scope included vars to their namespace

Author: dgageot

AGENTS.md

@@ -122,7 +122,6 @@ The Go toolchain version comes from `go.mod` (`go 1.26.3`). Tests run with
   env → preconditions → up-to-date → cmds), and cover it with a literal
   `taskfile.Config` test in `run_test.go` plus a `Parse`-based test in
   `parse_test.go` if YAML shape matters.
-- **Touching env/var resolution**: respect the existing precedence
 - **Touching env/var resolution**: respect the existing precedence
   (`BaseEnv` < parent task env < task dotenv < task vars < task env) and the
   rule that *task dotenv never overrides global dotenv or OS env* (see
@@ -135,13 +134,23 @@ The Go toolchain version comes from `go.mod` (`go 1.26.3`). Tests run with
   resolve lazily through a recursive lookup in `resolveAllVars` (see
   `taskfile/vars.go`); they may reference each other and the built-in
   `GIT_*` family transitively, declaration order is irrelevant, and
-  cycles short-circuit to the empty string. The built-in `GIT_*`
-  resolver in `taskfile/gitvars.go` is wired through
-  `Runner.builtinLookup` and is consulted *after* user vars / CLI_ARGS
-  but *before* the process environment by `expandVars`,
-  `resolveEnvValue`, and `checkRequires`. Watch mode must call
-  `ResetRan` between iterations — it also clears the gitVars cache so
-  `{{.GIT_DIRTY}}` re-evaluates after each edit.
+  cycles short-circuit to the empty string. **Vars are namespace-scoped**:
+  a var declared in an included `gogo.yaml` lives in
+  `Config.NamespaceVars[namespace]` (with its own working dir in
+  `Config.NamespaceDirs[namespace]` for `sh:` resolution) and is visible
+  only to tasks at or below that namespace — sibling includes never see
+  each other's vars (see `TestNamespacedVarsIsolateSiblings`). Root vars
+  in `Config.Vars` stay visible everywhere. The most-specific namespace
+  wins on collisions, so `proxy:` and `metrics:` can each declare their
+  own `LDFLAGS` without clobbering. The built-in `GIT_*` resolver in
+  `taskfile/gitvars.go` is wired through `Runner.builtinLookup` and is
+  consulted *after* user vars / CLI_ARGS but *before* the process
+  environment by `expandVars`, `resolveEnvValue`, and `checkRequires`.
+  Unresolved `${VAR}` references survive verbatim through
+  `unknownShellVarSpan`; in particular `$2` (awk positional) is **not**
+  rewritten to `${2}` (see `TestShVarPreservesAwkPositional`). Watch mode
+  must call `ResetRan` between iterations — it also clears the gitVars
+  cache so `{{.GIT_DIRTY}}` re-evaluates after each edit.
 - **Touching include logic**: cycles must be detected by absolute dir
   (`includeStack`), nested namespaces are colon-joined
   (`parent:child:grandchild`), and dotenv files dedupe globally via

taskfile/includes.go

@@ -71,6 +71,8 @@ func newIncludeLoader(root *Config) (*includeLoader, error) {
 
 func (l *includeLoader) load() (*Config, error) {
 	l.root.Namespaces = make(map[string]string)
+	l.root.NamespaceDirs = make(map[string]string)
+	l.root.NamespaceVars = make(map[string]map[string]Var)
 
 	// Process flatten files first (their tasks merge into the root namespace).
 	// Order vs. includes doesn't matter for correctness because both honor
@@ -167,7 +169,7 @@ func (l *includeLoader) loadInclude(req includeRequest) error {
 		}
 	}
 
-	l.mergeVars(included.Vars)
+	l.mergeVars(included.Namespace, included.Dir, included.Vars)
 	l.mergeSourcePresets(included.Sources)
 	l.mergeSecrets(included.Secrets)
 	return l.mergeTasks(included)
@@ -199,6 +201,7 @@ func (l *includeLoader) parseInclude(req includeRequest) (*includedConfig, error
 		Parent:    req,
 	}
 	l.root.Namespaces[childDir] = req.namespace
+	l.root.NamespaceDirs[req.namespace] = childDir
 	return included, nil
 }
 
@@ -303,7 +306,7 @@ func (l *includeLoader) loadFlatten(req flattenRequest) error {
 		}
 	}
 
-	l.mergeVars(flattened.Vars)
+	l.mergeVars(req.namespace, req.ancestorDir, flattened.Vars)
 	l.mergeSourcePresets(flattened.Sources)
 	return l.mergeFlattenedTasks(flattened, req.namespace, req.ancestorDir)
 }
@@ -315,17 +318,40 @@ func namespaceJoin(prefix, name string) string {
 	return prefix + ":" + name
 }
 
-// mergeVars merges child global vars into the root. Root vars win conflicts.
-func (l *includeLoader) mergeVars(vars map[string]Var) {
+// mergeVars merges vars declared by an included or flattened file into the
+// scope that owns them. Vars from the root or root-level flatten files
+// (namespace "") land in Config.Vars and are visible everywhere; vars from
+// an include land in Config.NamespaceVars[namespace] and are visible only
+// to tasks that live at or below that namespace — so two sibling includes
+// can each declare their own LDFLAGS/IMAGE_NAME without leaking values
+// into each other. "First defined wins" still holds within each scope,
+// matching the prior root-merge precedence.
+func (l *includeLoader) mergeVars(namespace, dir string, vars map[string]Var) {
 	if len(vars) == 0 {
 		return
 	}
-	if l.root.Vars == nil {
-		l.root.Vars = make(map[string]Var)
+	if namespace == "" {
+		if l.root.Vars == nil {
+			l.root.Vars = make(map[string]Var)
+		}
+		for k, v := range vars {
+			if _, exists := l.root.Vars[k]; !exists {
+				l.root.Vars[k] = v
+			}
+		}
+		return
+	}
+	if _, ok := l.root.NamespaceDirs[namespace]; !ok {
+		l.root.NamespaceDirs[namespace] = dir
+	}
+	scoped := l.root.NamespaceVars[namespace]
+	if scoped == nil {
+		scoped = make(map[string]Var)
+		l.root.NamespaceVars[namespace] = scoped
 	}
 	for k, v := range vars {
-		if _, exists := l.root.Vars[k]; !exists {
-			l.root.Vars[k] = v
+		if _, exists := scoped[k]; !exists {
+			scoped[k] = v
 		}
 	}
 }

taskfile/parse_test.go

@@ -184,8 +184,13 @@ tasks:
 	tf, err := LoadWithIncludes(dir)
 	require.NoError(t, err)
 
-	assert.Contains(t, tf.Vars, "VERSION")
-	assert.Equal(t, "1.2.3", tf.Vars["VERSION"].Value)
+	// Child vars are scoped to their include's namespace, not leaked into the
+	// root — a sibling include can declare its own VERSION without clashing.
+	assert.NotContains(t, tf.Vars, "VERSION", "included vars must not leak into the root namespace")
+	require.Contains(t, tf.NamespaceVars, "child")
+	assert.Contains(t, tf.NamespaceVars["child"], "VERSION")
+	assert.Equal(t, "1.2.3", tf.NamespaceVars["child"]["VERSION"].Value)
+	assert.Equal(t, filepath.Join(dir, "child"), tf.NamespaceDirs["child"])
 }
 
 func TestLoadWithIncludesNestedNamespaceCollision(t *testing.T) {