push-disk-images-to-cdn.yaml

---
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: push-disk-images-to-cdn
  annotations:
    tekton.dev/pipelines.minVersion: "0.12.1"
    tekton.dev/tags: release
spec:
  description: |-
    Tekton Pipeline to push disk images to a cdn using pulp
  params:
    - name: release
      type: string
      description:
        The namespaced name (namespace/name) of the Release custom resource initiating this pipeline execution
    - name: releasePlan
      type: string
      description: The namespaced name (namespace/name) of the releasePlan
    - name: releasePlanAdmission
      type: string
      description: The namespaced name (namespace/name) of the releasePlanAdmission
    - name: releaseServiceConfig
      type: string
      description: The namespaced name (namespace/name) of the releaseServiceConfig
    - name: snapshot
      type: string
      description: The namespaced name (namespace/name) of the snapshot
    - name: enterpriseContractPolicy
      type: string
      description: JSON representation of the EnterpriseContractPolicy
    - name: enterpriseContractExtraRuleData
      type: string
      description: |
        Extra rule data to be merged into the policy specified in params.enterpriseContractPolicy. Use syntax
        "key1=value1,key2=value2..."
      default: "pipeline_intention=release"
    - name: verify_ec_task_git_revision
      type: string
      description: Previously used for the Conforma task git resolver, now deprecated and ignored
      default: ignored
    - name: taskGitUrl
      type: string
      description: The url to the git repo where the release-service-catalog tasks to be used are stored
      default: https://github.com/konflux-ci/release-service-catalog.git
    - name: taskGitRevision
      type: string
      description: The revision in the taskGitUrl repo to be used
    - name: ociStorage
      type: string
      description: The OCI repository where the Trusted Artifacts are stored
      default: "quay.io/konflux-ci/release-service-trusted-artifacts"
    - name: orasOptions
      description: oras options to pass to Trusted Artifacts calls
      type: string
      default: ""
    - name: trustedArtifactsDebug
      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable
      type: string
      default: ""
    - name: dataDir
      description: The location where data will be stored
      type: string
      # to avoid tar extraction errors, we need to specify a subdirectory
      # inside the volume.
      default: "/var/workdir/release"
  tasks:
    - name: verify-access-to-resources
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/verify-access-to-resources/verify-access-to-resources.yaml
      params:
        - name: release
          value: $(params.release)
        - name: releasePlan
          value: $(params.releasePlan)
        - name: releasePlanAdmission
          value: $(params.releasePlanAdmission)
        - name: releaseServiceConfig
          value: $(params.releaseServiceConfig)
        - name: snapshot
          value: $(params.snapshot)
        - name : requireInternalServices
          value: "true"
    - name: collect-data
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/collect-data/collect-data.yaml
      params:
        - name: release
          value: $(params.release)
        - name: releasePlan
          value: $(params.releasePlan)
        - name: releasePlanAdmission
          value: $(params.releasePlanAdmission)
        - name: releaseServiceConfig
          value: $(params.releaseServiceConfig)
        - name: snapshot
          value: $(params.snapshot)
        - name: subdirectory
          value: $(context.pipelineRun.uid)
        - name: ociStorage
          value: $(params.ociStorage)
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - verify-access-to-resources
    - name: reduce-snapshot
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/reduce-snapshot/reduce-snapshot.yaml
      params:
        - name: SNAPSHOT
          value: $(params.dataDir)/$(tasks.collect-data.results.snapshotSpec)
        - name: SINGLE_COMPONENT
          value: $(tasks.collect-data.results.singleComponentMode)
        - name: SINGLE_COMPONENT_CUSTOM_RESOURCE
          value: snapshot/$(tasks.collect-data.results.snapshotName)
        - name: SINGLE_COMPONENT_CUSTOM_RESOURCE_NS
          value: $(tasks.collect-data.results.snapshotNamespace)
        - name: SNAPSHOT_PATH
          value: $(params.dataDir)/$(tasks.collect-data.results.snapshotSpec)
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - collect-data
    - name: collect-task-params
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/collect-task-params/collect-task-params.yaml
      params:
        - name: dataDir
          value: "$(params.dataDir)"
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: keysToExtract
          value: |
            [
              {"resultIndex": 0, "key": ".conforma.workerCount", "default": "4"}
            ]
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
      runAfter:
        - collect-data
    - name: apply-mapping
      retries: 3
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/apply-mapping/apply-mapping.yaml
      params:
        - name: failOnEmptyResult
          value: "true"
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: snapshotPath
          value: "$(tasks.collect-data.results.snapshotSpec)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.reduce-snapshot.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - reduce-snapshot
    - name: verify-conforma
      timeout: "4h00m0s"
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: https://github.com/conforma/tekton-catalog
          - name: revision
            value: "f20c7a8c15a71c9462b11e5a28f8907a29c7075a"
          - name: pathInRepo
            value: "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml"
      params:
        - name: SNAPSHOT_FILENAME
          value: "$(tasks.collect-data.results.snapshotSpec)"
        - name: SSL_CERT_DIR
          value: /var/run/secrets/kubernetes.io/serviceaccount
        - name: POLICY_CONFIGURATION
          value: $(params.enterpriseContractPolicy)
        - name: STRICT
          value: "true"
        - name: IGNORE_REKOR
          value: "true"
        - name: EXTRA_RULE_DATA
          value: $(params.enterpriseContractExtraRuleData)
        - name: WORKERS
          value: "$(tasks.collect-task-params.results.extractedValues[0])"
        - name: SOURCE_DATA_ARTIFACT
          value: "$(tasks.apply-mapping.results.sourceDataArtifact)"
        - name: TRUSTED_ARTIFACTS_DEBUG
          value: "$(params.trustedArtifactsDebug)"
      runAfter:
        - apply-mapping
        - collect-task-params
    - name: check-data-keys
      params:
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: systems
          value: |
            [
              {"systemName": "cdn", "dynamic": false}
            ]
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.apply-mapping.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      taskRef:
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/check-data-keys/check-data-keys.yaml
        resolver: git
      runAfter:
        - apply-mapping
    - name: push-disk-images
      retries: 3
      timeout: "5h00m0s"
      when:
        - input: "$(tasks.apply-mapping.results.mapped)"
          operator: in
          values: ["true"]
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/push-disk-images/push-disk-images.yaml
      params:
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: snapshotPath
          value: "$(tasks.collect-data.results.snapshotSpec)"
        - name: pipelineRunUid
          value: $(context.pipelineRun.uid)
        - name: resultsDirPath
          value: "$(tasks.collect-data.results.resultsDir)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.check-data-keys.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: $(params.taskGitUrl)
        - name: taskGitRevision
          value: $(params.taskGitRevision)
      runAfter:
        - check-data-keys
        - verify-conforma
    - name: update-cr-status
      params:
        - name: resource
          value: $(params.release)
        - name: resultsDirPath
          value: $(tasks.collect-data.results.resultsDir)
        - name: ociStorage
          value: $(params.ociStorage)
        - name: resultArtifacts
          value:
            - "$(tasks.push-disk-images.results.sourceDataArtifact)=$(params.dataDir)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/update-cr-status/update-cr-status.yaml
      runAfter:
        - push-disk-images
  finally:
    - name: cleanup
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/cleanup-internal-requests/cleanup-internal-requests.yaml
      params:
        - name: pipelineRunUid
          value: $(context.pipelineRun.uid)