release-to-nrrc.yaml

---
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: release-to-nrrc
  annotations:
    tekton.dev/pipelines.minVersion: "0.12.1"
    tekton.dev/tags: release
spec:
  description: |-
    Tekton release pipeline to release npm artifacts built through Middleware
    product in Konflux. The artifacts will be released to npm.registry.redhat.com.

    ## Important Note on Idempotency
    
    Charon (the NRRC publishing tool) has no mechanism for detecting that a npm tarball was already published. 
    Thus, when rerunning this pipeline with the same release, no artifacts will be filtered out and all will
    be passed to the conforma check and other release tasks. This means the pipeline will re-process all 
    artifacts on every run, but Charon itself handles duplicate publications appropriately at the NRRC level.
  params:
    - name: release
      type: string
      description:
        The namespaced name (namespace/name) of the Release custom resource initiating this pipeline execution
    - name: releasePlan
      type: string
      description: The namespaced name (namespace/name) of the releasePlan
    - name: releasePlanAdmission
      type: string
      description: The namespaced name (namespace/name) of the releasePlanAdmission
    - name: releaseServiceConfig
      type: string
      description: The namespaced name (namespace/name) of the releaseServiceConfig
    - name: snapshot
      type: string
      description: The namespaced name (namespace/name) of the snapshot
    - name: enterpriseContractPolicy
      type: string
      description: JSON representation of the EnterpriseContractPolicy
    - name: enterpriseContractExtraRuleData
      type: string
      description: |
        Extra rule data to be merged into the policy specified in params.enterpriseContractPolicy. Use syntax
        "key1=value1,key2=value2..."
      default: "pipeline_intention=release"
    - name: verify_ec_task_git_revision
      type: string
      description: Previously used for the Conforma task git resolver, now deprecated and ignored
      default: ignored
    - name: taskGitUrl
      type: string
      description: The url to the git repo where the release-service-catalog tasks to be used are stored
      default: https://github.com/konflux-ci/release-service-catalog.git
    - name: taskGitRevision
      type: string
      description: The revision in the taskGitUrl repo to be used
      default: production
    - name: ociStorage
      description: The OCI repository where the Trusted Artifacts are stored
      type: string
      default: "quay.io/konflux-ci/release-service-trusted-artifacts"
    - name: orasOptions
      description: oras options to pass to Trusted Artifacts calls
      type: string
      default: ""
    - name: trustedArtifactsDebug
      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable
      type: string
      default: ""
    - name: dataDir
      description: The location where data will be stored
      type: string
      # to avoid tar extraction errors, we need to specify a subdirectory
      # inside the volume.
      default: "/var/workdir/release"
  tasks:
    - name: verify-access-to-resources
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/verify-access-to-resources/verify-access-to-resources.yaml
      params:
        - name: release
          value: $(params.release)
        - name: releasePlan
          value: $(params.releasePlan)
        - name: releasePlanAdmission
          value: $(params.releasePlanAdmission)
        - name: releaseServiceConfig
          value: $(params.releaseServiceConfig)
        - name: snapshot
          value: $(params.snapshot)
        - name: requireInternalServices
          value: "false"
    - name: collect-data
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/collect-data/collect-data.yaml
      params:
        - name: release
          value: $(params.release)
        - name: releasePlan
          value: $(params.releasePlan)
        - name: releasePlanAdmission
          value: $(params.releasePlanAdmission)
        - name: releaseServiceConfig
          value: $(params.releaseServiceConfig)
        - name: snapshot
          value: $(params.snapshot)
        - name: subdirectory
          value: $(context.pipelineRun.uid)
        - name: ociStorage
          value: $(params.ociStorage)
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - verify-access-to-resources
    - name: collect-task-params
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/collect-task-params/collect-task-params.yaml
      params:
        - name: dataDir
          value: "$(params.dataDir)"
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: keysToExtract
          value: |
            [
              {"resultIndex": 0, "key": ".conforma.workerCount", "default": "4"}
            ]
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
      runAfter:
        - collect-data
    - name: check-data-keys
      params:
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: systems
          value: |
            [
              {"systemName": "nrrc", "dynamic": false}
            ]
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      taskRef:
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/check-data-keys/check-data-keys.yaml
        resolver: git
      runAfter:
        - collect-data
    - name: verify-conforma
      timeout: "4h00m0s"
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: https://github.com/conforma/tekton-catalog
          - name: revision
            value: "f20c7a8c15a71c9462b11e5a28f8907a29c7075a"
          - name: pathInRepo
            value: "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml"
      params:
        - name: SNAPSHOT_FILENAME
          value: "$(tasks.collect-data.results.snapshotSpec)"
        - name: SSL_CERT_DIR
          value: /var/run/secrets/kubernetes.io/serviceaccount
        - name: POLICY_CONFIGURATION
          value: $(params.enterpriseContractPolicy)
        - name: STRICT
          # only set to false for development
          value: "true"
        - name: IGNORE_REKOR
          value: "true"
        - name: EXTRA_RULE_DATA
          value: $(params.enterpriseContractExtraRuleData)
        - name: WORKERS
          value: "$(tasks.collect-task-params.results.extractedValues[0])"
        - name: SOURCE_DATA_ARTIFACT
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: TRUSTED_ARTIFACTS_DEBUG
          value: "$(params.trustedArtifactsDebug)"
      runAfter:
        - check-data-keys
        - collect-task-params
    - name: collect-charon-params
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/collect-charon-params/collect-charon-params.yaml
      params:
        - name: dataJsonPath
          value: "$(tasks.collect-data.results.data)"
        - name: snapshotPath
          value: "$(tasks.collect-data.results.snapshotSpec)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: releasePath
          value: "$(tasks.collect-data.results.release)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - verify-conforma
    - name: publish-to-nrrc
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/publish-to-nrrc/publish-to-nrrc.yaml
      params:
        - name: charonParamFilePath
          value: "$(tasks.collect-charon-params.results.charonParamFilePath)"
        - name: charonConfigFilePath
          value: "$(tasks.collect-charon-params.results.charonConfigFilePath)"
        - name: charonAWSSecret
          value: "$(tasks.collect-charon-params.results.charonAWSSecret)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-charon-params.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - collect-charon-params
  finally:
    - name: cleanup-internal-requests
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/cleanup-internal-requests/cleanup-internal-requests.yaml
      params:
        - name: pipelineRunUid
          value: $(context.pipelineRun.uid)