.kres.yaml

kind: golang.Generate
spec:
  versionPackagePath: internal/version
---
kind: golang.GoVulnCheck
spec:
  ignore: []
---
kind: golang.Build
spec:
  outputs:
    linux-amd64:
      GOOS: linux
      GOARCH: amd64
    linux-arm64:
      GOOS: linux
      GOARCH: arm64
---
kind: golang.Toolchain
spec:
  makefile:
    extraVariables:
      - name: PKGS_PREFIX
        defaultValue: ghcr.io/siderolabs
      - name: PKGS
        defaultValue: v1.14.0-alpha.0-70-g0870a4b
  docker:
    extraArgs:
      - PKGS_PREFIX
      - PKGS
  buildTags:
    - enterprise
---
kind: common.Docker
spec:
  extraBuildArgs:
    - PKGS_PREFIX
    - PKGS
---
kind: common.Image
name: image-image-factory
spec:
  extraEnvironment:
    PLATFORM: linux/amd64,linux/arm64
  environment:
    TUF_ROOT: /tmp
  additionalImages: [] # so we copy same fhs and ca-certificates as the version of other tools
  allowedLocalPaths:
    - package.json
    - package-lock.json
  dependsOn:
    - tailwind
  entrypoint: /usr/bin/image-factory
  copyFrom:
    - name: imager-tools
      stage: imager-tools
---
kind: auto.Helm
spec:
  enabled: true
  chartDir: deploy/helm/image-factory
  chartVersionMajor: 1
  template:
    setFile:
      - cacheSigningKey.key=deploy/helm/e2e/testdata/signing-key.key
---
kind: auto.CustomSteps
spec:
  steps:
    - name: imager-base
      toplevel: true
    - name: imager-tools
      toplevel: true
    - name: integration.test
      toplevel: true
    - name: integration.enterprise.test
      toplevel: true
    - name: integration-direct
      toplevel: true
      dependants:
        - coverage
    - name: integration-s3
      toplevel: true
      dependants:
        - coverage
    - name: integration-cdn
      toplevel: true
      dependants:
        - coverage
    - name: integration-proxy-installer
      toplevel: true
      dependants:
        - coverage
    - name: integration-enterprise
      toplevel: true
      dependants:
        - coverage
    - name: tailwind
      toplevel: true
    - name: docs
      toplevel: true
    - name: docker-compose-up
      toplevel: true
    - name: docker-compose-down
      toplevel: true
    - name: talosctl
      toplevel: true
    - name: tools
      toplevel: true
    - name: chart-test
      toplevel: true
    - name: k8s-up
      toplevel: true
    - name: k8s-down
      toplevel: true
    - name: chainsaw-install
      toplevel: true
    - name: chart-e2e-chainsaw
      toplevel: true
    - name: chart-e2e-ci
      toplevel: true
    - name: chart-version
      toplevel: true
    - name: $(ARTIFACTS)/image-signer
      toplevel: true
    - name: sign-images
      toplevel: true
    - name: push-talos-vex-data
      toplevel: true
    - name: update-local-path-provisioner
      toplevel: true
---
kind: custom.Step
name: imager-base
spec:
  makefile:
    enabled: true
    phony: true
  docker:
    enabled: true
    stages:
      - name: pkg-fhs
        from: ${PKGS_PREFIX}/fhs:${PKGS}
      - name: pkg-ca-certificates
        from: ${PKGS_PREFIX}/ca-certificates:${PKGS}
      - name: pkg-musl
        from: ${PKGS_PREFIX}/musl:${PKGS}
      - name: pkg-cpio
        from: ${PKGS_PREFIX}/cpio:${PKGS}
      - name: pkg-dosfstools
        from: ${PKGS_PREFIX}/dosfstools:${PKGS}
      - name: pkg-grub
        from: ${PKGS_PREFIX}/grub:${PKGS}
      - name: pkg-grub-amd64
        from: ${PKGS_PREFIX}/grub:${PKGS}
        platform: linux/amd64
      - name: pkg-grub-arm64
        from: ${PKGS_PREFIX}/grub:${PKGS}
        platform: linux/arm64
      - name: pkg-grub-unicode
        from: ${PKGS_PREFIX}/installer:v1.9.4
      - name: pkg-kmod
        from: ${PKGS_PREFIX}/kmod:${PKGS}
      - name: pkg-libarchive
        from: ${PKGS_PREFIX}/libarchive:${PKGS}
      - name: pkg-libattr
        from: ${PKGS_PREFIX}/libattr:${PKGS}
      - name: pkg-libinih
        from: ${PKGS_PREFIX}/libinih:${PKGS}
      - name: pkg-liblzma
        from: ${PKGS_PREFIX}/liblzma:${PKGS}
      - name: pkg-liburcu
        from: ${PKGS_PREFIX}/liburcu:${PKGS}
      - name: pkg-openssl
        from: ${PKGS_PREFIX}/openssl:${PKGS}
      - name: pkg-open-vmdk
        from: ${PKGS_PREFIX}/open-vmdk:${PKGS}
      - name: pkg-xfsprogs
        from: ${PKGS_PREFIX}/xfsprogs:${PKGS}
      - name: pkg-e2fsprogs
        from: ${PKGS_PREFIX}/e2fsprogs:${PKGS}
      - name: pkg-glib
        from: ${PKGS_PREFIX}/glib:${PKGS}
      - name: pkg-libburn
        from: ${PKGS_PREFIX}/libburn:${PKGS}
      - name: pkg-libisoburn
        from: ${PKGS_PREFIX}/libisoburn:${PKGS}
      - name: pkg-libisofs
        from: ${PKGS_PREFIX}/libisofs:${PKGS}
      - name: pkg-mtools
        from: ${PKGS_PREFIX}/mtools:${PKGS}
      - name: pkg-pcre2
        from: ${PKGS_PREFIX}/pcre2:${PKGS}
      - name: pkg-pigz
        from: ${PKGS_PREFIX}/pigz:${PKGS}
      - name: pkg-qemu-tools
        from: ${PKGS_PREFIX}/qemu-tools:${PKGS}
      - name: pkg-squashfs-tools
        from: ${PKGS_PREFIX}/squashfs-tools:${PKGS}
      - name: pkg-tar
        from: ${PKGS_PREFIX}/tar:${PKGS}
      - name: pkg-xz
        from: ${PKGS_PREFIX}/xz:${PKGS}
      - name: pkg-zlib
        from: ${PKGS_PREFIX}/zlib:${PKGS}
      - name: pkg-zstd
        from: ${PKGS_PREFIX}/zstd:${PKGS}
---
kind: custom.Step
name: imager-tools
spec:
  makefile:
    enabled: true
    phony: true
  docker:
    enabled: true
    stages:
      - name: imager-tools
        description: copies the imager tools
        steps:
          - copy:
              from: pkg-fhs
              src: /
              dst: /
          - copy:
              from: pkg-ca-certificates
              src: /
              dst: /
          - copy:
              from: pkg-musl
              src: /
              dst: /
          - copy:
              from: pkg-cpio
              src: /
              dst: /
          - copy:
              from: pkg-dosfstools
              src: /
              dst: /
          - copy:
              from: pkg-grub
              src: /
              dst: /
          - copy:
              from: pkg-grub-amd64
              src: /usr/lib/grub
              dst: /usr/lib/grub
          - copy:
              from: pkg-grub-arm64
              src: /usr/lib/grub
              dst: /usr/lib/grub
          - copy:
              from: pkg-grub-unicode
              src: /usr/share/grub/unicode.pf2
              dst: /usr/share/grub/unicode.pf2
          - copy:
              from: pkg-kmod
              src: /
              dst: /
          - copy:
              from: pkg-libarchive
              src: /
              dst: /
          - copy:
              from: pkg-libattr
              src: /
              dst: /
          - copy:
              from: pkg-libinih
              src: /
              dst: /
          - copy:
              from: pkg-liblzma
              src: /
              dst: /
          - copy:
              from: pkg-liburcu
              src: /
              dst: /
          - copy:
              from: pkg-openssl
              src: /
              dst: /
          - copy:
              from: pkg-open-vmdk
              src: /
              dst: /
          - copy:
              from: pkg-xfsprogs
              src: /
              dst: /
          - copy:
              from: pkg-e2fsprogs
              src: /
              dst: /
          - copy:
              from: pkg-glib
              src: /
              dst: /
          - copy:
              from: pkg-libburn
              src: /
              dst: /
          - copy:
              from: pkg-libisoburn
              src: /
              dst: /
          - copy:
              from: pkg-libisofs
              src: /
              dst: /
          - copy:
              from: pkg-mtools
              src: /
              dst: /
          - copy:
              from: pkg-pcre2
              src: /
              dst: /
          - copy:
              from: pkg-pigz
              src: /
              dst: /
          - copy:
              from: pkg-qemu-tools
              src: /
              dst: /
          - copy:
              from: pkg-squashfs-tools
              src: /
              dst: /
          - copy:
              from: pkg-tar
              src: /
              dst: /
          - copy:
              from: pkg-xz
              src: /
              dst: /
          - copy:
              from: pkg-zlib
              src: /
              dst: /
          - copy:
              from: pkg-zstd
              src: /
              dst: /
---
kind: custom.Step
name: integration.test
spec:
  docker:
    enabled: true
    stages:
      - name: integration-build
        description: builds the integration test binary
        from: base
        steps:
          - script:
              command: go test -c -covermode=atomic -coverpkg=./... -tags integration ./internal/integration
              cache:
                - /root/.cache/go-build
                - /go/pkg
      - name: integration.test
        description: copies out the integration test binary
        steps:
          - copy:
              from: integration-build
              src: /src/integration.test
              dst: /integration.test
  makefile:
    enabled: true
    phony: true
    script:
      - "@$(MAKE) local-$@ DEST=$(ARTIFACTS)"
---
kind: custom.Step
name: integration.enterprise.test
spec:
  docker:
    enabled: true
    stages:
      - name: integration-enterprise-build
        description: builds the integration test binary (Enterprise flavor)
        from: base
        steps:
          - script:
              command: go test -c -covermode=atomic -coverpkg=./... -tags integration,enterprise ./internal/integration
              cache:
                - /root/.cache/go-build
                - /go/pkg
      - name: integration.enterprise.test
        description: copies out the integration test binary
        steps:
          - copy:
              from: integration-enterprise-build
              src: /src/integration.test
              dst: /integration.enterprise.test
  makefile:
    enabled: true
    phony: true
    script:
      - "@$(MAKE) local-$@ DEST=$(ARTIFACTS)"
---
kind: custom.Step
name: integration-direct
spec:
  makefile:
    enabled: true
    phony: true
    depends:
      - integration.test
    variables:
      - name: RUN_TESTS_DIRECT
        defaultValue: TestIntegrationDirect
      - name: TEST_FLAGS
        defaultValue: ""
    script:
      - "@$(MAKE) image-image-factory PUSH=true"
      - docker pull $(REGISTRY)/$(USERNAME)/image-factory:$(TAG)
      - docker rm -f local-if || true
      - docker run -d -p 5100:5000 --name=local-if registry:3
      - docker run --rm --net=host --cap-drop=all --cap-add=DAC_OVERRIDE --userns=host -v /var/run:/var/run -v $(PWD)/$(ARTIFACTS)/:/out/ -v $(PWD)/$(ARTIFACTS)/integration.test:/bin/integration.test:ro --entrypoint /bin/integration.test $(REGISTRY)/$(USERNAME)/image-factory:$(TAG) -test.v $(TEST_FLAGS) -test.coverprofile=/out/coverage-integration-direct.txt -test.run $(RUN_TESTS_DIRECT)
      - docker rm -f local-if
  ghaction:
    enabled: true
    condition: on-pull-request
    parallelJob:
      name: integration-direct
      runnerGroup: large
    coverage:
      inputPaths:
        - coverage-integration-direct.txt
    environment:
      REGISTRY: registry.dev.siderolabs.io
      RUN_TESTS_DIRECT: TestIntegrationDirect
      TEST_FLAGS: "-test.schematic-service-repository=127.0.0.1:5100/image-factory/schematic -test.installer-external-repository=127.0.0.1:5100/siderolabs -test.installer-internal-repository=127.0.0.1:5100/siderolabs -test.cache-repository=127.0.0.1:5100/image-factory/cache -test.signing-cache-repository=127.0.0.1:5100/image-factory/signing-cache"
---
kind: custom.Step
name: integration-s3
spec:
  makefile:
    enabled: true
    phony: true
    depends:
      - integration.test
    variables:
      - name: RUN_TESTS_S3
        defaultValue: TestIntegrationS3
      - name: TEST_FLAGS
        defaultValue: ""
    script:
      - "@$(MAKE) image-image-factory PUSH=true"
      - docker pull $(REGISTRY)/$(USERNAME)/image-factory:$(TAG)
      - docker rm -f local-if || true
      - docker run -d -p 5100:5000 --name=local-if registry:3
      - docker run --rm --net=host --cap-drop=all --cap-add=DAC_OVERRIDE --userns=host -v /var/run:/var/run -v $(PWD)/$(ARTIFACTS)/:/out/ -v $(PWD)/$(ARTIFACTS)/integration.test:/bin/integration.test:ro --entrypoint /bin/integration.test $(REGISTRY)/$(USERNAME)/image-factory:$(TAG) -test.v $(TEST_FLAGS) -test.coverprofile=/out/coverage-integration-s3.txt -test.run $(RUN_TESTS_S3)
      - docker rm -f local-if
  ghaction:
    enabled: true
    condition: on-pull-request
    parallelJob:
      name: integration-s3
      runnerGroup: large
    coverage:
      inputPaths:
        - coverage-integration-s3.txt
    environment:
      REGISTRY: registry.dev.siderolabs.io
      RUN_TESTS: TestIntegrationS3
      TEST_FLAGS: "-test.schematic-service-repository=127.0.0.1:5100/image-factory/schematic -test.installer-external-repository=127.0.0.1:5100/siderolabs -test.installer-internal-repository=127.0.0.1:5100/siderolabs -test.cache-repository=127.0.0.1:5100/image-factory/cache -test.signing-cache-repository=127.0.0.1:5100/image-factory/signing-cache"
---
kind: custom.Step
name: integration-cdn
spec:
  makefile:
    enabled: true
    phony: true
    depends:
      - integration.test
    variables:
      - name: RUN_TESTS_CDN
        defaultValue: TestIntegrationCDN
      - name: TEST_FLAGS
        defaultValue: ""
    script:
      - "@$(MAKE) image-image-factory PUSH=true"
      - docker pull $(REGISTRY)/$(USERNAME)/image-factory:$(TAG)
      - docker rm -f local-if || true
      - docker run -d -p 5100:5000 --name=local-if registry:3
      - docker run --rm --net=host --cap-drop=all --cap-add=DAC_OVERRIDE --userns=host -v /var/run:/var/run -v $(PWD)/$(ARTIFACTS)/:/out/ -v $(PWD)/$(ARTIFACTS)/integration.test:/bin/integration.test:ro --entrypoint /bin/integration.test $(REGISTRY)/$(USERNAME)/image-factory:$(TAG) -test.v $(TEST_FLAGS) -test.coverprofile=/out/coverage-integration-cdn.txt -test.run $(RUN_TESTS_CDN)
      - docker rm -f local-if
  ghaction:
    enabled: true
    condition: on-pull-request
    parallelJob:
      name: integration-cdn
      runnerGroup: large
    coverage:
      inputPaths:
        - coverage-integration-cdn.txt
    environment:
      REGISTRY: registry.dev.siderolabs.io
      RUN_TESTS_CDN: TestIntegrationCDN
      TEST_FLAGS: "-test.schematic-service-repository=127.0.0.1:5100/image-factory/schematic -test.installer-external-repository=127.0.0.1:5100/siderolabs -test.installer-internal-repository=127.0.0.1:5100/siderolabs -test.cache-repository=127.0.0.1:5100/image-factory/cache -test.signing-cache-repository=127.0.0.1:5100/image-factory/signing-cache"
---
kind: custom.Step
name: integration-proxy-installer
spec:
  makefile:
    enabled: true
    phony: true
    depends:
      - integration.test
    variables:
      - name: RUN_TESTS_PROXY
        defaultValue: TestIntegrationDirect
      - name: TEST_FLAGS
        defaultValue: ""
    script:
      - "@$(MAKE) image-image-factory PUSH=true"
      - docker pull $(REGISTRY)/$(USERNAME)/image-factory:$(TAG)
      - docker rm -f local-if || true
      - docker run -d -p 5100:5000 --name=local-if registry:3
      - docker run --rm --net=host --cap-drop=all --cap-add=DAC_OVERRIDE --userns=host -v /var/run:/var/run -v $(PWD)/$(ARTIFACTS)/:/out/ -v $(PWD)/$(ARTIFACTS)/integration.test:/bin/integration.test:ro --entrypoint /bin/integration.test $(REGISTRY)/$(USERNAME)/image-factory:$(TAG) -test.v $(TEST_FLAGS) -test.coverprofile=/out/coverage-integration-direct.txt -test.run $(RUN_TESTS_PROXY)
      - docker rm -f local-if
  ghaction:
    enabled: true
    condition: on-pull-request
    parallelJob:
      name: integration-proxy-installer
      runnerGroup: large
    coverage:
      inputPaths:
        - coverage-integration-proxy-installer.txt
    environment:
      REGISTRY: registry.dev.siderolabs.io
      RUN_TESTS_PROXY: TestIntegrationDirect
      TEST_FLAGS: "-test.schematic-service-repository=127.0.0.1:5100/image-factory/schematic -test.installer-internal-repository=127.0.0.1:5100/siderolabs -test.cache-repository=127.0.0.1:5100/image-factory/cache -test.signing-cache-repository=127.0.0.1:5100/image-factory/signing-cache"
---
kind: custom.Step
name: integration-enterprise
spec:
  makefile:
    enabled: true
    phony: true
    depends:
      - integration.enterprise.test
    variables:
      - name: RUN_TESTS_ENTERPRISE
        defaultValue: TestIntegrationDirect
      - name: TEST_FLAGS
        defaultValue: ""
    script:
      - "@$(MAKE) image-image-factory PUSH=true"
      - docker pull $(REGISTRY)/$(USERNAME)/image-factory:$(TAG)
      - docker rm -f local-if || true
      - docker run -d -p 5100:5000 --name=local-if registry:3
      - docker run --rm --net=host --cap-drop=all --cap-add=DAC_OVERRIDE --userns=host -v /var/run:/var/run -v $(PWD)/$(ARTIFACTS)/:/out/ -v $(PWD)/$(ARTIFACTS)/integration.enterprise.test:/bin/integration.test:ro --entrypoint /bin/integration.test $(REGISTRY)/$(USERNAME)/image-factory:$(TAG) -test.v $(TEST_FLAGS) -test.coverprofile=/out/coverage-integration-enterprise.txt -test.run $(RUN_TESTS_ENTERPRISE)
      - docker rm -f local-if
  ghaction:
    enabled: true
    condition: on-pull-request
    parallelJob:
      name: integration-enterprise
      runnerGroup: large
    coverage:
      inputPaths:
        - coverage-integration-enterprise.txt
    environment:
      REGISTRY: registry.dev.siderolabs.io
      RUN_TESTS_ENTERPRISE: TestIntegrationDirect
      TEST_FLAGS: "-test.schematic-service-repository=127.0.0.1:5100/image-factory/schematic -test.installer-internal-repository=127.0.0.1:5100/siderolabs -test.cache-repository=127.0.0.1:5100/image-factory/cache -test.signing-cache-repository=127.0.0.1:5100/image-factory/signing-cache -test.spdx-cache-repository=127.0.0.1:5100/image-factory/spdx -test.vex-data-repository=ghcr.io/siderolabs/image-factory/test-vex-data"
      TAG_SUFFIX: "-enterprise"
---
kind: custom.Step
name: docker-compose-up
spec:
  makefile:
    enabled: true
    phony: true
    script:
      - "@$(MAKE) image-image-factory PUSH=true"
      - "@IMAGE_FACTORY_IMAGE=$(REGISTRY)/$(USERNAME)/image-factory:$(IMAGE_TAG) docker compose -f hack/dev/compose.yaml up --pull=always --remove-orphans --no-attach registry.local --no-attach registry.ghcr.io"
---
kind: custom.Step
name: docker-compose-down
spec:
  makefile:
    enabled: true
    phony: true
    script:
      - "@IMAGE_FACTORY_IMAGE=$(REGISTRY)/$(USERNAME)/image-factory:$(IMAGE_TAG) docker compose -f hack/dev/compose.yaml down"
---
kind: common.Build
spec:
  ignoredPaths:
    - node_modules/
---
kind: service.CodeCov
spec:
  targetThreshold: 50
---
kind: custom.Step
name: tailwind
spec:
  makefile:
    enabled: true
    phony: true
    script:
      - "@$(MAKE) local-tailwind-copy PUSH=false DEST=. PLATFORM=$(OPERATING_SYSTEM)/$(GOARCH)"
  docker:
    description: "Runs tailwind update"
    enabled: true
    stages:
      - name: tailwind-base
        description: "Installs tailwindcss"
        from: docker.io/node:24.14.1-alpine
        platform: "${BUILDPLATFORM}"
        workdir: /src
        steps:
          - copy:
              src: package.json package-lock.json
              dst: .
          - script:
              command: npm install
      - name: tailwind-update
        description: "tailwind update"
        from: tailwind-base
        steps:
          - copy:
              src: internal/frontend/http
              dst: internal/frontend/http
          - script:
              command: node_modules/.bin/tailwindcss -i internal/frontend/http/css/input.css -o internal/frontend/http/css/output.css --minify
      - name: tailwind-copy
        description: "Copies assets"
        steps:
          - copy:
              from: tailwind-update
              src: /src/internal/frontend/http/css/output.css
              dst: internal/frontend/http/css/output.css
---
kind: common.Repository
spec:
  licenses:
    - id: MPL-2.0
      header: |
        // This Source Code Form is subject to the terms of the Mozilla Public
        // License, v. 2.0. If a copy of the MPL was not distributed with this
        // file, You can obtain one at http://mozilla.org/MPL/2.0/.

    - id: BSL-1.1
      root: enterprise
      params:
        Licensor: Sidero Labs, Inc.
        LicensedWork: Image Factory
        Copyright: (c) 2026 Sidero Labs, Inc.
        ChangeDate: "2030-06-01"
        ChangeLicense: Mozilla Public License, version 2.0
        EnterpriseLink: https://www.siderolabs.com/contact/
      header: |
        // Copyright (c) 2026 Sidero Labs, Inc.
        //
        // Use of this software is governed by the Business Source License
        // included in the LICENSE file.
  licenseChecks:
    - root: "."
      header: |
        // This Source Code Form is subject to the terms of the Mozilla Public
        // License, v. 2.0. If a copy of the MPL was not distributed with this
        // file, You can obtain one at http://mozilla.org/MPL/2.0/
      includeSuffixes:
        - .go
      excludeSuffixes:
        - .pb.go
        - .pb.gw.go
      skipPaths:
        - enterprise/

    - root: enterprise
      header: |
        // Copyright (c) 2026 Sidero Labs, Inc.
        //
        // Use of this software is governed by the Business Source License
        // included in the LICENSE file.
      includeSuffixes:
        - .go
      excludeSuffixes:
        - .pb.go
        - .pb.gw.go
---
kind: custom.Step
name: docs
spec:
  docker:
    enabled: true
    stages:
      - name: docgen
        description: run the docgen
        from: base
        steps:
          - script:
              command: go run ./tools/docgen ./cmd/image-factory/cmd/options.go docs/configuration.md
              cache:
                - /root/.cache/go-build
                - /go/pkg
      - name: docs
        description: copies out the generated docs
        steps:
          - copy:
              from: docgen
              src: /src/docs/configuration.md
              dst: /configuration.md
  makefile:
    enabled: true
    phony: true
    script:
      - "@$(MAKE) local-$@ DEST=docs"
  ghaction:
    enabled: true
    condition: on-pull-request
  lefthook:
    enabled: true
    hooks:
      pre-commit:
        jobs:
          - name: fix
            group:
              jobs:
                - name: docs
                  run: make docs
                  stage_fixed: true
---
kind: custom.Step
name: talosctl
spec:
  makefile:
    enabled: true
    phony: true
    depends:
      - $(ARTIFACTS)
    variables:
      - name: GOOS
        defaultValue: $(shell uname -s | tr "[:upper:]" "[:lower:]")
      - name: TALOS_VERSION
        defaultValue: 1.12.2
    script:
      - |
        curl -Lo $(ARTIFACTS)/talosctl https://github.com/siderolabs/talos/releases/download/v$(TALOS_VERSION)/talosctl-$(GOOS)-$(GOARCH)
        chmod +x $(ARTIFACTS)/talosctl
---
kind: custom.Step
name: tools
spec:
  makefile:
    enabled: true
    phony: true
    depends:
      - talosctl
  ghaction:
    enabled: true
    condition: on-pull-request
---
kind: custom.Step
name: k8s-up
spec:
  makefile:
    enabled: true
    phony: true
    depends:
      - $(ARTIFACTS)
    variables:
      - name: K8S_VERSION
        defaultValue: v1.35.0
    script:
      - |
        $(ARTIFACTS)/talosctl cluster create docker \
            --name=image-factory-env \
            --talosconfig-destination=$(ARTIFACTS)/talosconfig \
            --kubernetes-version=$(K8S_VERSION) \
            --mtu=1450
        $(ARTIFACTS)/talosctl kubeconfig $(ARTIFACTS)/kubeconfig \
            --talosconfig=$(ARTIFACTS)/talosconfig \
            --nodes=10.5.0.2 \
            --force
---
kind: custom.Step
name: k8s-down
spec:
  makefile:
    enabled: true
    phony: true
    script:
      - |
        $(ARTIFACTS)/talosctl cluster destroy \
            --name=image-factory-env
        rm -f $(ARTIFACTS)/talosconfig $(ARTIFACTS)/kubeconfig
---
kind: custom.Step
name: chart-version
spec:
  makefile:
    enabled: true
    phony: true
    variables:
      - name: CHART_VERSION
        defaultValue: "0.0.0-alpha.0"
    script:
      - yq -i '.version = strenv(CHART_VERSION)' deploy/helm/image-factory/Chart.yaml
      - yq -i '.appVersion = strenv(TAG)' deploy/helm/image-factory/Chart.yaml
      - |
        sed -i '/# -- Repository to use for Image Factory/{n; s|repository:.*|repository: '"$(REGISTRY)/$(USERNAME)/image-factory"'|}' deploy/helm/image-factory/values.yaml
---
kind: custom.Step
name: chainsaw-install
spec:
  makefile:
    enabled: true
    phony: true
    variables:
      - name: CHAINSAW_VERSION
        defaultValue: v0.2.12
    depends:
      - $(ARTIFACTS)
    script:
      - |
        @curl -sSL https://github.com/kyverno/chainsaw/releases/download/$(CHAINSAW_VERSION)/chainsaw_linux_$(GOARCH).tar.gz \
          | tar -xz -C $(ARTIFACTS) chainsaw
        @chmod +x $(ARTIFACTS)/chainsaw
---
kind: custom.Step
name: chart-e2e-chainsaw
spec:
  makefile:
    enabled: true
    phony: true
    depends:
      - chainsaw-install
    script:
      - export KUBECONFIG=$(shell pwd)/$(ARTIFACTS)/kubeconfig && cd deploy/helm/e2e && $(shell pwd)/$(ARTIFACTS)/chainsaw test
---
kind: custom.Step
name: chart-e2e-ci
spec:
  makefile:
    enabled: true
    phony: true
    depends:
      - tools
    script:
      - "@$(MAKE) image-image-factory PUSH=true"
      - "@$(MAKE) chart-version CHART_VERSION=v1.0.0-test.1 REGISTRY=$(REGISTRY) USERNAME=$(USERNAME) TAG=$(TAG)"
      - "@$(MAKE) k8s-up"
      - "@$(MAKE) chart-e2e-chainsaw"
  ghaction:
    enabled: true
    condition: on-pull-request
    parallelJob:
      name: chart-e2e
      runnerGroup: large
    environment:
      REGISTRY: registry.dev.siderolabs.io
---
kind: custom.Step
name: $(ARTIFACTS)/image-signer
spec:
  makefile:
    variables:
      - name: GO_TOOLS_RELEASE
        defaultValue: v0.3.1
    enabled: true
    phony: true
    depends:
      - $(ARTIFACTS)
    script:
      - |
        @curl -sSL https://github.com/siderolabs/go-tools/releases/download/$(GO_TOOLS_RELEASE)/image-signer-$(OPERATING_SYSTEM)-$(GOARCH) -o $(ARTIFACTS)/image-signer
        @chmod +x $(ARTIFACTS)/image-signer
---
kind: custom.Step
name: sign-images
spec:
  makefile:
    enabled: true
    phony: true
    depends:
      - $(ARTIFACTS)/image-signer
    script:
      - |
        @$(ARTIFACTS)/image-signer sign --timeout=15m \
          $(TALOS_VEX_DATA_IMAGE_REF)@$$(crane digest $(TALOS_VEX_DATA_IMAGE_REF))
---
kind: custom.Step
name: push-talos-vex-data
spec:
  makefile:
    variables:
      - name: TALOS_VEX_DATA_IMAGE_REF
        defaultValue: $(REGISTRY_AND_USERNAME)/image-factory/test-vex-data:latest
    enabled: true
    phony: true
    script:
      - |
        @tar -C $(PWD)/internal/integration/testdata/vex-data -cvf $(PWD)/$(ARTIFACTS)/test-vulnerability-data.tar .
        @crane append -f $(PWD)/$(ARTIFACTS)/test-vulnerability-data.tar -t $(TALOS_VEX_DATA_IMAGE_REF)
---
kind: custom.Step
name: update-local-path-provisioner
spec:
  makefile:
    enabled: true
    phony: true
    variables:
      - name: LOCAL_PATH_PROVISIONER_VERSION
        defaultValue: v0.0.35
      - name: LOCAL_PATH_PROVISIONER_URL
        defaultValue: "https://raw.githubusercontent.com/rancher/local-path-provisioner/$(LOCAL_PATH_PROVISIONER_VERSION)/deploy/local-path-storage.yaml"
    script:
      - |
        @curl -sSL $(LOCAL_PATH_PROVISIONER_URL) -o ./deploy/helm/e2e/_manifests/local-path-storage.yaml
        @yq -i 'with(select(.kind == "StorageClass"); .metadata.annotations."storageclass.kubernetes.io/is-default-class" = "true")' ./deploy/helm/e2e/_manifests/local-path-storage.yaml
        @yq -i 'with(select(.kind == "Namespace"); .metadata.labels."pod-security.kubernetes.io/enforce" = "privileged")' ./deploy/helm/e2e/_manifests/local-path-storage.yaml
---
kind: golang.UnitTests
spec:
  extraArgs: "-tags=enterprise"
---
kind: golang.GolangciLint
spec:
  buildTags:
    - enterprise