release-pipeline.yaml

# Copyright 2019-2024 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: dashboard-release
spec:
  params:
    - name: package
      description: package to release
      default: github.com/tektoncd/dashboard
    - name: gitRevision
      description: the git revision to release
    - name: imageRegistry
      description: The target image registry
      default: gcr.io
    - name: imageRegistryPath
      description: The path (project) in the image registry
      default: tekton-releases
    - name: imageRegistryRegions
      description: The target image registry regions
      default: "us eu asia"
    - name: imageRegistryUser
      description: The user for the image registry credentials
      default: "_json_key"
    - name: versionTag
      description: The X.Y.Z version that the artifacts should be tagged with
    - name: releaseBucket
      description: bucket where the release is stored. The bucket must be project specific.
      default: gs://tekton-releases-nightly/dashboard
    - name: releaseAsLatest
      description: Whether to tag and publish this release as Pipelines' latest
      default: "true"
    - name: platforms
      description: Platforms to publish for the images (e.g. linux/amd64,linux/arm64)
      default: linux/amd64,linux/arm,linux/arm64,linux/s390x,linux/ppc64le
    - name: koExtraArgs
      description: Extra args to be passed to ko
      default: "--preserve-import-paths"
    - name: serviceAccountPath
      description: The path to the service account file within the release-secret workspace
    - name: serviceAccountImagesPath
      description: The path to the service account file or credentials within the release-images-secret workspace
  workspaces:
    - name: workarea
      description: The workspace where the repo will be cloned.
    - name: release-secret
      description: The secret that contains a service account authorized to push to the output bucket
    - name: release-images-secret
      description: The secret that contains a service account authorized to push to the image registry
  results:
    - name: commit-sha
      description: the sha of the commit that was released
      value: $(tasks.git-clone.results.commit)
    - name: release-file
      description: the URL of the release file
      value: $(tasks.report-bucket.results.release)
    - name: release-file-full
      description: the URL of the release file
      value: $(tasks.report-bucket.results.release-full)
  tasks:
    - name: git-clone
      taskRef:
        name: git-clone
      workspaces:
        - name: output
          workspace: workarea
          subpath: git
      params:
        - name: url
          value: https://$(params.package)
        - name: revision
          value: $(params.gitRevision)
    - name: precheck
      runAfter: [git-clone]
      taskRef:
        name: dashboard-prerelease-checks
      params:
        - name: package
          value: $(params.package)
        - name: versionTag
          value: $(params.versionTag)
        - name: releaseBucket
          value: $(params.releaseBucket)
      workspaces:
        - name: source-to-release
          workspace: workarea
          subpath: git
    - name: build
      runAfter: [precheck]
      taskRef:
        name: build-dashboard
      workspaces:
        - name: source
          workspace: workarea
          subpath: git
    - name: publish-images
      runAfter: [build]
      taskRef:
        name: publish-dashboard-release
      params:
        - name: package
          value: $(params.package)
        - name: versionTag
          value: $(params.versionTag)
        - name: imageRegistry
          value: $(params.imageRegistry)
        - name: imageRegistryPath
          value: $(params.imageRegistryPath)
        - name: imageRegistryUser
          value: $(params.imageRegistryUser)
        - name: imageRegistryRegions
          value: $(params.imageRegistryRegions)
        - name: releaseAsLatest
          value: $(params.releaseAsLatest)
        - name: serviceAccountPath
          value: $(params.serviceAccountImagesPath)
        - name: platforms
          value: $(params.platforms)
        - name: koExtraArgs
          value: $(params.koExtraArgs)
      workspaces:
        - name: source
          workspace: workarea
          subpath: git
        - name: output
          workspace: workarea
          subpath: bucket
        - name: release-secret
          workspace: release-images-secret
    - name: publish-to-bucket
      runAfter: [publish-images]
      taskRef:
        name: gcs-upload
      workspaces:
        - name: credentials
          workspace: release-secret
        - name: source
          workspace: workarea
          subpath: bucket
      params:
        - name: location
          value: $(params.releaseBucket)/previous/$(params.versionTag)
        - name: path
          value: $(params.versionTag)
        - name: serviceAccountPath
          value: $(params.serviceAccountPath)
    - name: publish-to-bucket-latest
      runAfter: [publish-images]
      when:
        - input: "$(params.releaseAsLatest)"
          operator: in
          values: ["true"]
      taskRef:
        name: gcs-upload
      workspaces:
        - name: credentials
          workspace: release-secret
        - name: source
          workspace: workarea
          subpath: bucket
      params:
        - name: location
          value: $(params.releaseBucket)/latest
        - name: path
          value: $(params.versionTag)
        - name: serviceAccountPath
          value: $(params.serviceAccountPath)
    - name: report-bucket
      runAfter: [publish-to-bucket]
      params:
        - name: releaseBucket
          value: $(params.releaseBucket)
        - name: versionTag
          value: $(params.versionTag)
      taskSpec:
        params:
          - name: releaseBucket
          - name: versionTag
        results:
          - name: release
            description: The full URL of the release file (read-only) in the bucket
            type: string
          - name: release-full
            description: The full URL of the release file (read/write) in the bucket
            type: string
        steps:
          - name: create-results
            image: docker.io/library/alpine:3.20.3@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d
            script: |
              BASE_URL=$(echo "$(params.releaseBucket)/previous/$(params.versionTag)")
              # If the bucket is in the gs:// return the corresponding public https URL
              BASE_URL=$(echo ${BASE_URL} | sed 's,gs://,https://storage.googleapis.com/,g')
              echo "${BASE_URL}/release.yaml" > $(results.release.path)
              echo "${BASE_URL}/release-full.yaml" > $(results.release-full.path)