publish.yaml

apiVersion: tekton.dev/v1alpha1
kind: Task
metadata:
  name: publish-tekton-pipelines
spec:
  inputs:
    resources:
    - name: source
      type: git
      targetPath: go/src/github.com/tektoncd/pipeline
    - name: bucket
      type: storage
    params:
    - name: versionTag
      description: The vX.Y.Z version that the artifacts should be tagged with (including `v`)
    - name: imageRegistry
      description: TODO(#569) This is a hack to make it easy for folks to switch the registry being used by the many many image outputs
    - name: pathToProject
      description: The path to the folder in the go/src dir that contains the project, which is used by `ko` to name the resulting images
  outputs:
    resources:
    - name: bucket
      type: storage
    - name: builtBaseImage
      type: image
    - name: builtEntrypointImage
      type: image
    - name: builtKubeconfigWriterImage
      type: image
    - name: builtCredsInitImage
      type: image
    - name: builtGitInitImage
      type: image
    - name: builtNopImage
      type: image
    - name: builtBashImage
      type: image
    - name: builtGsutilImage
      type: image
    - name: builtControllerImage
      type: image
    - name: builtWebhookImage
      type: image
    - name: builtDigestExporterImage
      type: image
    - name: builtPullRequestInitImage
      type: image
    - name: builtGcsFetcherImage
      type: image
  steps:

  - name: build-push-base-images
    image: gcr.io/kaniko-project/executor:v0.9.0
    command:
    - /kaniko/executor
    args:
    - --dockerfile=/workspace/go/src/github.com/tektoncd/pipeline/images/Dockerfile
    - --destination=$(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtBaseImage.url)
    - --context=/workspace/go/src/github.com/tektoncd/pipeline

    volumeMounts:
      - name: gcp-secret
        mountPath: /secret
    env:
      - name: GOOGLE_APPLICATION_CREDENTIALS
        value: /secret/release.json

  - name: create-ko-yaml
    image: busybox
    command:
    - /bin/sh
    args:
    - -ce
    - |
      set -e
      set -x

      cat <<EOF > /workspace/go/src/github.com/tektoncd/pipeline/.ko.yaml
      # By default ko will build images on top of distroless
      baseImageOverrides:
        $(inputs.params.pathToProject)/$(outputs.resources.builtCredsInitImage.url): $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/build-base:latest
        $(inputs.params.pathToProject)/$(outputs.resources.builtGitInitImage.url): $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/build-base:latest
        $(inputs.params.pathToProject)/$(outputs.resources.builtBashImage.url): busybox # image should have shell in $PATH
        $(inputs.params.pathToProject)/$(outputs.resources.builtEntrypointImage.url): busybox # image should have shell in $PATH
        $(inputs.params.pathToProject)/$(outputs.resources.builtGsutilImage.url): google/cloud-sdk:alpine # image should have gsutil in $PATH
      EOF

      cat /workspace/go/src/github.com/tektoncd/pipeline/.ko.yaml

  - name: ensure-release-dirs-exist
    image: busybox
    command: ["mkdir"]
    args:
    - "-p"
    - "/workspace/bucket/latest/"
    - "/workspace/bucket/previous/"

  - name: run-ko
    # TODO(#639) we should be able to use the image built by an upstream Task here instead of hardcoding
    image: gcr.io/tekton-releases/ko-ci
    env:
    - name: KO_DOCKER_REPO
      value: $(inputs.params.imageRegistry)
    - name: GOPATH
      value: /workspace/go
    - name: CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE
      value: /secret/release.json
    command:
    - /bin/sh
    args:
    - -ce
    - |
      set -e
      set -x

      # Auth with CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE
      gcloud auth configure-docker

      # ko requires this variable to be set in order to set image creation timestamps correctly https://github.com/google/go-containerregistry/pull/146
      export SOURCE_DATE_EPOCH=`date +%s`

      # Change to directory with our .ko.yaml
      cd /workspace/go/src/github.com/tektoncd/pipeline

      # Publish images and create release.yaml
      ko resolve --preserve-import-paths -f /workspace/go/src/github.com/tektoncd/pipeline/config/ > /workspace/bucket/latest/release.yaml
    volumeMounts:
      - name: gcp-secret
        mountPath: /secret

  - name: copy-to-tagged-bucket
    image: busybox
    workingDir: "/workspace/bucket"
    command:
    - /bin/sh
    args:
    - -ce
    - |
      mkdir -p /workspace/bucket/previous/$(inputs.params.versionTag)/
      cp /workspace/bucket/latest/release.yaml /workspace/bucket/previous/$(inputs.params.versionTag)/release.yaml

  - name: tag-images
    image: google/cloud-sdk
    command:
    - /bin/bash
    args:
    - -ce
    - |
      set -e
      set -x

      REGIONS=(us eu asia)
      IMAGES=(
        $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtEntrypointImage.url)
        $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtKubeconfigWriterImage.url)
        $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtCredsInitImage.url)
        $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtGitInitImage.url)
        $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtNopImage.url)
        $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtBashImage.url)
        $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtGsutilImage.url)
        $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtControllerImage.url)
        $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtWebhookImage.url)
        $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtDigestExporterImage.url)
        $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtPullRequestInitImage.url)
        $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/$(outputs.resources.builtGcsFetcherImage.url)
      )
      # Parse the built images from the release.yaml generated by ko
      BUILT_IMAGES=( $(/workspace/go/src/github.com/tektoncd/pipeline/tekton/koparse/koparse.py --path /workspace/bucket/latest/release.yaml --base $(inputs.params.imageRegistry)/$(inputs.params.pathToProject) --images ${IMAGES[@]}) )

      # Auth with account credentials
      gcloud auth activate-service-account --key-file=/secret/release.json

      # Tag the images and put them in all the regions
      for IMAGE in "${BUILT_IMAGES[@]}"
      do
        IMAGE_WITHOUT_SHA=${IMAGE%%@*}
        gcloud -q container images add-tag ${IMAGE} ${IMAGE_WITHOUT_SHA}:latest
        gcloud -q container images add-tag ${IMAGE} ${IMAGE_WITHOUT_SHA}:$(inputs.params.versionTag)
        for REGION in "${REGIONS[@]}"
        do
          for TAG in "latest" $(inputs.params.versionTag)
          do
            gcloud -q container images add-tag ${IMAGE} ${REGION}.${IMAGE_WITHOUT_SHA}:$TAG
          done
        done
      done
    volumeMounts:
      - name: gcp-secret
        mountPath: /secret

  volumes:
    - name: gcp-secret
      secret:
        secretName: release-secret