publish-index-image.yaml

---
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: publish-index-image
  annotations:
    tekton.dev/pipelines.minVersion: "0.12.1"
    tekton.dev/tags: release
spec:
  description: |-
    Publish a built FBC index image using skopeo
  params:
    - name: dataPath
      description: Path to the JSON string of the merged data to use in the data workspace
      type: string
    - name: internalRequestResultsFile
      type: string
      description: File containing the results of the build
    - name: retries
      type: string
      default: "0"
      description: Number of skopeo retries
    - name: requestTimeout
      type: string
      default: "360"
      description: Max seconds waiting for the status update
    - name: buildTimestamp
      type: string
      description: Build timestamp for the publishing image
    - name: pipelineRunUid
      type: string
      description: The uid of the current pipelineRun. Used as a label value when creating internal requests
    - name: ociStorage
      description: The OCI repository where the Trusted Artifacts are stored
      type: string
      default: "empty"
    - name: ociArtifactExpiresAfter
      description: Expiration date for the trusted artifacts created in the
        OCI repository. An empty string means the artifacts do not expire
      type: string
      default: "1d"
    - name: trustedArtifactsDebug
      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable
      type: string
      default: ""
    - name: orasOptions
      description: oras options to pass to Trusted Artifacts calls
      type: string
      default: ""
    - name: sourceDataArtifact
      type: string
      description: Location of trusted artifacts to be used to populate data directory
      default: ""
    - name: dataDir
      description: The location where data will be stored
      type: string
      default: /var/workdir/release
    - name: taskGitUrl
      type: string
      description: The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored
    - name: taskGitRevision
      type: string
      description: The revision in the taskGitUrl repo to be used
    - name: caTrustConfigMapName
      type: string
      description: The name of the ConfigMap to read CA bundle data from
      default: trusted-ca
    - name: caTrustConfigMapKey
      type: string
      description: The name of the key in the ConfigMap that contains the CA bundle data
      default: ca-bundle.crt
  results:
    - name: requestMessage
      type: string
    - name: sourceDataArtifact
      type: string
      description: Produced trusted data artifact
  volumes:
    - name: workdir
      emptyDir: {}
    - name: trusted-ca
      configMap:
        name: $(params.caTrustConfigMapName)
        items:
          - key: $(params.caTrustConfigMapKey)
            path: ca-bundle.crt
        optional: true
  stepTemplate:
    volumeMounts:
      - mountPath: /var/workdir
        name: workdir
      - name: trusted-ca
        mountPath: /mnt/trusted-ca
        readOnly: true
    securityContext:
      runAsUser: 1001
    env:
      - name: IMAGE_EXPIRES_AFTER
        value: $(params.ociArtifactExpiresAfter)
      - name: "ORAS_OPTIONS"
        value: "$(params.orasOptions)"
      - name: "DEBUG"
        value: "$(params.trustedArtifactsDebug)"
  steps:
    - name: use-trusted-artifact
      computeResources:
        limits:
          memory: 64Mi
        requests:
          memory: 64Mi
          cpu: 30m
      ref:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: stepactions/use-trusted-artifact/use-trusted-artifact.yaml
      params:
        - name: workDir
          value: $(params.dataDir)
        - name: sourceDataArtifact
          value: $(params.sourceDataArtifact)
    - name: publish-index-image
      image: >-
        quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3
      computeResources:
        limits:
          memory: 512Mi
        requests:
          memory: 512Mi
          cpu: 200m
      script: |
        #!/usr/bin/env bash
        set -e

        DATA_FILE="$(params.dataDir)/$(params.dataPath)"
        if [ ! -f "${DATA_FILE}" ] ; then
            echo "No valid data file was provided."
            exit 1
        fi

        request="publish-index-image-pipeline"
        credentials=$(jq -r '.fbc.publishingCredentials' "$DATA_FILE")
        pipelinerun_label="internal-services.appstudio.openshift.io/pipelinerun-uid"

        LENGTH="$(jq -r '.components | length' "$(params.dataDir)/$(params.internalRequestResultsFile)")"
        for((i=0; i<LENGTH; i++)); do
          targetIndex=$(jq -r --argjson i "$i" \
            '.components[$i].target_index' "$(params.dataDir)/$(params.internalRequestResultsFile)")

          sourceIndex="$(jq -r  --argjson i "$i" \
            '.components[$i].index_image' "$(params.dataDir)/$(params.internalRequestResultsFile)")"

          targetOcpVersion=$(jq -r --argjson i "$i" \
            '.components[$i].ocp_version' "$(params.dataDir)/$(params.internalRequestResultsFile)")

          buildTimestamp=$(jq -r --argjson i "$i" '.components[$i].completion_time' \
            "$(params.dataDir)/$(params.internalRequestResultsFile)")

          publishingImages=("$targetIndex")
          # only publish the extra timestamp-based tag if the targetIndex does not have it already
          if [[ ! "$targetIndex" =~ .*"$buildTimestamp"$ ]]; then
            publishingImages+=("${targetIndex}-${buildTimestamp}")
          fi

          requestTimeout=$(params.requestTimeout)
          pipelineTimeoutSeconds=$((requestTimeout+300))
          pipelineTimeout=$(date -u -d @"${pipelineTimeoutSeconds}" +"%Hh%Mm%Ss")
          taskTimeout=$(date -u -d @"${requestTimeout}" +"%Hh%Mm%Ss")

          IR_RESULT_FILE=$(mktemp)

          for((x=0; x<${#publishingImages[@]}; x++ )); do
              echo "=== Creating internal request to publish image:"
              echo ""
              echo "- from: ${sourceIndex}"
              echo "- to: ${publishingImages[$x]}"

              internal-request --pipeline "${request}" \
                  -p sourceIndex="${sourceIndex}" \
                  -p targetIndex="${publishingImages[$x]}" \
                  -p targetOcpVersion="${targetOcpVersion}" \
                  -p publishingCredentials="${credentials}" \
                  -p retries="$(params.retries)" \
                  -p taskGitUrl="$(params.taskGitUrl)" \
                  -p taskGitRevision="$(params.taskGitRevision)" \
                  -t "$(params.requestTimeout)" \
                  --pipeline-timeout "${pipelineTimeout}" \
                  --task-timeout "$taskTimeout" \
                  -l ${pipelinerun_label}="$(params.pipelineRunUid)" \
                  | tee "$IR_RESULT_FILE" || \
                  (grep "^\[" "$IR_RESULT_FILE" | jq . && exit 1)

              internalRequest=$(awk -F"'" '/created/ { print $2 }' "$IR_RESULT_FILE")
              echo "done (${internalRequest})"

              results=$(kubectl get internalrequest "${internalRequest}" -o=jsonpath='{.status.results}')
              requestMessage=$(echo "${results}" | jq -r '.requestMessage // ""')

              if echo "${requestMessage}" | grep -qi "error"; then
                echo "ERROR: Publish to ${publishingImages[$x]} failed"
                echo "requestMessage: ${requestMessage}"
                exit 1
              fi
              echo "=== published successfully (${publishingImages[$x]})"

              echo ""
              echo ""
          done
        done
    - name: create-trusted-artifact
      computeResources:
        limits:
          memory: 128Mi
        requests:
          memory: 128Mi
          cpu: 250m
      ref:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: stepactions/create-trusted-artifact/create-trusted-artifact.yaml
      params:
        - name: ociStorage
          value: $(params.ociStorage)
        - name: workDir
          value: $(params.dataDir)
        - name: sourceDataArtifact
          value: $(results.sourceDataArtifact.path)