all-in-one.yaml

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: harbor-all-in-one
  annotations:
    pipelinesascode.tekton.dev/on-comment: "^(/all-in-one)$"
    pipelinesascode.tekton.dev/cancel-in-progress: "true"
    pipelinesascode.tekton.dev/on-cel-expression: |-
      (
        !last_commit_title.contains("Auto-commit")
      ) && ((
        event == "push" && (
          source_branch.matches("^(main|master|release-.*|alauda-.*)$") ||
          target_branch.matches("^(main|master|release-.*|alauda-.*)$") ||
          target_branch.startsWith("refs/tags/")
        )
      ) || (
        event == "pull_request" && (
          target_branch.matches("^(main|master|release-.*|alauda-.*)$")
        )
      ))
    pipelinesascode.tekton.dev/max-keep-runs: "30"
    pip.tekton.dev/runspec.build-core-image: |
      taskRunSpecs:
        - pipelineTaskName: trivy-scan
          computeResources:
            limits:
              cpu: '2'
              memory: 2Gi
            requests:
              cpu: '1'
              memory: 1Gi
    pip.tekton.dev/runspec.build-jobservice-image: |
      taskRunSpecs:
        - pipelineTaskName: trivy-scan
          computeResources:
            limits:
              cpu: '2'
              memory: 2Gi
            requests:
              cpu: '1'
              memory: 1Gi
    pip.tekton.dev/runspec.build-registryctl-image: |
      taskRunSpecs:
        - pipelineTaskName: trivy-scan
          computeResources:
            limits:
              cpu: '2'
              memory: 2Gi
            requests:
              cpu: '1'
              memory: 1Gi
    pip.tekton.dev/runspec.build-portal-image: |
      taskRunSpecs:
        - pipelineTaskName: trivy-scan
          computeResources:
            limits:
              cpu: '2'
              memory: 2Gi
            requests:
              cpu: '1'
              memory: 1Gi
    pip.tekton.dev/runspec.build-nginx-image: |
      taskRunSpecs:
        - pipelineTaskName: trivy-scan
          computeResources:
            limits:
              cpu: '2'
              memory: 2Gi
            requests:
              cpu: '1'
              memory: 1Gi
    pip.tekton.dev/runspec.build-registry-image: |
      taskRunSpecs:
        - pipelineTaskName: trivy-scan
          computeResources:
            limits:
              cpu: '2'
              memory: 2Gi
            requests:
              cpu: '1'
              memory: 1Gi
    pip.tekton.dev/runspec.build-trivy-adapter-image: |
      taskRunSpecs:
        - pipelineTaskName: trivy-scan
          computeResources:
            limits:
              cpu: '2'
              memory: 2Gi
            requests:
              cpu: '1'
              memory: 1Gi
    pip.tekton.dev/runspec.build-exporter-image: |
      taskRunSpecs:
        - pipelineTaskName: trivy-scan
          computeResources:
            limits:
              cpu: '2'
              memory: 2Gi
            requests:
              cpu: '1'
              memory: 1Gi
spec:
  timeouts:
    pipeline: 3h
    tasks: 2h

  params:
    - name: git-url
      value: "{{ repo_url }}"
    - name: git-revision
      value: "{{ source_branch }}"
    - name: git-commit
      value: "{{ revision }}"
    - name: pull-request-number
      value: "{{ pull_request_number }}"
    - name: target-branch
      value: "{{ target_branch }}"
    - name: build-path
      value: subtree/harbor
    - name: tag-template
      value: 2.14.3-g$ShortSha
    - name: skip-e2e
      value: "{{ skip_e2e }}"

  pipelineSpec:
    description: The pipeline is used to combine multiple pipeline templates
    params:
      - name: git-url
        description: Repository URL to clone from.
        type: string
      - name: git-revision
        description: Revision to checkout. (branch, tag, sha, ref, etc...)
        type: string
      - name: git-commit
        description: Commit sha used in this build
        default: ""
      - name: pull-request-number
        description: Pull Request number to checkout. When provided, it takes precedence over revision parameter.
        type: string
        default: ""
      - name: pr-revision-format
        description: Format template for PR revision. Use {PR_NUMBER} as placeholder. Examples - GitHub 'pull/{PR_NUMBER}/head', GitLab 'merge-requests/{PR_NUMBER}/head', Gitee 'pulls/{PR_NUMBER}'
        type: string
        default: "pull/{PR_NUMBER}/head"
      - name: target-branch
        description: The target branch of the pull request
        type: string
        default: ""
      - name: tag-template
        description: >-
          The template to generate the image tag.
          The following variables can be used in the template:
          - $FULL_SEM_VERSION: The complete version string, e.g: 2.13.0-feat86.3.ga84887a
          - $ShortSha: The short commit ID, e.g a84887a
          - $Major: The major version, e.g: 2
          - $Minor: The minor version, e.g: 13
          - $Patch: The patch version, e.g: 0
          - $MajorMinorPatch: The major and minor version, e.g: 2.13.0
          - $PreReleaseNumber: The pre-release version, e.g: 86.3
          - $CustomVariable: Custom variables generated by tag-variables-generator script
      - name: file-list-for-commit-sha
        type: array
        default:
          - "."
        description: >
          This list of files will be used to calculate the most recently modified commit sha.
          It is used to set the `SOURCE_DATE_EPOCH` environment variable and version number,
          ensuring that the image digest remains consistent when files have not changed.
      - name: reuse-artifact
        description: >-
          If set to true, the task will reuse the built image from the previous run.
          This is useful for speeding up the build process when the image has not changed.
        default: "true"

      - name: build-path
        description: Path to the directory to build the image from
        type: string
        default: "./subtree/harbor"

      - name: pre-build-command
        description: The command to be used to pre-build the image.
        type: string
        default: |
          export IMAGENAMESPACE="build-harbor.alauda.cn/devops"
          export BASEIMAGENAMESPACE="build-harbor.alauda.cn/devops"
          export PUSHBASEIMAGE=false
          export DOCKERBUILD="docker buildx build --platform=linux/$ARCH --builder builder --push --metadata-file --output=oci-mediatypes=false --provenance=false --metadata-file .build-metadata.txt"

      - name: post-build-command
        description: The command to be used to post-build the image.
        type: string
        default: |
          echo "==== build metadata"
          cat .build-metadata.txt
          echo "==== build metadata"
      - name: fetch-third-party-script
        type: string
        default: |
          # download trivy and scanner-trivy
          
          # renovate: datasource=github-releases depName=trivy packageName=AlaudaDevops/trivy
          TRIVY_VERSION=v0.68.3-alauda-9
          
          # renovate: datasource=github-releases depName=harbor-scanner-trivy packageName=AlaudaDevops/harbor-scanner-trivy
          TRIVY_ADAPTER_VERSION=v0.34.3-alauda-5
          
          # renovate: datasource=golang-version depName=go
          export GOLANG_IMAGE_VERSION=1.26.4
          
          TRIVY_DOWNLOAD_URL=https://github.com/AlaudaDevops/trivy/releases/download/${TRIVY_VERSION}/trivy_Linux_${ARCH}.tar.gz
          TRIVY_ADAPTER_DOWNLOAD_URL=https://github.com/AlaudaDevops/harbor-scanner-trivy/releases/download/${TRIVY_ADAPTER_VERSION}/harbor-scanner-trivy_${TRIVY_ADAPTER_VERSION#v}_Linux_${ARCH}.tar.gz
          
          TRIVY_BINARY_PATH=${BUILDPATH}/make/photon/trivy-adapter/binary
          mkdir -p ${TRIVY_BINARY_PATH}
          
          curl --retry 6 --create-dirs -fLo /tmp/trivy.tar.gz ${TRIVY_DOWNLOAD_URL}
          tar -xzf /tmp/trivy.tar.gz -C /tmp
          mv /tmp/alauda-trivy ${TRIVY_BINARY_PATH}/trivy
          
          curl --retry 6 --create-dirs -fLo /tmp/trivy-adapter.tar.gz ${TRIVY_ADAPTER_DOWNLOAD_URL}
          tar -xzf /tmp/trivy-adapter.tar.gz -C /tmp
          mv /tmp/alauda-scanner-trivy ${TRIVY_BINARY_PATH}/scanner-trivy
          
          # download registry binary from AlaudaDevops/goharbor-distribution release
          # renovate: datasource=github-releases depName=goharbor-distribution packageName=AlaudaDevops/goharbor-distribution
          REGISTRY_VERSION=v2.8.4-alauda-8

          # distribution release assets use amd64/arm64 naming
          REGISTRY_ARCH=${ARCH}
          if [ "${REGISTRY_ARCH}" = "x86_64" ]; then
            REGISTRY_ARCH=amd64
          fi
          REGISTRY_DOWNLOAD_URL=https://github.com/AlaudaDevops/goharbor-distribution/releases/download/${REGISTRY_VERSION}/registry_Linux_${REGISTRY_ARCH}.tar.gz

          REGISTRY_BINARY_PATH=${BUILDPATH}/make/photon/registry/binary
          mkdir -p ${REGISTRY_BINARY_PATH}

          curl --retry 6 --create-dirs -fLo /tmp/registry.tar.gz ${REGISTRY_DOWNLOAD_URL}
          tar -xzf /tmp/registry.tar.gz -C /tmp
          mv /tmp/registry ${REGISTRY_BINARY_PATH}/registry
          chmod +x ${REGISTRY_BINARY_PATH}/registry

          # old source-build path, keep for future rollback to upstream
          # REGISTRY_SRC=https://github.com/goharbor/distribution.git
          # REGISTRY_SRC_TAG=release/2.8
          # DOCKERNETWORK=default
          # cd ${BUILDPATH}/make/photon/registry && ./builder ${REGISTRY_SRC_TAG} ${REGISTRY_SRC} docker-mirrors.alauda.cn/library/golang:${GOLANG_IMAGE_VERSION} ${DOCKERNETWORK} && cd -
      # trivy-scan gate ignores CVEs that have no upstream fix (re-check when a fix ships):
      #   CVE-2026-34040 / CVE-2026-33997 - Moby AuthZ; fix only on moby/moby/v2 >=29.3.1 path,
      #     28.x HEAD already carries the backport (existing exemption).
      #   CVE-2026-50163 - oras-go tar-extraction hardlink escape; no fixed release (v2.6.1 still
      #     affected); embedded via the trivy binary in the trivy-adapter image.
      #   CVE-2026-41889 - jackc/pgx v4 LOW SQL-injection; no fix for the v4 line (exporter image).
      - name: trivy-args
        type: string
        default: >-
          --scanners vuln
          --skip-db-update=false
          --db-repository=registry.alauda.cn:60070/ops/aquasecurity/trivy-db
          --skip-java-db-update=false
          --java-db-repository=registry.alauda.cn:60070/ops/aquasecurity/trivy-java-db
          --exit-code=1
          --ignorefile <(printf '%s\n' CVE-2026-34040 CVE-2026-33997 CVE-2026-50163 CVE-2026-41889)
      - name: skip-e2e
        description: Skip e2e test, default is false.
        default: "false"
    results:
      - name: e2e-image
        description: The e2e image built by this pipeline
        type: string
        value: $(tasks.update-image-tags.results.string-result)
      - name: components-images
        description: The components images built by this pipeline
        type: array
        value: $(tasks.update-image-tags.results.array-result)
    tasks:
      - name: git-clone-amd64
        timeout: 30m
        retries: 3
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: catalog
            - name: kind
              value: task
            - name: name
              value: git-clone
            - name: version
              value: "0.9"

        params:
          - name: url
            value: $(params.git-url)
          - name: revision
            value: $(params.git-revision)
          - name: pr-number
            value: $(params.pull-request-number)

        workspaces:
          - name: output
            workspace: source-amd64
          - name: basic-auth
            workspace: basic-auth

      - name: git-clone-arm64
        timeout: 30m
        retries: 3
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: catalog
            - name: kind
              value: task
            - name: name
              value: git-clone
            - name: version
              value: "0.9"

        params:
          - name: url
            value: $(params.git-url)
          - name: revision
            value: $(params.git-revision)
          - name: pr-number
            value: $(params.pull-request-number)

        workspaces:
          - name: output
            workspace: source-arm64
          - name: basic-auth
            workspace: basic-auth

      # avoid bug of git-version task, the git-version task will fetch refs and save them in .git/refs/heads/ as root user
      # it will causes the git-commit step failed to fetch new branch in nonroot user
      # we can remove it after the git-version task is fixed
      - name: calculate-commit-sha
        runAfter:
          - git-clone-amd64
        timeout: 30m
        retries: 3
        params:
          - name: image
            value: registry.alauda.cn:60080/devops/nonroot/chainguard/git:latest
          - name: args
            value: $(params.file-list-for-commit-sha[*])
          - name: imagePullPolicy
            value: Always
          - name: script
            value: |
              #!/bin/bash
              set -ex
              # sleep for less than 1 second to prevent from failure of git command due to concurrent run
              sleep 0.$[ $((RANDOM % 100)) + 1 ]

              # Add the source directory to the safe.directory list
              git config --global --add safe.directory $(workspaces.source.path)

              # Initialize environment variables
              export GIT_URL=$(params.git-url)
              export GIT_REVISION=$(params.git-revision)
              export RESET_GIT_COMMIT=$(params.git-commit)
              export RESULT_STRING_PATH=$(results.string-result.path)
              export RESULT_ARRAY_PATH=$(results.array-result.path)
              export RESULT_OBJECT_PATH=$(results.object-result.path)
              export DEFAULT_GIT_COMMIT=$(git rev-parse HEAD)
              export DEFAULT_GIT_COMMITTER_DATE=$(git log -1 --pretty=%ct)
              export WORKSPACE_SOURCE_PATH=$(workspaces.source.path)
              export WORKSPACE_SECRET_BOUND=$(workspaces.secret.bound)
              export WORKSPACE_SECRET_PATH=$(workspaces.secret.path)

              # calculate the last commit info
              calculate-last-commit-info.sh $@

              # Define the commit info file path and create the directory if it doesn't exist
              COMMIT_INFO_FILE=".git/$(context.pipelineRun.name)/.last-changed-commit-sha"
              mkdir -p "$(dirname ${COMMIT_INFO_FILE})"
              # Store the last changed commit sha in a file
              cp -f $(results.string-result.path) "${COMMIT_INFO_FILE}"

              # Store the original git revision in a file
              echo -n "${GIT_REVISION}" > .git/$(context.pipelineRun.name)/.git-revision

        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: catalog
            - name: kind
              value: task
            - name: name
              value: run-script
            - name: version
              value: "0.1"
        workspaces:
          - name: source
            workspace: source-amd64
          - name: secret
            workspace: basic-auth

      - name: git-version
        retries: 1
        runAfter:
          - git-clone-amd64
          - calculate-commit-sha
        params:
          - name: gitversion-image
            value: registry.alauda.cn:60080/devops/gittools/gitversion:6.0.5
          - name: yq-image
            value: registry.alauda.cn:60080/devops/nonroot/yq:latest
          - name: commit
            value: $(params.git-commit)
          - name: config-file
            value: GitVersion.yaml
          - name: post-command
            value: |
              # Extract version information from gitversion output
              PRE_RELEASE_LABEL=$(sed -n 's/.*"PreReleaseLabel": "\([^"]*\)".*/\1/p' $FINAL_RESULTS_PATH)
              INFORMATIONAL_VERSION=$(sed -n 's/.*"InformationalVersion": "\([^"]*\)".*/\1/p' $FINAL_RESULTS_PATH)
              FULL_SEM_VERSION=$(sed -n 's/.*"FullSemVer": "\([^"]*\)".*/\1/p' $FINAL_RESULTS_PATH)
              
              # Get current branch name
              current_revision=$(git branch --show-current)
              
              GIT_REVISION=$(params.git-commit)
              
              # Only adjust FullSemVer when:
              # 1. PreReleaseLabel cannot be empty to avoid affecting the version of the tag.
              # 2. This revision is not a tag.
              if [ -n "$PRE_RELEASE_LABEL" ] && [ "${GIT_REVISION#refs/tags/}" = "${GIT_REVISION}" ]; then
                sed -i "s/\"FullSemVer\": \"[^\"]*\"/\"FullSemVer\": \"$INFORMATIONAL_VERSION\"/" $FINAL_RESULTS_PATH
                echo "Current revision: $current_revision"
                echo "Adjusted FullSemVer from $FULL_SEM_VERSION to $INFORMATIONAL_VERSION"
              fi
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: extras
            - name: kind
              value: task
            - name: name
              value: git-version
            - name: version
              value: "0.2"
        timeout: 10m0s
        workspaces:
          - name: source
            workspace: source-amd64
          - name: basic-auth
            workspace: basic-auth
          - name: config
            workspace: gitversion-config

      - name: generate-tag
        runAfter:
          - git-version
        timeout: 60m
        retries: 0
        params:
          - name: image
            value: registry.alauda.cn:60080/devops/nonroot/alauda-docker-buildx:latest
          - name: args
            value:
              - $(tasks.git-version.results.variables.FullSemVer)
          - name: script
            value: |
              #!/bin/sh
              set -e
              
              full_sem_ver=$(tasks.git-version.results.variables.FullSemVer)
              
              export FULL_SEM_VERSION="$full_sem_ver"
              export ShortSha=$(tasks.git-version.results.variables.ShortSha)
              export Major=$(tasks.git-version.results.variables.Major)
              export Minor=$(tasks.git-version.results.variables.Minor)
              export Patch=$(tasks.git-version.results.variables.Patch)
              export MajorMinorPatch=$(tasks.git-version.results.variables.MajorMinorPatch)
              export PreReleaseNumber=$(tasks.git-version.results.variables.PreReleaseNumber)
              export FullSemVer=$(tasks.git-version.results.variables.FullSemVer)
              
              tag=$(echo "$(params.tag-template)")
              echo -n "$tag" > $(results.string-result.path)
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: catalog
            - name: kind
              value: task
            - name: name
              value: run-script
            - name: version
              value: "0.1"
        workspaces:
          - name: source
            workspace: source-amd64

      - name: patch-amd64
        runAfter:
          - git-clone-amd64
        timeout: 10m
        retries: 1
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: catalog
            - name: kind
              value: task
            - name: name
              value: run-script
            - name: version
              value: "0.1"
        params:
          - name: script
            value: |
              cd $(workspaces.source.path)/$(params.build-path)
              bash make/patches/patch-amd64.sh
        workspaces:
          - name: source
            workspace: source-amd64

      - name: patch-arm64
        runAfter:
          - git-clone-arm64
        timeout: 10m
        retries: 1
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: catalog
            - name: kind
              value: task
            - name: name
              value: run-script
            - name: version
              value: "0.1"
        params:
          - name: script
            value: |
              cd $(workspaces.source.path)/$(params.build-path)
              bash make/patches/patch-amd64.sh
              bash make/patches/patch-arm64.sh
        workspaces:
          - name: source
            workspace: source-arm64

      - name: compile-amd64
        runAfter:
          - patch-amd64
        timeout: 1h
        retries: 0
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: name
              value: docker-in-docker
            - name: version
              value: "0.2"
        params:
          - name: tools-image
            value: registry.alauda.cn:60080/devops/alauda-docker-buildx:latest
          - name: command
            value: |
              cd $(workspaces.source.path)/$(params.build-path)
              BUILDPATH=$(realpath .) make compile
        workspaces:
          - name: source
            workspace: source-amd64

      - name: compile-arm64
        runAfter:
          - patch-arm64
        timeout: 1h
        retries: 0
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: name
              value: docker-in-docker
            - name: version
              value: "0.2"
        params:
          - name: tools-image
            value: registry.alauda.cn:60080/devops/alauda-docker-buildx:latest
          - name: command
            value: |
              cd $(workspaces.source.path)/$(params.build-path)
              BUILDPATH=$(realpath .) make compile
        workspaces:
          - name: source
            workspace: source-arm64

      - name: fetch-thirdparty-amd64
        runAfter:
          - patch-amd64
        timeout: 60m
        retries: 0
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: name
              value: docker-in-docker
            - name: version
              value: "0.2"
        params:
          - name: tools-image
            value: registry.alauda.cn:60080/devops/alauda-docker-buildx:latest
          - name: command
            value: |
              set -ex
              cd $(workspaces.source.path)/$(params.build-path)
              BUILDPATH=$(realpath .)
              ARCH=x86_64
              
              $(params.fetch-third-party-script)

        workspaces:
          - name: source
            workspace: source-amd64

      - name: fetch-thirdparty-arm64
        runAfter:
          - patch-arm64
        timeout: 60m
        retries: 0
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: name
              value: docker-in-docker
            - name: version
              value: "0.2"
        params:
          - name: tools-image
            value: registry.alauda.cn:60080/devops/alauda-docker-buildx:latest
          - name: command
            value: |
              set -ex
              cd $(workspaces.source.path)/$(params.build-path)
              BUILDPATH=$(realpath .)
              ARCH=arm64
              
              $(params.fetch-third-party-script)

        workspaces:
          - name: source
            workspace: source-arm64

      - name: build-core-image
        runAfter:
          - generate-tag
          - compile-amd64
          - compile-arm64
        timeout: 120m
        retries: 3
        taskRef:
          apiVersion: tekton.dev/v1
          kind: Pipeline
          name: dind-build-merge-scan
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: kind
              value: pipeline
            - name: type
              value: tekton
            - name: name
              value: dind-build-merge-scan
            - name: version
              value: "0.1"
        params:
          - name: reuse-artifact
            value: $(params.reuse-artifact)
          - name: trivy-args
            value: $(params.trivy-args)
          - name: image
            value: build-harbor.alauda.cn/devops/goharbor-harbor-core:$(tasks.generate-tag.results.string-result)
          - name: build-command
            value: |
              set -ex
              
              $(params.pre-build-command)
              
              export VERSIONTAG=$(tasks.generate-tag.results.string-result)-$ARCH
              export BASEIMAGETAG=$(tasks.generate-tag.results.string-result)-$ARCH
              cd $(workspaces.source.path)/$(params.build-path)
              make build -e BUILDTARGET=_build_core
              
              $(params.post-build-command)
        workspaces:
          - name: source-amd64
            workspace: source-amd64
          - name: source-arm64
            workspace: source-arm64
          - name: dockerconfig
            workspace: dockerconfig

      - name: build-jobservice-image
        runAfter:
          - generate-tag
          - compile-amd64
          - compile-arm64
        timeout: 120m
        retries: 3
        taskRef:
          apiVersion: tekton.dev/v1
          kind: Pipeline
          name: dind-build-merge-scan
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: kind
              value: pipeline
            - name: name
              value: dind-build-merge-scan
            - name: version
              value: "0.1"
        params:
          - name: reuse-artifact
            value: $(params.reuse-artifact)
          - name: trivy-args
            value: $(params.trivy-args)
          - name: image
            value: build-harbor.alauda.cn/devops/goharbor-harbor-jobservice:$(tasks.generate-tag.results.string-result)
          - name: build-command
            value: |
              set -ex
              
              $(params.pre-build-command)
              
              export VERSIONTAG=$(tasks.generate-tag.results.string-result)-$ARCH
              export BASEIMAGETAG=$(tasks.generate-tag.results.string-result)-$ARCH
              cd $(workspaces.source.path)/$(params.build-path)
              make build -e BUILDTARGET=_build_jobservice
              
              $(params.post-build-command)
        workspaces:
          - name: source-amd64
            workspace: source-amd64
          - name: source-arm64
            workspace: source-arm64
          - name: dockerconfig
            workspace: dockerconfig

      - name: build-registryctl-image
        runAfter:
          - generate-tag
          - compile-amd64
          - compile-arm64
        timeout: 120m
        retries: 3
        taskRef:
          apiVersion: tekton.dev/v1
          kind: Pipeline
          name: dind-build-merge-scan
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: kind
              value: pipeline
            - name: name
              value: dind-build-merge-scan
            - name: version
              value: "0.1"
        params:
          - name: reuse-artifact
            value: $(params.reuse-artifact)
          - name: trivy-args
            value: $(params.trivy-args)
          - name: image
            value: build-harbor.alauda.cn/devops/goharbor-harbor-registryctl:$(tasks.generate-tag.results.string-result)
          - name: build-command
            value: |
              set -ex

              $(params.pre-build-command)

              export VERSIONTAG=$(tasks.generate-tag.results.string-result)-$ARCH
              export BASEIMAGETAG=$(tasks.generate-tag.results.string-result)-$ARCH
              cd $(workspaces.source.path)/$(params.build-path)
              make build -e BUILDTARGET=_build_registryctl

              $(params.post-build-command)
        workspaces:
          - name: source-amd64
            workspace: source-amd64
          - name: source-arm64
            workspace: source-arm64
          - name: dockerconfig
            workspace: dockerconfig

      - name: build-redis-image
        runAfter:
          - generate-tag
          - patch-amd64
          - patch-arm64
        timeout: 120m
        retries: 3
        taskRef:
          apiVersion: tekton.dev/v1
          kind: Pipeline
          name: dind-build-merge-scan
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: kind
              value: pipeline
            - name: name
              value: dind-build-merge-scan
            - name: version
              value: "0.1"
        params:
          - name: reuse-artifact
            value: $(params.reuse-artifact)
          - name: skip-trivy-scan
            value: "true"
          - name: image
            value: build-harbor.alauda.cn/devops/goharbor-redis-photon:$(tasks.generate-tag.results.string-result)
          - name: build-command
            value: |
              set -ex

              $(params.pre-build-command)

              export VERSIONTAG=$(tasks.generate-tag.results.string-result)-$ARCH
              export BASEIMAGETAG=$(tasks.generate-tag.results.string-result)-$ARCH
              cd $(workspaces.source.path)/$(params.build-path)
              make build -e BUILDTARGET=_build_bitnami_redis

              $(params.post-build-command)
        workspaces:
          - name: source-amd64
            workspace: source-amd64
          - name: source-arm64
            workspace: source-arm64
          - name: dockerconfig
            workspace: dockerconfig

      - name: build-db-image
        runAfter:
          - generate-tag
          - patch-amd64
          - patch-arm64
        timeout: 120m
        retries: 3
        taskRef:
          apiVersion: tekton.dev/v1
          kind: Pipeline
          name: dind-build-merge-scan
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: kind
              value: pipeline
            - name: name
              value: dind-build-merge-scan
            - name: version
              value: "0.1"
        params:
          - name: reuse-artifact
            value: $(params.reuse-artifact)
          - name: skip-trivy-scan
            value: "true"
          - name: image
            value: build-harbor.alauda.cn/devops/goharbor-harbor-db:$(tasks.generate-tag.results.string-result)
          - name: build-command
            value: |
              set -ex

              $(params.pre-build-command)

              export VERSIONTAG=$(tasks.generate-tag.results.string-result)-$ARCH
              export BASEIMAGETAG=$(tasks.generate-tag.results.string-result)-$ARCH
              cd $(workspaces.source.path)/$(params.build-path)
              make build -e BUILDTARGET=_build_db

              $(params.post-build-command)
        workspaces:
          - name: source-amd64
            workspace: source-amd64
          - name: source-arm64
            workspace: source-arm64
          - name: dockerconfig
            workspace: dockerconfig

      - name: build-portal-image
        runAfter:
          - generate-tag
          - patch-amd64
          - patch-arm64
        timeout: 120m
        retries: 3
        taskRef:
          apiVersion: tekton.dev/v1
          kind: Pipeline
          name: dind-build-merge-scan
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: kind
              value: pipeline
            - name: name
              value: dind-build-merge-scan
            - name: version
              value: "0.1"
        params:
          - name: reuse-artifact
            value: $(params.reuse-artifact)
          - name: trivy-args
            value: $(params.trivy-args)
          - name: image
            value: build-harbor.alauda.cn/devops/goharbor-harbor-portal:$(tasks.generate-tag.results.string-result)
          - name: build-command
            value: |
              set -ex

              $(params.pre-build-command)

              export VERSIONTAG=$(tasks.generate-tag.results.string-result)-$ARCH
              export BASEIMAGETAG=$(tasks.generate-tag.results.string-result)-$ARCH
              cd $(workspaces.source.path)/$(params.build-path)
              make build -e BUILDTARGET=_build_portal

              $(params.post-build-command)
        workspaces:
          - name: source-amd64
            workspace: source-amd64
          - name: source-arm64
            workspace: source-arm64
          - name: dockerconfig
            workspace: dockerconfig

      - name: build-nginx-image
        runAfter:
          - generate-tag
          - patch-amd64
          - patch-arm64
        timeout: 120m
        retries: 3
        taskRef:
          apiVersion: tekton.dev/v1
          kind: Pipeline
          name: dind-build-merge-scan
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: kind
              value: pipeline
            - name: name
              value: dind-build-merge-scan
            - name: version
              value: "0.1"
        params:
          - name: reuse-artifact
            value: $(params.reuse-artifact)
          - name: trivy-args
            value: $(params.trivy-args)
          - name: image
            value: build-harbor.alauda.cn/devops/goharbor-nginx-photon:$(tasks.generate-tag.results.string-result)
          - name: build-command
            value: |
              set -ex

              $(params.pre-build-command)

              export VERSIONTAG=$(tasks.generate-tag.results.string-result)-$ARCH
              export BASEIMAGETAG=$(tasks.generate-tag.results.string-result)-$ARCH
              cd $(workspaces.source.path)/$(params.build-path)
              make build -e BUILDTARGET=_build_nginx

              $(params.post-build-command)
        workspaces:
          - name: source-amd64
            workspace: source-amd64
          - name: source-arm64
            workspace: source-arm64
          - name: dockerconfig
            workspace: dockerconfig

      - name: build-registry-image
        runAfter:
          - generate-tag
          - fetch-thirdparty-amd64
          - fetch-thirdparty-arm64
        timeout: 120m
        retries: 3
        taskRef:
          apiVersion: tekton.dev/v1
          kind: Pipeline
          name: dind-build-merge-scan
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: kind
              value: pipeline
            - name: name
              value: dind-build-merge-scan
            - name: version
              value: "0.1"
        params:
          - name: reuse-artifact
            value: $(params.reuse-artifact)
          - name: trivy-args
            value: $(params.trivy-args)
          - name: image
            value: build-harbor.alauda.cn/devops/goharbor-registry-photon:$(tasks.generate-tag.results.string-result)
          - name: build-command
            value: |
              set -ex

              $(params.pre-build-command)

              export VERSIONTAG=$(tasks.generate-tag.results.string-result)-$ARCH
              export BASEIMAGETAG=$(tasks.generate-tag.results.string-result)-$ARCH
              cd $(workspaces.source.path)/$(params.build-path)
              make build -e BUILDTARGET=_build_registry

              $(params.post-build-command)
        workspaces:
          - name: source-amd64
            workspace: source-amd64
          - name: source-arm64
            workspace: source-arm64
          - name: dockerconfig
            workspace: dockerconfig

      - name: build-trivy-adapter-image
        runAfter:
          - generate-tag
          - fetch-thirdparty-amd64
          - fetch-thirdparty-arm64
        timeout: 120m
        retries: 3
        taskRef:
          apiVersion: tekton.dev/v1
          kind: Pipeline
          name: dind-build-merge-scan
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: kind
              value: pipeline
            - name: name
              value: dind-build-merge-scan
            - name: version
              value: "0.1"
        params:
          - name: reuse-artifact
            value: $(params.reuse-artifact)
          - name: trivy-args
            value: $(params.trivy-args)
          - name: image
            value: build-harbor.alauda.cn/devops/goharbor-trivy-adapter-photon:$(tasks.generate-tag.results.string-result)
          - name: build-command
            value: |
              set -ex

              $(params.pre-build-command)

              export VERSIONTAG=$(tasks.generate-tag.results.string-result)-$ARCH
              export BASEIMAGETAG=$(tasks.generate-tag.results.string-result)-$ARCH
              cd $(workspaces.source.path)/$(params.build-path)
              make build -e BUILDTARGET=_build_trivy_adapter

              $(params.post-build-command)
        workspaces:
          - name: source-amd64
            workspace: source-amd64
          - name: source-arm64
            workspace: source-arm64
          - name: dockerconfig
            workspace: dockerconfig

      - name: build-exporter-image
        runAfter:
          - generate-tag
          - patch-amd64
          - patch-arm64
        timeout: 120m
        retries: 3
        taskRef:
          apiVersion: tekton.dev/v1
          kind: Pipeline
          name: dind-build-merge-scan
          resolver: hub
          params:
            - name: catalog
              value: alauda
            - name: type
              value: tekton
            - name: kind
              value: pipeline
            - name: name
              value: dind-build-merge-scan
            - name: version
              value: "0.1"
        params:
          - name: reuse-artifact
            value: $(params.reuse-artifact)
          - name: trivy-args
            value: $(params.trivy-args)
          - name: image
            value: build-harbor.alauda.cn/devops/goharbor-harbor-exporter:$(tasks.generate-tag.results.string-result)
          - name: build-command
            value: |
              set -ex

              $(params.pre-build-command)

              export VERSIONTAG=$(tasks.generate-tag.results.string-result)-$ARCH
              export BASEIMAGETAG=$(tasks.generate-tag.results.string-result)-$ARCH
              cd $(workspaces.source.path)/$(params.build-path)
              make build -e BUILDTARGET=_compile_and_build_exporter

              $(params.post-build-command)
        workspaces:
          - name: source-amd64
            workspace: source-amd64
          - name: source-arm64
            workspace: source-arm64
          - name: dockerconfig
            workspace: dockerconfig

      - name: build-e2e-image
        runAfter:
          - patch-amd64
          - generate-tag
        timeout: 60m
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: extras
            - name: kind
              value: task
            - name: name
              value: buildx
            - name: version
              value: "0.1"
        workspaces:
          - name: source
            workspace: source-amd64
          - name: dockerconfig
            workspace: dockerconfig
        params:
          - name: reuse-artifact
            value: $(params.reuse-artifact)
          - name: trivy-args
            value: $(params.trivy-args)
          - name: prepare-command
            value: |
              cd $(params.build-path)/tests/test-engine-image && ./generate.sh api && cd -
          - name: image-url
            value: build-harbor.alauda.cn/devops/harbor-e2e-engine
          - name: image-tags
            value:
              - $(tasks.generate-tag.results.string-result)
          - name: dockerfile
            value: $(params.build-path)/tests/test-engine-image/Dockerfile
          - name: labels
            value:
              - branch=$(build.git.branch.name)
              - commit=$(build.git.lastCommit.id)
              - commit_id=$(build.git.lastCommit.id)
          - name: context
            value: $(params.build-path)/tests/test-engine-image

      - name: update-image-tags
        runAfter:
          - build-core-image
          - build-jobservice-image
          - build-registryctl-image
          - build-redis-image
          - build-db-image
          - build-portal-image
          - build-nginx-image
          - build-registry-image
          - build-trivy-adapter-image
          - build-exporter-image
          - build-e2e-image
        timeout: 20m
        retries: 1
        params:
          - name: image
            value: registry.alauda.cn:60080/devops/nonroot/alauda-docker-buildx:latest
          - name: imagePullPolicy
            value: Always
          - name: script
            value: |
              set -e
              
              # Important!!! Only the files specified in `TMP_SCRIPT` in the `commit` Task will be committed. 
              # If a new file need to be committed, please update TMP_SCRIPT in time.
              
              image_tag=$(tasks.generate-tag.results.string-result)
              
              # update image tag in values.yaml
              echo "update image tag in values.yaml"
              make update-component-image-tag TAG=${image_tag} KEY=core 
              make update-component-image-tag TAG=${image_tag} KEY=jobservice 
              make update-component-image-tag TAG=${image_tag} KEY=registryController 
              make update-component-image-tag TAG=${image_tag} KEY=portal 
              make update-component-image-tag TAG=${image_tag} KEY=exporter 
              make update-component-image-tag TAG=${image_tag} KEY=registry 
              make update-component-image-tag TAG=${image_tag} KEY=nginx 
              make update-component-image-tag TAG=${image_tag} KEY=trivy
              cat values.yaml
              
              # update image tag in base-values.yaml for integration test
              base_values_file=testing/testdata/snippets/base-values.yaml
              echo "update image tag in ${base_values_file}"
              make update-yaml-value FILE=${base_values_file} VALUE=${image_tag} KEY=database.internal.image.tag 
              make update-yaml-value FILE=${base_values_file} VALUE=${image_tag} KEY=redis.internal.image.tag
              cat ${base_values_file}
              
              # update image tag in harbor.yaml for integration test
              harbor_file=testing/testdata/harbor.yaml
              echo "update image tag in ${harbor_file}"
              make update-yaml-value FILE=${harbor_file} VALUE=${image_tag} KEY=spec.helmValues.database.internal.image.tag
              make update-yaml-value FILE=${harbor_file} VALUE=${image_tag} KEY=spec.helmValues.redis.internal.image.tag
              cat ${harbor_file}
              
              # update image tag in redis-tls-server.yaml for integration test
              redis_tls_server_file=testing/testdata/resources/redis-tls-server.yaml
              echo "update redis-tls-server image in ${redis_tls_server_file}"
              sed -i "s|goharbor-redis-photon:.*|goharbor-redis-photon:${image_tag}|g" ${redis_tls_server_file}
              cat ${redis_tls_server_file}
              
              # update e2e image
              e2e_script=testdata/script/run-harbor-e2e.sh
              echo "update e2e image in ${e2e_script}"
              cd testing
              make update-e2e-image-tag TAG=${image_tag} E2E_SCRIPT=${e2e_script}
              cat ${e2e_script}
              cd -
              
              # write image info into results
              echo "registry.alauda.cn:60070/devops/harbor-e2e-engine:${image_tag}" > $(results.string-result.path)
              echo -n "[
                \"build-harbor.alauda.cn/devops/goharbor-harbor-core:${image_tag}\",
                \"build-harbor.alauda.cn/devops/goharbor-harbor-jobservice:${image_tag}\",
                \"build-harbor.alauda.cn/devops/goharbor-harbor-registryctl:${image_tag}\",
                \"build-harbor.alauda.cn/devops/goharbor-harbor-portal:${image_tag}\",
                \"build-harbor.alauda.cn/devops/goharbor-harbor-exporter:${image_tag}\",
                \"build-harbor.alauda.cn/devops/goharbor-registry-photon:${image_tag}\",
                \"build-harbor.alauda.cn/devops/goharbor-nginx-photon:${image_tag}\",
                \"build-harbor.alauda.cn/devops/goharbor-trivy-adapter-photon:${image_tag}\",
                \"build-harbor.alauda.cn/devops/goharbor-harbor-db:${image_tag}\",
                \"build-harbor.alauda.cn/devops/goharbor-redis-photon:${image_tag}\"
              ]" > $(results.array-result.path)
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: catalog
            - name: kind
              value: task
            - name: name
              value: run-script
            - name: version
              value: "0.1"
        workspaces:
          - name: source
            workspace: source-amd64

      - name: commit
        runAfter:
          - update-image-tags
        timeout: 60m
        retries: 0
        params:
          - name: BASE_IMAGE
            value: registry.alauda.cn:60080/devops/nonroot/chainguard/git:latest
          - name: GIT_USER_NAME
            value: "Alauda Bot"
          - name: GIT_USER_EMAIL
            value: "alaudabot@alauda.io"
          - name: USER_HOME
            value: "/home/git"
          - name: VERBOSE
            value: "true"
          - name: GIT_SCRIPT
            value: |
              set -ex

              BASIC_AUTH_PATH="$(workspaces.basic-auth.path)"
              TOKEN_FILE="${BASIC_AUTH_PATH}/git-provider-token"

              if [ -f "${TOKEN_FILE}" ]; then
                echo "=> git-provider-token detected at ${TOKEN_FILE}, performing gh auth login"
                gh auth login --with-token < "${TOKEN_FILE}"
                echo "=> gh auth login completed"
              fi

              # Create temporary script file
              TMP_SCRIPT=$(mktemp)

              # Write script content to temp file
              # Harbor use patches file to update source code, but we only want to update the specified files
              # So we use git stash to stash the changes and restore other changes
              cat <<EOF > "${TMP_SCRIPT}"
              git stash push --keep-index -- \
                testing/testdata/script/run-harbor-e2e.sh \
                testing/testdata/snippets/base-values.yaml \
                testing/testdata/harbor.yaml \
                values.yaml
              git restore .
              git stash pop
              EOF
              chmod +x "${TMP_SCRIPT}"

              COMMIT_MESSAGE="Auto-commit by alaudabot in edge [ci skip] - $(context.taskRun.namespace)/$(context.taskRun.name)"
              
              # Commit the changes
              git-push-commit.sh \
                --revision $(params.git-revision) \
                $( [ -n "$(params.pull-request-number)" ] && printf -- "--pr-number %s" "$(params.pull-request-number)" ) \
                --source-path $(workspaces.source.path) \
                --output-path $(results.commit.path) \
                --message "${COMMIT_MESSAGE}" \
                --pre-commit "${TMP_SCRIPT}"

        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: extras
            - name: kind
              value: task
            - name: name
              value: git-cli
            - name: version
              value: "0.4"
        workspaces:
          - name: source
            workspace: source-amd64
          - name: basic-auth
            workspace: basic-auth

      - name: detect-component-changes
        runAfter:
          - git-version
        timeout: 60m
        retries: 3
        taskRef:
          resolver: hub
          params:
            - name: catalog
              value: catalog
            - name: kind
              value: task
            - name: name
              value: run-script
            - name: version
              value: "0.1"
        when:
          - input: $(params.skip-e2e)
            operator: notin
            values: ["true"]
        workspaces:
          - name: source
            workspace: source-amd64
          - name: secret
            workspace: basic-auth
        params:
          - name: image
            value: registry.alauda.cn:60080/devops/nonroot/chainguard/git:latest
          - name: imagePullPolicy
            value: Always
          - name: script
            value: |
              #!/bin/bash
              set -x

              export SOURCE_BRANCH=$(params.git-revision)
              export TARGET_BRANCH=$(params.target-branch)

              export RESULT_PATH=$(results.object-result.path)

              export WORKSPACE_SOURCE_PATH=$(workspaces.source.path)
              export WORKSPACE_SECRET_BOUND=$(workspaces.secret.bound)
              export WORKSPACE_SECRET_PATH=$(workspaces.secret.path)

              # Define components and their corresponding check paths
              declare -A components=(
                ["harbor_source_code"]="subtree/harbor .tekton/images/all-in-one.yaml"
              )

              # Export components to be used in the script
              export COMPONENTS_DEF=$(declare -p components)

              # Commit the changes
              calculate-changed-components.sh

              # The results of the script are stored in the object-result
              # {
              #   "message": "",                # Reserved field
              #   "any": true,                  # true indicates at least one component has changes
              #   "all": true,                  # true indicates all components have changes
              #   "changed_{key}": "true"       # {key} is the component name in components map, true indicates this component has changes
              # }

      - name: trigger-e2e-test
        timeout: 30m
        retries: 1
        runAfter:
          - commit
          - detect-component-changes
        taskRef:
          params:
            - name: catalog
              value: alauda
            - name: kind
              value: task
            - name: name
              value: trigger-pac
            - name: version
              value: "0.1"
          resolver: hub
        workspaces:
          - name: secret
            workspace: incoming-secret
        params:
          - name: repository
            value: alaudadevops-harbor-helm
          - name: branch
            value: $(params.git-revision)
          - name: pipeline-run
            value: harbor-integration-test
          - name: pac-params
            value:
              - "source_code_changed=$(tasks.detect-component-changes.results.object-result.changed_harbor_source_code)"
          - name: pr-number
            value: $(params.pull-request-number)

  taskRunTemplate:
    # 让所有任务都以非 root 用户运行。
    podTemplate:
      securityContext:
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        fsGroupChangePolicy: "OnRootMismatch"
  taskRunSpecs:
    - pipelineTaskName: compile-amd64
      computeResources:
        limits:
          cpu: "4"
          memory: 4Gi
        requests:
          cpu: "2"
          memory: 2Gi
    - pipelineTaskName: compile-arm64
      computeResources:
        limits:
          cpu: "4"
          memory: 4Gi
        requests:
          cpu: "2"
          memory: 2Gi
    - pipelineTaskName: fetch-thirdparty-amd64
      computeResources:
        limits:
          cpu: "4"
          memory: 4Gi
        requests:
          cpu: "2"
          memory: 2Gi
    - pipelineTaskName: fetch-thirdparty-arm64
      computeResources:
        limits:
          cpu: "4"
          memory: 4Gi
        requests:
          cpu: "2"
          memory: 2Gi
    - pipelineTaskName: build-e2e-image
      computeResources:
        limits:
          cpu: "6"
          memory: 4Gi
        requests:
          cpu: "3"
          memory: 2Gi

  workspaces:
    - name: source-amd64
      volumeClaimTemplate:
        spec:
          accessModes:
            - ReadWriteMany
          resources:
            requests:
              storage: 2Gi
    - name: source-arm64
      volumeClaimTemplate:
        spec:
          accessModes:
            - ReadWriteMany
          resources:
            requests:
              storage: 2Gi
    - name: dockerconfig
      secret:
        secretName: build-harbor.kauto.docfj
    # This secret will be replaced by the pac controller
    - name: basic-auth
      secret:
        secretName: "{{ git_auth_secret }}"
    - name: gitversion-config
      configMap:
        name: gitversion-config
    - name: sonar-credentials
      secret:
        secretName: sonarqube-credentials
    - name: go-cache
      persistentVolumeClaim:
        claimName: build-cache-v4
    - name: signkey
      secret:
        secretName: signing-secrets
    - name: incoming-secret
      secret:
        secretName: harbor-helm-repo-incoming-secret