-
Notifications
You must be signed in to change notification settings - Fork 1.8k
/
release-pipeline.yaml
282 lines (282 loc) · 9.29 KB
/
release-pipeline.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
---
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
name: pipeline-release
spec:
params:
- name: package
description: package to release
default: github.com/tektoncd/pipeline
- name: gitRevision
description: the git revision to release
- name: imageRegistry
description: The target image registry
default: gcr.io
- name: imageRegistryPath
description: The path (project) in the image registry
default: tekton-releases
- name: imageRegistryRegions
description: The target image registry regions
default: "us eu asia"
- name: imageRegistryUser
description: The user for the image registry credentials
default: _json_key
- name: versionTag
description: The X.Y.Z version that the artifacts should be tagged with
- name: releaseBucket
description: bucket where the release is stored. The bucket must be project specific.
default: gs://tekton-releases-nightly/pipeline
- name: releaseAsLatest
description: Whether to tag and publish this release as Pipelines' latest
default: "true"
- name: buildPlatforms
description: Platforms to build images for (e.g. linux/amd64,linux/arm64)
default: linux/amd64,linux/arm,linux/arm64,linux/s390x,linux/ppc64le
- name: publishPlatforms
description: |
Platforms to publish images for (e.g. linux/amd64,linux/arm64,windows/amd64). This
can differ from buildPlatforms due to the fact that a windows-compatible base image
is constructed for the publishing phase.
default: linux/amd64,linux/arm,linux/arm64,linux/s390x,linux/ppc64le,windows/amd64
- name: koExtraArgs
description: Extra args to be passed to ko
default: "--preserve-import-paths"
- name: serviceAccountPath
description: The path to the service account file within the release-secret workspace
- name: serviceAccountImagesPath
description: The path to the service account file or credentials within the release-images-secret workspace
- name: runTests
description: If set to something other than "true", skip the build and test tasks
default: "true"
workspaces:
- name: workarea
description: The workspace where the repo will be cloned.
- name: release-secret
description: The secret that contains a service account authorized to push to the output bucket
- name: release-images-secret
description: The secret that contains a service account authorized to push to the imageRegistry
results:
- name: commit-sha
description: the sha of the commit that was released
value: $(tasks.git-clone.results.commit)
- name: release-file
description: the URL of the release file
value: $(tasks.report-bucket.results.release)
- name: release-file-no-tag
description: the URL of the release file
value: $(tasks.report-bucket.results.release-no-tag)
tasks:
- name: git-clone
taskRef:
resolver: hub
params:
- name: name
value: git-clone
- name: version
value: "0.7"
workspaces:
- name: output
workspace: workarea
subpath: git
params:
- name: url
value: https://$(params.package)
- name: revision
value: $(params.gitRevision)
- name: precheck
runAfter: [git-clone]
taskRef:
resolver: git
params:
- name: repo
value: plumbing
- name: org
value: tektoncd
- name: revision
value: aeed19e5a36f335ebfdc4b96fa78d1ce5bb4f7b8
- name: pathInRepo
value: tekton/resources/release/base/prerelease_checks.yaml
params:
- name: package
value: $(params.package)
- name: versionTag
value: $(params.versionTag)
- name: releaseBucket
value: $(params.releaseBucket)
workspaces:
- name: source-to-release
workspace: workarea
subpath: git
- name: unit-tests
runAfter: [precheck]
when:
- cel: "'$(params.runTests)' == 'true'"
taskRef:
resolver: bundles
params:
- name: bundle
value: gcr.io/tekton-releases/catalog/upstream/golang-test:0.2
- name: name
value: golang-test
- name: kind
value: task
params:
- name: package
value: $(params.package)
- name: flags
value: -v -mod=vendor
workspaces:
- name: source
workspace: workarea
subpath: git
- name: build
runAfter: [precheck]
when:
- cel: "'$(params.runTests)' == 'true'"
taskRef:
resolver: bundles
params:
- name: bundle
value: gcr.io/tekton-releases/catalog/upstream/golang-build:0.3
- name: name
value: golang-build
- name: kind
value: task
params:
- name: package
value: $(params.package)
- name: packages
value: ./cmd/...
workspaces:
- name: source
workspace: workarea
subpath: git
- name: publish-images
runAfter: [unit-tests, build]
taskRef:
resolver: git
params:
- name: repo
value: pipeline
- name: org
value: tektoncd
- name: revision
value: $(params.gitRevision)
- name: pathInRepo
value: tekton/publish.yaml
params:
- name: package
value: $(params.package)
- name: versionTag
value: $(params.versionTag)
- name: imageRegistry
value: $(params.imageRegistry)
- name: imageRegistryPath
value: $(params.imageRegistryPath)
- name: imageRegistryUser
value: $(params.imageRegistryUser)
- name: imageRegistryRegions
value: $(params.imageRegistryRegions)
- name: releaseAsLatest
value: $(params.releaseAsLatest)
- name: serviceAccountPath
value: $(params.serviceAccountImagesPath)
- name: platforms
value: $(params.publishPlatforms)
- name: koExtraArgs
value: $(params.koExtraArgs)
workspaces:
- name: source
workspace: workarea
subpath: git
- name: output
workspace: workarea
subpath: bucket
- name: release-secret
workspace: release-images-secret
timeout: 2h
- name: publish-to-bucket
runAfter: [publish-images]
taskRef:
resolver: bundles
params:
- name: bundle
value: gcr.io/tekton-releases/catalog/upstream/gcs-upload:0.3
- name: name
value: gcs-upload
- name: kind
value: task
workspaces:
- name: credentials
workspace: release-secret
- name: source
workspace: workarea
subpath: bucket
params:
- name: location
value: $(params.releaseBucket)/previous/$(params.versionTag)
- name: path
value: $(params.versionTag)
- name: serviceAccountPath
value: $(params.serviceAccountPath)
- name: publish-to-bucket-latest
runAfter: [publish-images]
when:
- input: "$(params.releaseAsLatest)"
operator: in
values: ["true"]
taskRef:
resolver: bundles
params:
- name: bundle
value: gcr.io/tekton-releases/catalog/upstream/gcs-upload:0.3
- name: name
value: gcs-upload
- name: kind
value: task
workspaces:
- name: credentials
workspace: release-secret
- name: source
workspace: workarea
subpath: bucket
params:
- name: location
value: $(params.releaseBucket)/latest
- name: path
value: $(params.versionTag)
- name: serviceAccountPath
value: $(params.serviceAccountPath)
- name: deleteExtraFiles
value: "true" # Uses rsync to copy content into latest
- name: report-bucket
runAfter: [publish-to-bucket]
params:
- name: releaseBucket
value: $(params.releaseBucket)
- name: versionTag
value: $(params.versionTag)
taskSpec:
params:
- name: releaseBucket
- name: versionTag
results:
- name: release
description: The full URL of the release file in the bucket
- name: release-no-tag
description: The full URL of the release file (no tag) in the bucket
steps:
- name: create-results
image: docker.io/library/alpine:3.20.3@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d
env:
- name: RELEASE_BUCKET
value: $(params.releaseBucket)
- name: VERSION_TAG
value: $(params.versionTag)
script: |
BASE_URL=$(echo "${RELEASE_BUCKET}/previous/${VERSION_TAG}")
# If the bucket is in the gs:// return the corresponding public https URL
BASE_URL=$(echo ${BASE_URL} | sed 's,gs://,https://storage.googleapis.com/,g')
echo "${BASE_URL}/release.yaml" > $(results.release.path)
echo "${BASE_URL}/release.notag.yaml" > $(results.release-no-tag.path)