_or(""))

        })

        .then_with(|| left.message.cmp(&right.message))

    });

  }

fn severity_rank(severity: &ValidationSeverity) -> u8 {

  match severity {

    ValidationSeverity::Error => 0,

    ValidationSeverity::Warning => 1,

}

  pub fn validate(&self) -> ValidationReport {

    let mut report = ValidationReport::default();

    self.validate_root(&mut report);

    for (task_name, task) in &self.tasks {

      self.validate_task(task_name, task, &mut report);

    }

    self.validate_cycles(&mut report);

    report.sort_issues();

    report

  }

  fn validate_root(&self, report: &mut ValidationReport) {

    if let Some(use_npm) = &self.use_npm {

    }

    if let Some(use_cargo) = &self.use_cargo {

    }

    if let Some(includes) = &self.include {

    }

    self.validate_runtime(

      None,

      Some("container_runtime"),

      self.container_runtime.as_ref(),

      report,

    self.validate_legacy_secret_settings_usage(None, &self.validation_legacy_secret_settings(), report);

    self.validate_secret_setting_combinations(

      None,

      self.raw_secrets.as_ref().or(self.secrets.as_ref()),

      &self.validation_legacy_secret_settings(),

      report,

  }

  fn validate_task(&self, task_name: &str, task: &Task, report: &mut ValidationReport) {

    match task {

      Task::Task(task) => {

        if task.commands.is_empty() {

        }

        for dependency in &task.depends_on {

          let dependency_name = dependency.resolve_name();

          if dependency_name.is_empty() {

          } else if dependency_name == task_name {

          } else if !self.tasks.contains_key(dependency_name) {

            report.push_error(

              Some(task_name),

              Some("depends_on"),

              format!("Missing dependency: {}", dependency_name),

            );

          }

        if task.is_parallel() {

          for command in &task.commands {

              CommandRunner::LocalRun(local_run) if local_run.is_parallel_safe() => {},

          if task

            .environment

            .values()

            .any(|value| contains_output_reference(value))

            || task.commands.iter().any(command_uses_task_outputs)

          {

            report.push_error(

              Some(task_name),

              Some("execution.mode"),

              "Parallel execution does not support saved command outputs",

            );

          }

        }

        if let Some(execution) = &task.execution {

          if let Some(max_parallel) = execution.max_parallel {

          }

        }

        if task.cache.as_ref().map(|cache| cache.enabled).unwrap_or(false) && task.outputs.is_empty() {

        }

        if task.cache.as_ref().map(|cache| cache.enabled).unwrap_or(false)

          && !task.depends_on.is_empty()

          && task.inputs.is_empty()

        {

          report.push_warning(

            Some(task_name),

            Some("inputs"),

            "Cached task depends_on other tasks but declares no inputs; dependency side effects may bypass cache invalidation",

          );

        }

        if task.cache.as_ref().map(|cache| cache.enabled).unwrap_or(false)

          && task.inputs.is_empty()

          && task_uses_dynamic_runtime_inputs(task)

        {

          report.push_warning(

            Some(task_name),

            Some("inputs"),

            "Cached task contains shell-derived or runtime-derived command inputs but declares no inputs; cache invalidation may miss external changes",

          );

        }

        for command in &task.commands {

          self.validate_command(task_name, command, report);

        }

        self.validate_legacy_secret_settings_usage(

          Some(task_name),

          &task.validation_legacy_secret_settings(),

          report,

        self.validate_secret_setting_combinations(

          Some(task_name),

          task.raw_secrets.as_ref().or(task.secrets.as_ref()),

          &task.validation_legacy_secret_settings(),

          report,

        self.validate_command_outputs(task_name, task, report);

        self.validate_labels(task_name, task, report);

  }

  fn validate_labels(&self, task_name: &str, task: &super::TaskArgs, report: &mut ValidationReport) {

    for (key, value) in &task.labels {

      if key.trim().is_empty() {

        report.push_warning(Some(task_name), Some("labels"), "Label key must not be empty");

      } else if key.starts_with("mk.") {

        report.push_warning(

          Some(task_name),

          Some("labels"),

          format!("Label key '{}' uses reserved 'mk.' prefix", key),

        );

      }

      if value.trim().is_empty() {

        report.push_warning(

          Some(task_name),

          Some("labels"),

          format!("Label '{}' has an empty value", key),

        );

      }

  }

  fn validate_secret_setting_combinations(

    &self,

    task_name: Option<&str>,

    secrets_block: Option<&SecretSettings>,

    legacy: &SecretSettings,

    report: &mut ValidationReport,

  ) {

    self.validate_legacy_secret_conflicts(task_name, secrets_block, legacy, report);

    let effective = merge_optional_secret_settings(Some(legacy.clone()), secrets_block.cloned());

    let Some(effective) = effective.filter(|settings| !settings.is_empty()) else {

      return;

    let backend = effective.resolved_backend();

    let explicit_key_name = secrets_block

      .and_then(|settings| settings.key_name.as_ref())

      .or(legacy.key_name.as_ref());

    let explicit_keys_location = secrets_block

      .and_then(|settings| settings.keys_location.as_ref())

      .or(legacy.keys_location.as_ref());

    match backend {

        if effective.gpg_key_id.is_none() {

          report.push_error(

            task_name,

            Some("secrets.gpg_key_id"),

            "GPG backend requires gpg_key_id",

          );

        }

        if explicit_key_name.is_some() || explicit_keys_location.is_some() {

          report.push_error(

            task_name,

            Some("secrets"),

            "GPG backend cannot be combined with PGP-only settings: key_name, keys_location",

          );

        }

        if effective.key_name.is_none() {

          report.push_error(

            task_name,

            Some("secrets.key_name"),

            "PGP backend requires key_name",

          );

        }

        if effective.keys_location.is_none() && !pgp_default_keys_location_applies() {

        }

  }

  fn validate_legacy_secret_conflicts(

    &self,

    task_name: Option<&str>,

    secrets_block: Option<&SecretSettings>,

    legacy: &SecretSettings,

    report: &mut ValidationReport,

  ) {

    let Some(secrets_block) = secrets_block else {

      return;

    validate_secret_field_conflict(

      task_name,

      "vault_location",

      legacy.vault_location.as_ref(),

      secrets_block.vault_location.as_ref(),

      report,

    validate_secret_field_conflict(

      task_name,

      "keys_location",

      legacy.keys_location.as_ref(),

      secrets_block.keys_location.as_ref(),

      report,

    validate_secret_field_conflict(

      task_name,

      "key_name",

      legacy.key_name.as_ref(),

      secrets_block.key_name.as_ref(),

      report,

    validate_secret_field_conflict(

      task_name,

      "gpg_key_id",

      legacy.gpg_key_id.as_ref(),

      secrets_block.gpg_key_id.as_ref(),

      report,

    validate_secret_field_conflict(

      task_name,

      "secrets_path",

      legacy.secrets_path.as_ref(),

      secrets_block.secrets_path.as_ref(),

      report,

  }

  fn validate_legacy_secret_settings_usage(

    &self,

    task_name: Option<&str>,

    legacy: &SecretSettings,

    report: &mut ValidationReport,

  ) {

    if legacy.is_empty() {

      return;

    }

    report.push_warning(

      task_name,

      Some("secrets"),

  }

  fn validate_command(&self, task_name: &str, command: &CommandRunner, report: &mut ValidationReport) {

    match command {

      CommandRunner::LocalRun(local_run) => {

        if local_run.command.trim().is_empty() {

        }

        if let Some(save_output_as) = &local_run.save_output_as {

          if save_output_as.trim().is_empty() {

          }

        }

        if local_run.interactive_enabled() && local_run.retrigger_enabled() {

          report.push_error(

            Some(task_name),

            Some("retrigger"),

            "retrigger is only supported for non-interactive local commands",

          );

        }

  }

  fn validate_command_outputs(&self, task_name: &str, task: &super::TaskArgs, report: &mut ValidationReport) {

    let declared_outputs = task

      .commands

      .iter()

      .filter_map(|command| match command {

        CommandRunner::LocalRun(local_run) => local_run.save_output_as.as_ref(),

      })

      .map(|name| name.trim().to_string())

      .filter(|name| !name.is_empty())

      .collect::<HashSet<_>>();

    for value in task.environment.values() {

      for output_name in extract_output_references(value) {

        if !declared_outputs.contains(&output_name) {

          report.push_error(

            Some(task_name),

            Some("environment"),

            format!("Unknown task output reference: {}", output_name),

          );

        }

    let mut produced_outputs = HashSet::new();

    for command in &task.commands {

      match command {

        CommandRunner::LocalRun(local_run) => {

          for output_name in extract_output_references(&local_run.command) {

            if !produced_outputs.contains(&output_name) {

              report.push_error(

                Some(task_name),

                Some("command"),

                format!(

                  "Output reference must come from an earlier command: {}",

                  output_name

                ),

              );

            }

          if let Some(test) = &local_run.test {

          }

          if let Some(save_output_as) = &local_run.save_output_as {

            let save_output_as = save_output_as.trim().to_string();

            if !save_output_as.is_empty() && !produced_outputs.insert(save_output_as.clone()) {

              report.push_error(

                Some(task_name),

                Some("save_output_as"),

                format!("Duplicate saved output name: {}", save_output_as),

              );

            }

          }

  }

  fn validate_runtime(

    &self,

    task: Option<&str>,

    field: Option<&str>,

    runtime: Option<&ContainerRuntime>,

    report: &mut ValidationReport,

  ) {

    if let Some(runtime) = runtime {

    }

  }

  fn validate_cycles(&self, report: &mut ValidationReport) {

    let mut visited = HashSet::new();

    let mut visiting = Vec::new();

    for task_name in self.tasks.keys() {

      self.detect_cycle(task_name, &mut visiting, &mut visited, report);

    }

  }

  fn detect_cycle(

    &self,

    task_name: &str,

    visiting: &mut Vec<String>,

    visited: &mut HashSet<String>,

    report: &mut ValidationReport,

  ) {

    if visited.contains(task_name) {

      return;

    }

    if let Some(index) = visiting.iter().position(|name| name == task_name) {

      let mut cycle = visiting[index..].to_vec();

      cycle.push(task_name.to_string());

      report.push_error(

        Some(task_name),

        Some("depends_on"),

        format!("Circular dependency detected: {}", cycle.join(" -> ")),

      return;

    }

    visiting.push(task_name.to_string());

    if let Some(Task::Task(task)) = self.tasks.get(task_name) {

      for dependency in &task.depends_on {

        self.detect_cycle(dependency.resolve_name(), visiting, visited, report);

      }

      for command in &task.commands {

        if let CommandRunner::TaskRun(task_run) = command {

        }

    }

    visiting.pop();

    visited.insert(task_name.to_string());

  }

fn validate_secret_field_conflict<T: PartialEq>(

  task_name: Option<&str>,

  field_name: &str,

  legacy: Option<&T>,

  secrets_block: Option<&T>,

  report: &mut ValidationReport,

) {

  if legacy.is_some() && secrets_block.is_some() && legacy != secrets_block {

    report.push_error(

      task_name,

      Some("secrets"),

      format!(

        "Legacy secret field '{}' conflicts with `secrets.{}`",

        field_name, field_name

      ),

    );

  }

}

fn pgp_default_keys_location_applies() -> bool {

  true

}

fn command_uses_task_outputs(command: &CommandRunner) -> bool {

  match command {

    CommandRunner::LocalRun(local_run) => {

      local_run.save_output_as.is_some()

}

fn task_uses_dynamic_runtime_inputs(task: &super::TaskArgs) -> bool {

  task.commands.iter().any(command_uses_dynamic_runtime_inputs)

    || task

      .preconditions

      .iter()

      .any(precondition_uses_dynamic_runtime_inputs)

}

fn command_uses_dynamic_runtime_inputs(command: &CommandRunner) -> bool {

  match command {

    CommandRunner::LocalRun(local_run) => {

      contains_dynamic_runtime_fragment(&local_run.command)

        || local_run

          .test

          .as_ref()

          .is_some_and(|test| contains_dynamic_runtime_fragment(test))

}

fn contains_dynamic_runtime_fragment(value: &str) -> bool {

  value.contains("$(")

    || value.contains('`')

    || value.contains("MK_NOW")

    || value.contains("MK_GIT_REVISION")

    || value.contains("MK_GIT_REMOTE_ORIGIN")

}

  fn has_error(report: &ValidationReport, field: &str, message: &str) -> bool {

    report.issues.iter().any(|issue| {

      issue.severity == ValidationSeverity::Error

        && issue.field.as_deref() == Some(field)

        && issue.message == message

    })

  }

  fn test_validate_retrigger_requires_non_interactive_local_run() -> anyhow::Result<()> {

    let yaml = r#"

      tasks:

        dev:

          commands:

            - command: "go run ."

              interactive: true

              retrigger: true

    "#;

    let task_root = serde_yaml::from_str::<TaskRoot>(yaml)?;

    let report = task_root.validate();

    assert!(report.issues.iter().any(|issue| {

      issue.field.as_deref() == Some("retrigger")

        && issue.message == "retrigger is only supported for non-interactive local commands"

    }));

    Ok(())

  }

  fn test_validate_rejects_gpg_backend_without_gpg_key_id() -> anyhow::Result<()> {

    let yaml = r#"

      secrets:

        backend: gpg

      tasks:

        demo:

          commands:

            - command: echo ready

    "#;

    let task_root = serde_yaml::from_str::<TaskRoot>(yaml)?;

    let report = task_root.validate();

    assert!(has_error(

      &report,

      "secrets.gpg_key_id",

      "GPG backend requires gpg_key_id"

    Ok(())

  }

  fn test_validate_rejects_pgp_backend_without_key_name() -> anyhow::Result<()> {

    let yaml = r#"

      secrets:

        backend: built_in_pgp

        keys_location: ./.mk/keys

      tasks:

        demo:

          commands:

            - command: echo ready

    "#;

    let task_root = serde_yaml::from_str::<TaskRoot>(yaml)?;

    let report = task_root.validate();

    assert!(has_error(

      &report,

      "secrets.key_name",

      "PGP backend requires key_name"

    Ok(())

  }

  fn test_validate_allows_pgp_backend_without_keys_location_when_default_applies() -> anyhow::Result<()> {

    let yaml = r#"

      secrets:

        backend: built_in_pgp

        key_name: team

      tasks:

        demo:

          commands:

            - command: echo ready

    "#;

    let task_root = serde_yaml::from_str::<TaskRoot>(yaml)?;

    let report = task_root.validate();

    assert!(!report

      .issues

      .iter()

      .any(|issue| issue.field.as_deref() == Some("secrets.keys_location")));

    Ok(())

  }

  fn test_validate_rejects_gpg_backend_with_pgp_only_settings() -> anyhow::Result<()> {

    let yaml = r#"

      tasks:

        demo:

          secrets:

            backend: gpg

            gpg_key_id: TEAMKEY

            key_name: team

            keys_location: ./.mk/keys

          commands:

            - command: echo ready

    "#;

    let task_root = serde_yaml::from_str::<TaskRoot>(yaml)?;

    let report = task_root.validate();

    assert!(has_error(

      &report,

      "secrets",

      "GPG backend cannot be combined with PGP-only settings: key_name, keys_location"

    Ok(())

  }

  fn test_validate_rejects_conflicting_legacy_and_secrets_block_values() -> anyhow::Result<()> {

    let yaml = r#"

      vault_location: ./.mk/legacy-vault

      secrets:

        vault_location: ./.mk/new-vault

      tasks:

        demo:

          commands:

            - command: echo ready

    "#;

    let task_root = serde_yaml::from_str::<TaskRoot>(yaml)?;

    let report = task_root.validate();

    assert!(has_error(

      &report,

      "secrets",

      "Legacy secret field 'vault_location' conflicts with `secrets.vault_location`"

    Ok(())

  }

  fn has_warning(report: &ValidationReport, field: &str, message: &str) -> bool {

    report.issues.iter().any(|issue| {

      issue.severity == ValidationSeverity::Warning

        && issue.field.as_deref() == Some(field)

        && issue.message == message

    })

  }

  fn test_validate_warns_on_empty_label_key() -> anyhow::Result<()> {

    let yaml = r#"

      tasks:

        demo:

          commands:

            - command: echo ready

          labels:

            "": present

    "#;

    let task_root = serde_yaml::from_str::<TaskRoot>(yaml)?;

    let report = task_root.validate();

    assert!(has_warning(&report, "labels", "Label key must not be empty"));

    Ok(())

  }

  fn test_validate_warns_on_empty_label_value() -> anyhow::Result<()> {

    let yaml = r#"

      tasks:

        demo:

          commands:

            - command: echo ready

          labels:

            area: ""

    "#;

    let task_root = serde_yaml::from_str::<TaskRoot>(yaml)?;

    let report = task_root.validate();

    assert!(has_warning(&report, "labels", "Label 'area' has an empty value"));

    Ok(())

  }

  fn test_validate_warns_on_reserved_mk_prefix() -> anyhow::Result<()> {

    let yaml = r#"

      tasks:

        demo:

          commands:

            - command: echo ready

          labels:

            mk.internal: reserved

    "#;

    let task_root = serde_yaml::from_str::<TaskRoot>(yaml)?;

    let report = task_root.validate();

    assert!(has_warning(

      &report,

      "labels",

      "Label key 'mk.internal' uses reserved 'mk.' prefix"

    Ok(())

  }

  fn test_validate_allows_valid_labels() -> anyhow::Result<()> {

    let yaml = r#"

      tasks:

        demo:

          commands:

            - command: echo ready

          labels:

            area: ci

            kind: test

    "#;

    let task_root = serde_yaml::from_str::<TaskRoot>(yaml)?;

    let report = task_root.validate();

    assert!(!report

      .issues

      .iter()

      .any(|issue| issue.field.as_deref() == Some("labels")));

    Ok(())

  }

  fn test_validate_warns_for_cached_dynamic_command_without_inputs() -> anyhow::Result<()> {

    let yaml = r#"

      tasks:

        build:

          outputs:

            - output.txt

          cache:

            enabled: true

          commands:

            - command: echo $(git rev-parse HEAD) > output.txt

    "#;

    let task_root = serde_yaml::from_str::<TaskRoot>(yaml)?;

    let report = task_root.validate();

    assert!(has_warning(

      &report,

      "inputs",

      "Cached task contains shell-derived or runtime-derived command inputs but declares no inputs; cache invalidation may miss external changes"

    Ok(())

  }

  fn test_validate_does_not_warn_for_cached_dynamic_command_with_inputs() -> anyhow::Result<()> {

    let yaml = r#"

      tasks:

        build:

          inputs:

            - .git/HEAD

          outputs:

            - output.txt

          cache:

            enabled: true

          commands:

            - command: echo $(git rev-parse HEAD) > output.txt

    "#;

    let task_root = serde_yaml::from_str::<TaskRoot>(yaml)?;

    let report = task_root.validate();

    assert!(!has_warning(

      &report,

      "inputs",

      "Cached task contains shell-derived or runtime-derived command inputs but declares no inputs; cache invalidation may miss external changes"

    ));

    Ok(())

  }