release-pipeline.yaml

# Copyright 2021 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Modifed for chains from tekton triggers: https://github.com/tektoncd/triggers/blob/main/tekton/release-pipeline.yaml
---
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: chains-release
  annotations:
    chains.tekton.dev/transparency-upload: "true"
spec:
  params:
  - name: package
    description: package to release
    default: github.com/tektoncd/chains
  - name: gitRevision
    description: the git revision to release
  - name: imageRegistry
    description: The target image registry
    default: gcr.io
  - name: imageRegistryPath
    description: The path (project) in the image registry
    default: tekton-releases
  - name: versionTag
    description: The X.Y.Z version that the artifacts should be tagged with
  - name: releaseBucket
    description: bucket where the release is stored. The bucket must be project specific.
    default: gs://tekton-releases/chains
  - name: releaseAsLatest
    description: Whether to tag and publish this release as chains' latest
    default: "true"
  - name: platforms
    description: Platforms to publish for the images (e.g. linux/amd64,linux/arm64)
    default: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
  - name: serviceAccountPath
    description: The path to the service account file within the release-secret workspace
  workspaces:
  - name: workarea
    description: The workspace where the repo will be cloned.
  - name: release-secret
    description: The secret that contains a service account authorized to push to the imageRegistry and to the output bucket
  results:
  - name: commit-sha
    description: the sha of the commit that was released
    value: $(tasks.git-clone.results.commit)
  - name: release-file
    description: the URL of the release file
    value: $(tasks.report-bucket.results.release)
  - name: release-file-no-tag
    description: the URL of the release file
    value: $(tasks.report-bucket.results.release-no-tag)
  tasks:
  - name: git-clone
    taskRef:
      name: git-clone
    workspaces:
    - name: output
      workspace: workarea
      subpath: git
    params:
    - name: url
      value: https://$(params.package)
    - name: revision
      value: $(params.gitRevision)
  - name: precheck
    runAfter: [git-clone]
    taskRef:
      name: prerelease-checks
    params:
    - name: package
      value: $(params.package)
    - name: versionTag
      value: $(params.versionTag)
    - name: releaseBucket
      value: $(params.releaseBucket)
    workspaces:
    - name: source-to-release
      workspace: workarea
      subpath: git
  - name: unit-tests
    runAfter: [precheck]
    taskRef:
      name: golang-test
    params:
    - name: package
      value: $(params.package)
    - name: flags
      value: -v -mod=vendor
    workspaces:
    - name: source
      workspace: workarea
      subpath: git
  - name: build
    runAfter: [precheck]
    taskRef:
      name: golang-build
    params:
    - name: package
      value: $(params.package)
    - name: packages
      value: ./cmd/...
    workspaces:
    - name: source
      workspace: workarea
      subpath: git
  - name: publish-images
    runAfter: [build, unit-tests]
    taskRef:
      name: publish-chains-release
    params:
    - name: package
      value: $(params.package)
    - name: versionTag
      value: $(params.versionTag)
    - name: imageRegistry
      value: $(params.imageRegistry)
    - name: imageRegistryPath
      value: $(params.imageRegistryPath)
    - name: releaseAsLatest
      value: $(params.releaseAsLatest)
    - name: platforms
      value: $(params.platforms)
    - name: serviceAccountPath
      value: $(params.serviceAccountPath)
    - name: CHAINS-GIT_COMMIT
      value: $(tasks.git-clone.results.commit)
    - name: CHAINS-GIT_URL
      value: https://$(params.package)
    workspaces:
    - name: source
      workspace: workarea
      subpath: git
    - name: output
      workspace: workarea
      subpath: bucket
    - name: release-secret
      workspace: release-secret
  - name: publish-to-bucket
    runAfter: [publish-images]
    taskRef:
      name: gcs-upload
    workspaces:
    - name: credentials
      workspace: release-secret
    - name: source
      workspace: workarea
      subpath: bucket
    params:
    - name: location
      value: $(params.releaseBucket)/previous/$(params.versionTag)
    - name: path
      value: $(params.versionTag)
    - name: serviceAccountPath
      value: $(params.serviceAccountPath)
  - name: publish-to-bucket-latest
    runAfter: [publish-images]
    when:
    - input: "$(params.releaseAsLatest)"
      operator: in
      values: ["true"]
    taskRef:
      name: gcs-upload
    workspaces:
    - name: credentials
      workspace: release-secret
    - name: source
      workspace: workarea
      subpath: bucket
    params:
    - name: location
      value: $(params.releaseBucket)/latest
    - name: path
      value: $(params.versionTag)
    - name: serviceAccountPath
      value: $(params.serviceAccountPath)
  - name: report-bucket
    runAfter: [publish-to-bucket]
    params:
    - name: releaseBucket
      value: $(params.releaseBucket)
    - name: versionTag
      value: $(params.versionTag)
    taskSpec:
      params:
      - name: releaseBucket
      - name: versionTag
      results:
      - name: release
        description: The full URL of the main release file in the bucket
      - name: release-no-tag
        description: The full URL of the main release file (no tag) in the bucket
      steps:
      - name: create-results
        image: alpine
        script: |
          BASE_URL=$(echo "$(params.releaseBucket)/previous/$(params.versionTag)")
          # If the bucket is in the gs:// return the corresponding public https URL
          BASE_URL=$(echo ${BASE_URL} | sed 's,gs://,https://storage.googleapis.com/,g')
          echo "${BASE_URL}/release.yaml" > $(results.release.path)
          echo "${BASE_URL}/release.notag.yaml" > $(results.release-no-tag.path)