diff --git a/.tekton/agentrun-nc01-v02.yaml b/.tekton/agentrun-nc01-v02.yaml index 1c4f759..40f6e1b 100644 --- a/.tekton/agentrun-nc01-v02.yaml +++ b/.tekton/agentrun-nc01-v02.yaml @@ -1,28 +1,26 @@ apiVersion: tekton.dev/v1 kind: PipelineRun -metadata: +metadata: name: "agentrun-nc01-v02-ci-{{ revision }}" namespace: agentrun-ci - annotations: + annotations: pipelinesascode.tekton.dev/on-event: "[push]" pipelinesascode.tekton.dev/on-target-branch: "[v0.2]" pipelinesascode.tekton.dev/on-cel-expression: "event == 'push' && target_branch == 'v0.2' && node == 'NC01'" pipelinesascode.tekton.dev/max-keep-runs: "8" - unidesk.ai/ci-source: pipelines-as-code - unidesk.ai/ci-owner: unidesk - unidesk.ai/ci-path: github-pr-gitea-webhook-pac-tekton - unidesk.ai/ci-retry: gitea-public-read - unidesk.ai/ci-verification: nc01-gitea-pac - unidesk.ai/generated-from: "config/agentrun.yaml#controlPlane.lanes.nc01-v02" - labels: + unidesk.ai/owning-config-ref: "config/agentrun.yaml#controlPlane.lanes.nc01-v02" + unidesk.ai/effective-config-sha256: sha256:4130e05516354925eae4e23958538f836afd12205f2eeef4b58ccdc3e2c9599a + unidesk.ai/source-artifact-renderer: agentrun-control-plane + unidesk.ai/source-artifact-mode: embedded-pipeline-spec + labels: app.kubernetes.io/part-of: agentrun agentrun.pikastech.local/lane: v0.2 agentrun.pikastech.local/node: NC01 agentrun.pikastech.local/source-commit: "{{ revision }}" agentrun.pikastech.local/trigger: pipelines-as-code -spec: - pipelineSpec: - params: +spec: + pipelineSpec: + params: - name: git-url type: string default: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git @@ -93,15 +91,15 @@ spec: - name: artifact-catalog type: string default: deploy/artifact-catalog.nc01-v02.json - workspaces: + workspaces: - name: source - tasks: + tasks: - name: build-publish - workspaces: + workspaces: - name: source workspace: source - taskSpec: - params: + taskSpec: + params: - name: git-read-url - name: git-write-url - name: source-branch @@ -125,9 +123,9 @@ spec: - name: env-identity-files-json - name: gitops-root - name: artifact-catalog - workspaces: + workspaces: - name: source - steps: + steps: - name: source-checkout image: $(params.tools-image) script: "#!/bin/sh\nset -eu\nroot=\"$(workspaces.source.path)\"\nrm -rf \"$root/repo\"\ngit clone --no-checkout \"$(params.git-read-url)\" \"$root/repo\"\ncd \"$root/repo\"\ngit fetch origin \"+$(params.source-stage-ref):refs/remotes/origin/unidesk-source-snapshot\"\ngit checkout --detach \"$(params.revision)\"\nactual=$(git rev-parse HEAD)\ntest \"$actual\" = \"$(params.revision)\"\nENV_IDENTITY_FILES='$(params.env-identity-files-json)' BUILD_ARGS_JSON='$(params.build-args-json)' CONTAINER_HTTP_PROXY='$(params.container-http-proxy)' CONTAINER_HTTPS_PROXY='$(params.container-https-proxy)' CONTAINER_NO_PROXY='$(params.container-no-proxy)' node <<'NODE' > \"$root/env-identity\"\nconst { createHash } = require('node:crypto');\nconst { existsSync, lstatSync, readdirSync, readFileSync } = require('node:fs');\nconst { join } = require('node:path');\nconst files = JSON.parse(process.env.ENV_IDENTITY_FILES || '[]');\nconst buildArgs = JSON.parse(process.env.BUILD_ARGS_JSON || '[]');\nconst proxy = [`HTTP_PROXY=${process.env.CONTAINER_HTTP_PROXY || ''}`, `HTTPS_PROXY=${process.env.CONTAINER_HTTPS_PROXY || ''}`, `NO_PROXY=${process.env.CONTAINER_NO_PROXY || ''}`];\nconst skip = new Set(['.git', '.worktree', '.state', 'node_modules', 'coverage', 'tmp', '.tmp']);\nconst hash = createHash('sha256');\nfunction collect(input) {\n if (!existsSync(input)) return [{ path: input, missing: true }];\n const stat = lstatSync(input);\n if (stat.isFile()) return [{ path: input, missing: false }];\n if (!stat.isDirectory()) return [{ path: input, missing: true }];\n const out = [];\n const stack = [input];\n while (stack.length) {\n const dir = stack.pop();\n for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {\n if (entry.isDirectory() && skip.has(entry.name)) continue;\n const child = join(dir, entry.name);\n if (entry.isDirectory()) stack.push(child);\n else if (entry.isFile()) out.push({ path: child, missing: false });\n }\n }\n return out.sort((a, b) => a.path.localeCompare(b.path));\n}\nfor (const item of buildArgs) { hash.update('build-arg\\0'); hash.update(item); hash.update('\\0'); }\nfor (const item of proxy) { hash.update('build-container-proxy\\0'); hash.update(item); hash.update('\\0'); }\nfor (const file of files) for (const entry of collect(file)) { hash.update(entry.path); hash.update('\\0'); if (!entry.missing) hash.update(readFileSync(entry.path)); hash.update('\\0'); }\nprocess.stdout.write(hash.digest('hex').slice(0, 24));\nNODE\nBUILD_ARGS='$(params.build-args-json)' node <<'NODE' > \"$root/build-args.txt\"\nconst values = JSON.parse(process.env.BUILD_ARGS || '[]');\nfor (const value of values) console.log(`build-arg:${value}`);\nNODE\nchmod -R a+rwX \"$root\"\nenv_identity=$(cat \"$root/env-identity\")\nprintf '{\"ok\":true,\"phase\":\"source-checkout\",\"sourceCommit\":\"%s\",\"sourceStageRef\":\"%s\",\"envIdentity\":\"%s\",\"valuesPrinted\":false}\\n' \"$(params.revision)\" \"$(params.source-stage-ref)\" \"$env_identity\"" @@ -136,7 +134,7 @@ spec: script: "#!/bin/sh\nset -eu\nroot=\"$(workspaces.source.path)\"\nenv_identity=$(cat \"$root/env-identity\")\nimage_repository='$(params.image-repository)'\nmanifest_accept='application/vnd.oci.image.index.v1+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json'\nrepo_path=${image_repository#127.0.0.1:5000/}\nheaders=$(mktemp)\ndigest=''\nif curl -fsSI -H \"Accept: $manifest_accept\" \"http://127.0.0.1:5000/v2/$repo_path/manifests/$env_identity\" >\"$headers\"; then\n digest=$(awk -F': ' 'tolower($1)==\"docker-content-digest\"{print $2}' \"$headers\" | tr -d '\\r' | head -n 1)\nfi\nrm -f \"$headers\"\nif [ -n \"$digest\" ]; then\n image=\"$image_repository:$env_identity\"\n printf '{\"ok\":true,\"status\":\"reused\",\"sourceCommit\":\"%s\",\"envIdentity\":\"%s\",\"image\":\"%s\",\"digest\":\"%s\",\"repositoryDigest\":\"%s@%s\",\"valuesPrinted\":false}\\n' \"$(params.revision)\" \"$env_identity\" \"$image\" \"$digest\" \"$image_repository\" \"$digest\" > \"$root/build-result.json\"\n touch \"$root/skip-build\"\nelse\n printf '{\"ok\":false,\"status\":\"cache-miss\",\"sourceCommit\":\"%s\",\"envIdentity\":\"%s\",\"valuesPrinted\":false}\\n' \"$(params.revision)\" \"$env_identity\" > \"$root/build-result.json\"\nfi\nchmod a+rw \"$root/build-result.json\"\ncat \"$root/build-result.json\"" - name: build-env-image image: $(params.buildkit-image) - env: + env: - name: BUILDKITD_FLAGS value: "--oci-worker-no-process-sandbox --oci-worker-net=host --allow-insecure-entitlement network.host" - name: HTTP_PROXY @@ -155,22 +153,22 @@ spec: value: $(params.build-no-proxy) - name: no_proxy value: $(params.build-no-proxy) - securityContext: + securityContext: privileged: true runAsUser: 1000 runAsGroup: 1000 script: "#!/bin/sh\nset -eu\nroot=\"$(workspaces.source.path)\"\nif [ -f \"$root/skip-build\" ]; then cat \"$root/build-result.json\"; exit 0; fi\nenv_identity=$(cat \"$root/env-identity\")\nimage_repository='$(params.image-repository)'\nimage=\"$image_repository:$env_identity\"\ncontext_dir='$(params.context-dir)'\nif [ \"$context_dir\" = \".\" ]; then context_path=\"$root/repo\"; else context_path=\"$root/repo/${context_dir#./}\"; fi\nargs=\"build --allow network.host --frontend dockerfile.v0 --local context=$context_path --local dockerfile=$root/repo --opt filename=$(params.containerfile) --opt network=$(params.build-network)\"\nadd_opt() { args=\"$args --opt $1\"; }\nif [ -n '$(params.container-http-proxy)' ]; then add_opt 'build-arg:HTTP_PROXY=$(params.container-http-proxy)'; add_opt 'build-arg:http_proxy=$(params.container-http-proxy)'; fi\nif [ -n '$(params.container-https-proxy)' ]; then add_opt 'build-arg:HTTPS_PROXY=$(params.container-https-proxy)'; add_opt 'build-arg:https_proxy=$(params.container-https-proxy)'; fi\nif [ -n '$(params.container-https-proxy)' ]; then add_opt 'build-arg:ALL_PROXY=$(params.container-https-proxy)'; add_opt 'build-arg:all_proxy=$(params.container-https-proxy)'; elif [ -n '$(params.container-http-proxy)' ]; then add_opt 'build-arg:ALL_PROXY=$(params.container-http-proxy)'; add_opt 'build-arg:all_proxy=$(params.container-http-proxy)'; fi\nif [ -n '$(params.container-no-proxy)' ]; then add_opt 'build-arg:NO_PROXY=$(params.container-no-proxy)'; add_opt 'build-arg:no_proxy=$(params.container-no-proxy)'; fi\nwhile IFS= read -r opt; do [ -n \"$opt\" ] && add_opt \"$opt\"; done < \"$root/build-args.txt\"\nargs=\"$args --metadata-file $root/build-metadata.json --output type=image,name=$image,push=true,registry.insecure=true\"\nbuildctl-daemonless.sh $args\nmetadata_compact=$(tr -d '\\n' < \"$root/build-metadata.json\")\ndigest=$(printf '%s' \"$metadata_compact\" | sed -n 's/.*\"containerimage.digest\"[[:space:]]*:[[:space:]]*\"\\([^\"]*\\)\".*/\\1/p' | head -n 1)\ntest -n \"$digest\"\nprintf '{\"ok\":true,\"status\":\"built\",\"sourceCommit\":\"%s\",\"envIdentity\":\"%s\",\"image\":\"%s\",\"digest\":\"%s\",\"repositoryDigest\":\"%s@%s\",\"valuesPrinted\":false}\\n' \"$(params.revision)\" \"$env_identity\" \"$image\" \"$digest\" \"$image_repository\" \"$digest\" > \"$root/build-result.json\"\ncat \"$root/build-result.json\"" - name: publish-gitops image: $(params.tools-image) - env: + env: - name: GITEA_TOKEN - valueFrom: - secretKeyRef: + valueFrom: + secretKeyRef: name: pac-gitea-agentrun-nc01-v02 key: token optional: true - script: "#!/bin/sh\nset -eu\nroot=\"$(workspaces.source.path)\"\nbuild_result=\"$root/build-result.json\"\ntest -s \"$build_result\"\ntemplates_b64=\"W3sicGF0aCI6InNvdXJjZS5qc29uIiwiY29udGVudCI6IntcbiAgXCJsYW5lXCI6IFwidjAuMlwiLFxuICBcInNvdXJjZUNvbW1pdFwiOiBcIl9fQUdFTlRSVU5fU09VUkNFX0NPTU1JVF9fXCIsXG4gIFwiZ2VuZXJhdGVkQnlcIjogXCJ1bmlkZXNrIGNvbmZpZy9hZ2VudHJ1bi55YW1sXCIsXG4gIFwiY29uZmlnU291cmNlXCI6IFwiY29uZmlnL2FnZW50cnVuLnlhbWxcIlxufVxuIn0seyJwYXRoIjoiZGVwbG95L2FydGlmYWN0LWNhdGFsb2cubmMwMS12MDIuanNvbiIsImNvbnRlbnQiOiJ7XG4gIFwibGFuZVwiOiBcInYwLjJcIixcbiAgXCJzb3VyY2VCcmFuY2hcIjogXCJ2MC4yXCIsXG4gIFwiZ2l0b3BzQnJhbmNoXCI6IFwibmMwMS12MC4yLWdpdG9wc1wiLFxuICBcInNvdXJjZUNvbW1pdElkXCI6IFwiX19BR0VOVFJVTl9TT1VSQ0VfQ09NTUlUX19cIixcbiAgXCJzdW1tYXJ5XCI6IFwiYnVpbGQ9MSByZXVzZT0wIHBsYWNlaG9sZGVyPTBcIixcbiAgXCJzZXJ2aWNlc1wiOiBbXG4gICAge1xuICAgICAgXCJzZXJ2aWNlSWRcIjogXCJhZ2VudHJ1bi1tZ3JcIixcbiAgICAgIFwiYXJ0aWZhY3RLaW5kXCI6IFwiZW52LXJldXNlXCIsXG4gICAgICBcInN0YXR1c1wiOiBcIl9fQUdFTlRSVU5fSU1BR0VfU1RBVFVTX19cIixcbiAgICAgIFwiaW1hZ2VcIjogXCIxMjcuMC4wLjE6NTAwMC9hZ2VudHJ1bi9hZ2VudHJ1bi1tZ3ItZW52Ol9fQUdFTlRSVU5fRU5WX0lERU5USVRZX19cIixcbiAgICAgIFwiZGlnZXN0XCI6IFwic2hhMjU2OmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFcIixcbiAgICAgIFwicmVwb3NpdG9yeURpZ2VzdFwiOiBcIjEyNy4wLjAuMTo1MDAwL2FnZW50cnVuL2FnZW50cnVuLW1nci1lbnZAc2hhMjU2OmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFcIixcbiAgICAgIFwiaW1hZ2VUYWdcIjogXCJfX0FHRU5UUlVOX0VOVl9JREVOVElUWV9fXCIsXG4gICAgICBcImVudklkZW50aXR5XCI6IFwiX19BR0VOVFJVTl9FTlZfSURFTlRJVFlfX1wiLFxuICAgICAgXCJlbnZJbWFnZVwiOiBcIjEyNy4wLjAuMTo1MDAwL2FnZW50cnVuL2FnZW50cnVuLW1nci1lbnY6X19BR0VOVFJVTl9FTlZfSURFTlRJVFlfX1wiLFxuICAgICAgXCJlbnZEaWdlc3RcIjogXCJzaGEyNTY6YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYVwiLFxuICAgICAgXCJlbnZSZXBvc2l0b3J5RGlnZXN0XCI6IFwiMTI3LjAuMC4xOjUwMDAvYWdlbnRydW4vYWdlbnRydW4tbWdyLWVudkBzaGEyNTY6YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYVwiLFxuICAgICAgXCJib290Q29tbWl0XCI6IFwiX19BR0VOVFJVTl9TT1VSQ0VfQ09NTUlUX19cIixcbiAgICAgIFwiYm9vdFNjcmlwdFwiOiBcImRlcGxveS9ydW50aW1lL2Jvb3QvYWdlbnRydW4tYm9vdC5zaFwiLFxuICAgICAgXCJwcm92ZW5hbmNlXCI6IHtcbiAgICAgICAgXCJzb3VyY2VDb21taXRJZFwiOiBcIl9fQUdFTlRSVU5fU09VUkNFX0NPTU1JVF9fXCIsXG4gICAgICAgIFwic291cmNlXCI6IFwidW5pZGVzay15YW1sLW9ubHlcIixcbiAgICAgICAgXCJjb25maWdTb3VyY2VcIjogXCJjb25maWcvYWdlbnRydW4ueWFtbFwiLFxuICAgICAgICBcInZhbHVlc1ByaW50ZWRcIjogZmFsc2VcbiAgICAgIH1cbiAgICB9XG4gIF1cbn1cbiJ9LHsicGF0aCI6ImRlcGxveS9naXRvcHMvbm9kZS9uYzAxL2FyZ29jZC9wcm9qZWN0LnlhbWwiLCJjb250ZW50Ijoie2FwaVZlcnNpb246IGFyZ29wcm9qLmlvL3YxYWxwaGExLGtpbmQ6IEFwcFByb2plY3QsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMixuYW1lc3BhY2U6IGFyZ29jZCxsYWJlbHM6IHthcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mOiBhZ2VudHJ1bixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbGFuZTogdjAuMixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbm9kZTogTkMwMX19LHNwZWM6IHtkZXNjcmlwdGlvbjogQWdlbnRSdW4gdjAuMiBHaXRPcHMgbGFuZSxzb3VyY2VSZXBvczogW2h0dHA6Ly9naXQtbWlycm9yLWh0dHAuZGV2b3BzLWluZnJhLnN2Yy5jbHVzdGVyLmxvY2FsOjgwODAvcGlrYXNUZWNoL2FnZW50cnVuLmdpdCxodHRwOi8vZ2l0ZWEtaHR0cC5kZXZvcHMtaW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWw6MzAwMC9taXJyb3JzL3Bpa2FzVGVjaC1hZ2VudHJ1bi5naXRdLGRlc3RpbmF0aW9uczogW3tzZXJ2ZXI6IGh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2YyxuYW1lc3BhY2U6IGFnZW50cnVuLXYwMn1dLGNsdXN0ZXJSZXNvdXJjZVdoaXRlbGlzdDogW3tncm91cDogXCJcIixraW5kOiBOYW1lc3BhY2V9XSxuYW1lc3BhY2VSZXNvdXJjZVdoaXRlbGlzdDogW3tncm91cDogXCIqXCIsa2luZDogXCIqXCJ9XX19XG4ifSx7InBhdGgiOiJkZXBsb3kvZ2l0b3BzL25vZGUvbmMwMS9hcmdvY2QvYXBwbGljYXRpb24tdjAyLnlhbWwiLCJjb250ZW50Ijoie2FwaVZlcnNpb246IGFyZ29wcm9qLmlvL3YxYWxwaGExLGtpbmQ6IEFwcGxpY2F0aW9uLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbmMwMS12MDIsbmFtZXNwYWNlOiBhcmdvY2QsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fSxzcGVjOiB7cHJvamVjdDogYWdlbnRydW4tbmMwMS12MDIsc291cmNlOiB7cmVwb1VSTDogaHR0cDovL2dpdC1taXJyb3ItaHR0cC5kZXZvcHMtaW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWw6ODA4MC9waWthc1RlY2gvYWdlbnRydW4uZ2l0LHRhcmdldFJldmlzaW9uOiBuYzAxLXYwLjItZ2l0b3BzLHBhdGg6IGRlcGxveS9naXRvcHMvbm9kZS9uYzAxL3J1bnRpbWUtdjAyfSxkZXN0aW5hdGlvbjoge3NlcnZlcjogaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyfSxzeW5jUG9saWN5OiB7YXV0b21hdGVkOiB7cHJ1bmU6IGZhbHNlLHNlbGZIZWFsOiB0cnVlfSxzeW5jT3B0aW9uczogW0NyZWF0ZU5hbWVzcGFjZT10cnVlLEFwcGx5T3V0T2ZTeW5jT25seT10cnVlXX19fVxuIn0seyJwYXRoIjoiZGVwbG95L2dpdG9wcy9ub2RlL25jMDEvcnVudGltZS12MDIva3VzdG9taXphdGlvbi55YW1sIiwiY29udGVudCI6InthcGlWZXJzaW9uOiBrdXN0b21pemUuY29uZmlnLms4cy5pby92MWJldGExLGtpbmQ6IEt1c3RvbWl6YXRpb24scmVzb3VyY2VzOiBbbmFtZXNwYWNlLnlhbWwsbWdyLnlhbWwscnVubmVyLXJiYWMueWFtbF19XG4ifSx7InBhdGgiOiJkZXBsb3kvZ2l0b3BzL25vZGUvbmMwMS9ydW50aW1lLXYwMi9uYW1lc3BhY2UueWFtbCIsImNvbnRlbnQiOiJ7YXBpVmVyc2lvbjogdjEsa2luZDogTmFtZXNwYWNlLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX19XG4ifSx7InBhdGgiOiJkZXBsb3kvZ2l0b3BzL25vZGUvbmMwMS9ydW50aW1lLXYwMi9tZ3IueWFtbCIsImNvbnRlbnQiOiJ7YXBpVmVyc2lvbjogdjEsa2luZDogU2VydmljZUFjY291bnQsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1tZ3IsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fX1cbi0tLVxue2FwaVZlcnNpb246IHYxLGtpbmQ6IFNlcnZpY2UsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1tZ3IsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fSxzcGVjOiB7c2VsZWN0b3I6IHthcHAua3ViZXJuZXRlcy5pby9uYW1lOiBhZ2VudHJ1bi1tZ3J9LHBvcnRzOiBbe25hbWU6IGh0dHAscG9ydDogODA4MCx0YXJnZXRQb3J0OiBodHRwfV19fVxuLS0tXG57YXBpVmVyc2lvbjogYXBwcy92MSxraW5kOiBEZXBsb3ltZW50LG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbWdyLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX0sc3BlYzoge3JlcGxpY2FzOiAxLHNlbGVjdG9yOiB7bWF0Y2hMYWJlbHM6IHthcHAua3ViZXJuZXRlcy5pby9uYW1lOiBhZ2VudHJ1bi1tZ3J9fSx0ZW1wbGF0ZToge21ldGFkYXRhOiB7bGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDEsYXBwLmt1YmVybmV0ZXMuaW8vbmFtZTogYWdlbnRydW4tbWdyfSxhbm5vdGF0aW9uczoge2FnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9zb3VyY2UtY29tbWl0OiBfX0FHRU5UUlVOX1NPVVJDRV9DT01NSVRfXyxhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvZW52LWlkZW50aXR5OiBfX0FHRU5UUlVOX0VOVl9JREVOVElUWV9ffX0sc3BlYzoge3NlcnZpY2VBY2NvdW50TmFtZTogYWdlbnRydW4tbmMwMS12MDItbWdyLGNvbnRhaW5lcnM6IFt7bmFtZTogbWdyLGltYWdlOiAxMjcuMC4wLjE6NTAwMC9hZ2VudHJ1bi9hZ2VudHJ1bi1tZ3ItZW52QHNoYTI1NjphYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhLGltYWdlUHVsbFBvbGljeTogSWZOb3RQcmVzZW50LHBvcnRzOiBbe25hbWU6IGh0dHAsY29udGFpbmVyUG9ydDogODA4MH1dLGVudjogW3tuYW1lOiBBR0VOVFJVTl9MQU5FLHZhbHVlOiB2MC4yfSx7bmFtZTogREFUQUJBU0VfVVJMLHZhbHVlRnJvbToge3NlY3JldEtleVJlZjoge25hbWU6IGFnZW50cnVuLXYwMi1tZ3ItZGIsa2V5OiBEQVRBQkFTRV9VUkx9fX0se25hbWU6IEFHRU5UUlVOX1NPVVJDRV9DT01NSVQsdmFsdWU6IF9fQUdFTlRSVU5fU09VUkNFX0NPTU1JVF9ffSx7bmFtZTogQUdFTlRSVU5fQk9PVF9DT01NSVQsdmFsdWU6IF9fQUdFTlRSVU5fU09VUkNFX0NPTU1JVF9ffSx7bmFtZTogQUdFTlRSVU5fQk9PVF9NT0RFLHZhbHVlOiBtZ3J9LHtuYW1lOiBBR0VOVFJVTl9CT09UX1JFUE9fVVJMLHZhbHVlOiBodHRwOi8vZ2l0ZWEtaHR0cC5kZXZvcHMtaW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWw6MzAwMC9taXJyb3JzL3Bpa2FzVGVjaC1hZ2VudHJ1bi5naXR9LHtuYW1lOiBBR0VOVFJVTl9FTlZfSURFTlRJVFksdmFsdWU6IF9fQUdFTlRSVU5fRU5WX0lERU5USVRZX199LHtuYW1lOiBBR0VOVFJVTl9SVU5USU1FX05BTUVTUEFDRSx2YWx1ZTogYWdlbnRydW4tdjAyfSx7bmFtZTogQUdFTlRSVU5fSU5URVJOQUxfTUdSX1VSTCx2YWx1ZTogaHR0cDovL2FnZW50cnVuLW1nci5hZ2VudHJ1bi12MDIuc3ZjLmNsdXN0ZXIubG9jYWw6ODA4MH0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9JTUFHRSx2YWx1ZTogMTI3LjAuMC4xOjUwMDAvYWdlbnRydW4vYWdlbnRydW4tbWdyLWVudkBzaGEyNTY6YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYX0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9TRVJWSUNFX0FDQ09VTlQsdmFsdWU6IGFnZW50cnVuLW5jMDEtdjAyLXJ1bm5lcn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9KT0JfTkFNRV9QUkVGSVgsdmFsdWU6IGFnZW50cnVuLW5jMDEtdjAyLXJ1bm5lcn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9BUElfS0VZX1NFQ1JFVF9OQU1FLHZhbHVlOiBhZ2VudHJ1bi12MDItYXBpLWtleX0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9BUElfS0VZX1NFQ1JFVF9LRVksdmFsdWU6IEhXTEFCX0FQSV9LRVl9LHtuYW1lOiBBR0VOVFJVTl9HSVRfTUlSUk9SX0JBU0VfVVJMLHZhbHVlOiBodHRwOi8vZ2l0LW1pcnJvci1odHRwLmRldm9wcy1pbmZyYS5zdmMuY2x1c3Rlci5sb2NhbDo4MDgwfSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX0lETEVfVElNRU9VVF9NUyx2YWx1ZTogXCI2MDAwMDBcIn0se25hbWU6IEFHRU5UUlVOX0JBQ0tFTkRfUkVUUllfTUFYX0FUVEVNUFRTLHZhbHVlOiBcIjVcIn0se25hbWU6IEFHRU5UUlVOX0JBQ0tFTkRfUkVUUllfSU5JVElBTF9CQUNLT0ZGX01TLHZhbHVlOiBcIjEwMDBcIn0se25hbWU6IEFHRU5UUlVOX0JBQ0tFTkRfUkVUUllfTUFYX0JBQ0tPRkZfTVMsdmFsdWU6IFwiMzAwMDBcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9SRVRFTlRJT05fTUFYX1JVTk5FUlMsdmFsdWU6IFwiMjBcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9SRVRFTlRJT05fQ0xFQU5VUF9PUkRFUix2YWx1ZTogb2xkZXN0LWluYWN0aXZlLWxhc3QtYWN0aXZlLWZpcnN0fSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX1JFVEVOVElPTl9BQ1RJVkVfSEVBUlRCRUFUX01BWF9BR0VfTVMsdmFsdWU6IFwiOTAwMDAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfUkVURU5USU9OX01BVENIX0xBQkVMU19KU09OLHZhbHVlOiBcIntcXFwiYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZlxcXCI6XFxcImFnZW50cnVuXFxcIixcXFwiYXBwLmt1YmVybmV0ZXMuaW8vbmFtZVxcXCI6XFxcImFnZW50cnVuLXJ1bm5lclxcXCIsXFxcImFwcC5rdWJlcm5ldGVzLmlvL2NvbXBvbmVudFxcXCI6XFxcInJ1bm5lclxcXCJ9XCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfUkVURU5USU9OX0pPQl9OQU1FX1BSRUZJWEVTLHZhbHVlOiBcImFnZW50cnVuLW5jMDEtdjAyLXJ1bm5lcixhZ2VudHJ1bi12MDItcnVubmVyLGFnZW50cnVuLXYwMS1ydW5uZXJcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9SRVRFTlRJT05fQUdFX0JBU0VEX0NMRUFOVVBfRU5BQkxFRCx2YWx1ZTogXCJmYWxzZVwifSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX1JFVEVOVElPTl9BR0VfQkFTRURfTUFYX0FHRV9IT1VSUyx2YWx1ZTogXCI0OFwifSx7bmFtZTogQUdFTlRSVU5fQ0FOQ0VMX0RFTElWRVJZX01PREUsdmFsdWU6IG1hbmFnZXItZXBvY2h9LHtuYW1lOiBBR0VOVFJVTl9DQU5DRUxfR1JBQ0VGVUxfQUJPUlRfTVMsdmFsdWU6IFwiMTUwMDBcIn0se25hbWU6IEFHRU5UUlVOX0NBTkNFTF9LSUxMX0VTQ0FMQVRJT05fTVMsdmFsdWU6IFwiMzAwMDBcIn0se25hbWU6IEFHRU5UUlVOX0NBTkNFTF9TVEFMRV9IRUFSVEJFQVRfRkVOQ0lOR19NUyx2YWx1ZTogXCI5MDAwMDBcIn0se25hbWU6IEFHRU5UUlVOX0NBTkNFTF9MQVRFX1dSSVRFX0ZFTkNJTkdfRU5BQkxFRCx2YWx1ZTogXCJ0cnVlXCJ9LHtuYW1lOiBBR0VOVFJVTl9DQU5DRUxfRVZFTlRfU1RBR0VTLHZhbHVlOiBcImFjY2VwdGVkLHBlcnNpc3RlZCxkZWxpdmVyZWQsYWJvcnRpbmcsdGVybWluYWxpemVkLGZlbmNlZCxsYXRlLXdyaXRlLXJlamVjdGVkXCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfRUdSRVNTX1BST1hZX1VSTCx2YWx1ZTogaHR0cDovLzEwLjQyLjAuMToxMDgwOH0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9OT19QUk9YWV9FWFRSQSx2YWx1ZTogXCJsb2NhbGhvc3QsMTI3LjAuMC4xLDo6MSwuc3ZjLC5zdmMuY2x1c3Rlci5sb2NhbCwuY2x1c3Rlci5sb2NhbCxoeXVlYXBpLmNvbSwuaHl1ZWFwaS5jb20sYXBpLnBpa2FweXRob24uY29tLC5waWthcHl0aG9uLmNvbVwifSx7bmFtZTogQUdFTlRSVU5fQVBJX0tFWSx2YWx1ZUZyb206IHtzZWNyZXRLZXlSZWY6IHtuYW1lOiBhZ2VudHJ1bi12MDItYXBpLWtleSxrZXk6IEhXTEFCX0FQSV9LRVl9fX0se25hbWU6IEFHRU5UUlVOX0tBRktBX0JPT1RTVFJBUF9TRVJWRVJTLHZhbHVlOiBwbGF0Zm9ybS1pbmZyYS1rYWZrYS1rYWZrYS1ib290c3RyYXAucGxhdGZvcm0taW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWw6OTA5Mn0se25hbWU6IEFHRU5UUlVOX0tBRktBX0NMSUVOVF9JRCx2YWx1ZTogYWdlbnRydW4tdjAyLW1hbmFnZXJ9LHtuYW1lOiBBR0VOVFJVTl9LQUZLQV9FTkFCTEVELHZhbHVlOiBcInRydWVcIn0se25hbWU6IEFHRU5UUlVOX0tBRktBX0VWRU5UX1RPUElDLHZhbHVlOiBhZ2VudHJ1bi5ldmVudC52MX0se25hbWU6IEFHRU5UUlVOX0tBRktBX09VVEJPWF9CQVRDSF9TSVpFLHZhbHVlOiBcIjEwMFwifSx7bmFtZTogQUdFTlRSVU5fS0FGS0FfT1VUQk9YX0lOVEVSVkFMX01TLHZhbHVlOiBcIjUwMFwifSx7bmFtZTogQUdFTlRSVU5fS0FGS0FfT1VUQk9YX0xFQVNFX01TLHZhbHVlOiBcIjYwMDAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9LQUZLQV9PVVRCT1hfUkVUUllfQkFDS09GRl9NUyx2YWx1ZTogXCI1MDAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9LQUZLQV9TVERJT19DTElFTlRfSUQsdmFsdWU6IGFnZW50cnVuLXYwMi1ydW5uZXJ9LHtuYW1lOiBBR0VOVFJVTl9LQUZLQV9TVERJT19QUk9EVUNFX0VOQUJMRUQsdmFsdWU6IFwidHJ1ZVwifSx7bmFtZTogQUdFTlRSVU5fS0FGS0FfU1RESU9fVE9QSUMsdmFsdWU6IGNvZGV4LXN0ZGlvLnJhdy52MX0se25hbWU6IEFHRU5UUlVOX01BTkFHRVJfUkVDT05DSUxFUl9CQVRDSF9TSVpFLHZhbHVlOiBcIjIwXCJ9LHtuYW1lOiBBR0VOVFJVTl9NQU5BR0VSX1JFQ09OQ0lMRVJfRU5BQkxFRCx2YWx1ZTogXCJ0cnVlXCJ9LHtuYW1lOiBBR0VOVFJVTl9NQU5BR0VSX1JFQ09OQ0lMRVJfSU5URVJWQUxfTVMsdmFsdWU6IFwiMzAwMDBcIn0se25hbWU6IEFHRU5UUlVOX1BPU1RHUkVTX1BPT0xfTUFYLHZhbHVlOiBcIjRcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9ESVNQQVRDSEVSX0FUVEVNUFRfVElNRU9VVF9NUyx2YWx1ZTogXCI5MDAwMFwifSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX0RJU1BBVENIRVJfQkFUQ0hfU0laRSx2YWx1ZTogXCIxMFwifSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX0RJU1BBVENIRVJfRU5BQkxFRCx2YWx1ZTogXCJ0cnVlXCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfRElTUEFUQ0hFUl9JTlRFUlZBTF9NUyx2YWx1ZTogXCIxMDAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfRElTUEFUQ0hFUl9MRUFTRV9NUyx2YWx1ZTogXCIxMjAwMDBcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9ESVNQQVRDSEVSX01BWF9BVFRFTVBUUyx2YWx1ZTogXCI1XCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfRElTUEFUQ0hFUl9SRVRSWV9CQUNLT0ZGX01TLHZhbHVlOiBcIjUwMDBcIn0se25hbWU6IEhXTEFCX1JVTlRJTUVfTEFORSx2YWx1ZTogdjAuM30se25hbWU6IE9URUxfRVhQT1JURVJfT1RMUF9UUkFDRVNfRU5EUE9JTlQsdmFsdWU6IGh0dHA6Ly9vdGVsLWNvbGxlY3Rvci5wbGF0Zm9ybS1pbmZyYS5zdmMuY2x1c3Rlci5sb2NhbDo0MzE4L3YxL3RyYWNlc30se25hbWU6IE9URUxfU0VSVklDRV9OQU1FLHZhbHVlOiBhZ2VudHJ1bi1tYW5hZ2VyfSx7bmFtZTogVU5JREVTS19OT0RFX0lELHZhbHVlOiBOQzAxfSx7bmFtZTogVU5JREVTS19NQUlOX1NFUlZFUl9JUCx2YWx1ZTogMTUyLjUzLjIyOS4xNDh9XSxyZWFkaW5lc3NQcm9iZToge2h0dHBHZXQ6IHtwYXRoOiAvaGVhbHRoL3JlYWRpbmVzcyxwb3J0OiBodHRwfSx0aW1lb3V0U2Vjb25kczogMn0sbGl2ZW5lc3NQcm9iZToge2h0dHBHZXQ6IHtwYXRoOiAvaGVhbHRoL2xpdmUscG9ydDogaHR0cH0sdGltZW91dFNlY29uZHM6IDJ9LHN0YXJ0dXBQcm9iZToge2h0dHBHZXQ6IHtwYXRoOiAvaGVhbHRoL2xpdmUscG9ydDogaHR0cH0scGVyaW9kU2Vjb25kczogMTAsdGltZW91dFNlY29uZHM6IDIsZmFpbHVyZVRocmVzaG9sZDogOTB9LHJlc291cmNlczoge3JlcXVlc3RzOiB7Y3B1OiAxMDBtLG1lbW9yeTogMjU2TWl9LGxpbWl0czoge2NwdTogODAwbSxtZW1vcnk6IDFHaX19fV19fX19XG4tLS1cbnthcGlWZXJzaW9uOiByYmFjLmF1dGhvcml6YXRpb24uazhzLmlvL3YxLGtpbmQ6IFJvbGUsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1tZ3ItcnVubmVyLWpvYi1jb250cm9sbGVyLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX0scnVsZXM6IFt7YXBpR3JvdXBzOiBbYmF0Y2hdLHJlc291cmNlczogW2pvYnNdLHZlcmJzOiBbY3JlYXRlLGRlbGV0ZSxnZXQsbGlzdCx3YXRjaF19LHthcGlHcm91cHM6IFtcIlwiXSxyZXNvdXJjZXM6IFtwb2RzXSx2ZXJiczogW2RlbGV0ZSxnZXQsbGlzdCx3YXRjaF19LHthcGlHcm91cHM6IFtcIlwiXSxyZXNvdXJjZXM6IFtwZXJzaXN0ZW50dm9sdW1lY2xhaW1zXSx2ZXJiczogW2NyZWF0ZSxnZXQsbGlzdCx3YXRjaCxkZWxldGVdfV19XG4tLS1cbnthcGlWZXJzaW9uOiByYmFjLmF1dGhvcml6YXRpb24uazhzLmlvL3YxLGtpbmQ6IFJvbGVCaW5kaW5nLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbmMwMS12MDItbWdyLXJ1bm5lci1qb2ItY29udHJvbGxlcixuYW1lc3BhY2U6IGFnZW50cnVuLXYwMixsYWJlbHM6IHthcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mOiBhZ2VudHJ1bixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbGFuZTogdjAuMixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbm9kZTogTkMwMX19LHN1YmplY3RzOiBbe2tpbmQ6IFNlcnZpY2VBY2NvdW50LG5hbWU6IGFnZW50cnVuLW5jMDEtdjAyLW1ncn1dLHJvbGVSZWY6IHthcGlHcm91cDogcmJhYy5hdXRob3JpemF0aW9uLms4cy5pbyxraW5kOiBSb2xlLG5hbWU6IGFnZW50cnVuLW5jMDEtdjAyLW1nci1ydW5uZXItam9iLWNvbnRyb2xsZXJ9fVxuLS0tXG57YXBpVmVyc2lvbjogcmJhYy5hdXRob3JpemF0aW9uLms4cy5pby92MSxraW5kOiBSb2xlLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbmMwMS12MDItbWdyLXByb3ZpZGVyLXNlY3JldC1tYW5hZ2VyLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX0scnVsZXM6IFt7YXBpR3JvdXBzOiBbXCJcIl0scmVzb3VyY2VzOiBbc2VjcmV0c10sdmVyYnM6IFtjcmVhdGUsZGVsZXRlLGdldCxsaXN0LHBhdGNoLHVwZGF0ZV19XX1cbi0tLVxue2FwaVZlcnNpb246IHJiYWMuYXV0aG9yaXphdGlvbi5rOHMuaW8vdjEsa2luZDogUm9sZUJpbmRpbmcsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1tZ3ItcHJvdmlkZXItc2VjcmV0LW1hbmFnZXIsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fSxzdWJqZWN0czogW3traW5kOiBTZXJ2aWNlQWNjb3VudCxuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1tZ3J9XSxyb2xlUmVmOiB7YXBpR3JvdXA6IHJiYWMuYXV0aG9yaXphdGlvbi5rOHMuaW8sa2luZDogUm9sZSxuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1tZ3ItcHJvdmlkZXItc2VjcmV0LW1hbmFnZXJ9fVxuIn0seyJwYXRoIjoiZGVwbG95L2dpdG9wcy9ub2RlL25jMDEvcnVudGltZS12MDIvcnVubmVyLXJiYWMueWFtbCIsImNvbnRlbnQiOiJ7YXBpVmVyc2lvbjogdjEsa2luZDogU2VydmljZUFjY291bnQsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1ydW5uZXIsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fX1cbi0tLVxue2FwaVZlcnNpb246IHJiYWMuYXV0aG9yaXphdGlvbi5rOHMuaW8vdjEsa2luZDogUm9sZSxtZXRhZGF0YToge25hbWU6IGFnZW50cnVuLW5jMDEtdjAyLXJ1bm5lci1zZWNyZXQtcmVhZGVyLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX0scnVsZXM6IFt7YXBpR3JvdXBzOiBbXCJcIl0scmVzb3VyY2VzOiBbc2VjcmV0c10sdmVyYnM6IFtnZXRdfV19XG4tLS1cbnthcGlWZXJzaW9uOiByYmFjLmF1dGhvcml6YXRpb24uazhzLmlvL3YxLGtpbmQ6IFJvbGVCaW5kaW5nLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbmMwMS12MDItcnVubmVyLXNlY3JldC1yZWFkZXIsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fSxzdWJqZWN0czogW3traW5kOiBTZXJ2aWNlQWNjb3VudCxuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1ydW5uZXJ9XSxyb2xlUmVmOiB7YXBpR3JvdXA6IHJiYWMuYXV0aG9yaXphdGlvbi5rOHMuaW8sa2luZDogUm9sZSxuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1ydW5uZXItc2VjcmV0LXJlYWRlcn19XG4ifV0=\"\ngit_write_url='$(params.git-write-url)'\ngit_auth_url=\"$git_write_url\"\nif printf '%s' \"$git_write_url\" | grep -q '^http://gitea-http\\.'; then\n test -n \"${GITEA_TOKEN:-}\"\n git_auth_url=$(printf '%s' \"$git_write_url\" | sed \"s#^http://#http://x-access-token:${GITEA_TOKEN}@#\")\nfi\nrm -rf \"$root/gitops\"\ngit clone \"$git_auth_url\" \"$root/gitops\"\ncd \"$root/gitops\"\ngit fetch origin \"$(params.gitops-branch)\" || true\nif git rev-parse --verify \"refs/remotes/origin/$(params.gitops-branch)^{commit}\" >/dev/null 2>&1; then git checkout -B \"$(params.gitops-branch)\" \"refs/remotes/origin/$(params.gitops-branch)\"; else git checkout --orphan \"$(params.gitops-branch)\"; git rm -rf . >/dev/null 2>&1 || true; fi\ngit rm -rf --ignore-unmatch \"$(params.gitops-root)\" \"$(params.artifact-catalog)\" source.json >/dev/null 2>&1 || true\nrm -rf \"$(params.gitops-root)\" \"$(params.artifact-catalog)\" source.json\nTEMPLATES_B64=\"$templates_b64\" BUILD_RESULT=\"$build_result\" node <<'NODE'\nconst { mkdirSync, readFileSync, writeFileSync } = require('node:fs');\nconst { dirname } = require('node:path');\nconst templates = JSON.parse(Buffer.from(process.env.TEMPLATES_B64, 'base64').toString('utf8'));\nconst build = JSON.parse(readFileSync(process.env.BUILD_RESULT, 'utf8'));\nconst replacements = new Map([\n ['__AGENTRUN_SOURCE_COMMIT__', build.sourceCommit],\n ['__AGENTRUN_ENV_IDENTITY__', build.envIdentity],\n ['sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', build.digest],\n ['__AGENTRUN_IMAGE_STATUS__', build.status],\n]);\nfor (const file of templates) {\n let content = file.content;\n for (const [from, to] of replacements) content = content.split(from).join(to);\n mkdirSync(dirname(file.path), { recursive: true });\n writeFileSync(file.path, content);\n}\nNODE\ngit add source.json \"$(params.artifact-catalog)\" \"$(params.gitops-root)\"\nif git diff --quiet --cached; then changed=false; else changed=true; git -c user.email=agentrun@unidesk.local -c user.name='UniDesk AgentRun PaC' commit -m \"deploy: render AgentRun $(params.gitops-branch) from PaC\"; fi\ngit remote set-url origin \"$git_auth_url\"\ngit push -u origin \"$(params.gitops-branch)\"\ngitops_commit=$(git rev-parse HEAD)\nBUILD_RESULT=\"$build_result\" CHANGED=\"$changed\" GITOPS_COMMIT=\"$gitops_commit\" node <<'NODE'\nconst { readFileSync } = require('node:fs');\nconst build = JSON.parse(readFileSync(process.env.BUILD_RESULT, 'utf8'));\nconsole.log(JSON.stringify({ ok: true, status: 'succeeded', phase: 'gitops-publish', changed: process.env.CHANGED === 'true', gitopsCommit: process.env.GITOPS_COMMIT, sourceCommit: build.sourceCommit, envIdentity: build.envIdentity, imageStatus: build.status, digest: build.digest, valuesPrinted: false }));\nNODE" - params: + script: "#!/bin/sh\nset -eu\nroot=\"$(workspaces.source.path)\"\nbuild_result=\"$root/build-result.json\"\ntest -s \"$build_result\"\ntemplates_b64=\"W3sicGF0aCI6InNvdXJjZS5qc29uIiwiY29udGVudCI6IntcbiAgXCJsYW5lXCI6IFwidjAuMlwiLFxuICBcInNvdXJjZUNvbW1pdFwiOiBcIl9fQUdFTlRSVU5fU09VUkNFX0NPTU1JVF9fXCIsXG4gIFwiZ2VuZXJhdGVkQnlcIjogXCJ1bmlkZXNrIGNvbmZpZy9hZ2VudHJ1bi55YW1sXCIsXG4gIFwiY29uZmlnU291cmNlXCI6IFwiY29uZmlnL2FnZW50cnVuLnlhbWxcIlxufVxuIn0seyJwYXRoIjoiZGVwbG95L2FydGlmYWN0LWNhdGFsb2cubmMwMS12MDIuanNvbiIsImNvbnRlbnQiOiJ7XG4gIFwibGFuZVwiOiBcInYwLjJcIixcbiAgXCJzb3VyY2VCcmFuY2hcIjogXCJ2MC4yXCIsXG4gIFwiZ2l0b3BzQnJhbmNoXCI6IFwibmMwMS12MC4yLWdpdG9wc1wiLFxuICBcInNvdXJjZUNvbW1pdElkXCI6IFwiX19BR0VOVFJVTl9TT1VSQ0VfQ09NTUlUX19cIixcbiAgXCJzdW1tYXJ5XCI6IFwiYnVpbGQ9MSByZXVzZT0wIHBsYWNlaG9sZGVyPTBcIixcbiAgXCJzZXJ2aWNlc1wiOiBbXG4gICAge1xuICAgICAgXCJzZXJ2aWNlSWRcIjogXCJhZ2VudHJ1bi1tZ3JcIixcbiAgICAgIFwiYXJ0aWZhY3RLaW5kXCI6IFwiZW52LXJldXNlXCIsXG4gICAgICBcInN0YXR1c1wiOiBcIl9fQUdFTlRSVU5fSU1BR0VfU1RBVFVTX19cIixcbiAgICAgIFwiaW1hZ2VcIjogXCIxMjcuMC4wLjE6NTAwMC9hZ2VudHJ1bi9hZ2VudHJ1bi1tZ3ItZW52Ol9fQUdFTlRSVU5fRU5WX0lERU5USVRZX19cIixcbiAgICAgIFwiZGlnZXN0XCI6IFwic2hhMjU2OmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFcIixcbiAgICAgIFwicmVwb3NpdG9yeURpZ2VzdFwiOiBcIjEyNy4wLjAuMTo1MDAwL2FnZW50cnVuL2FnZW50cnVuLW1nci1lbnZAc2hhMjU2OmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFcIixcbiAgICAgIFwiaW1hZ2VUYWdcIjogXCJfX0FHRU5UUlVOX0VOVl9JREVOVElUWV9fXCIsXG4gICAgICBcImVudklkZW50aXR5XCI6IFwiX19BR0VOVFJVTl9FTlZfSURFTlRJVFlfX1wiLFxuICAgICAgXCJlbnZJbWFnZVwiOiBcIjEyNy4wLjAuMTo1MDAwL2FnZW50cnVuL2FnZW50cnVuLW1nci1lbnY6X19BR0VOVFJVTl9FTlZfSURFTlRJVFlfX1wiLFxuICAgICAgXCJlbnZEaWdlc3RcIjogXCJzaGEyNTY6YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYVwiLFxuICAgICAgXCJlbnZSZXBvc2l0b3J5RGlnZXN0XCI6IFwiMTI3LjAuMC4xOjUwMDAvYWdlbnRydW4vYWdlbnRydW4tbWdyLWVudkBzaGEyNTY6YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYVwiLFxuICAgICAgXCJib290Q29tbWl0XCI6IFwiX19BR0VOVFJVTl9TT1VSQ0VfQ09NTUlUX19cIixcbiAgICAgIFwiYm9vdFNjcmlwdFwiOiBcImRlcGxveS9ydW50aW1lL2Jvb3QvYWdlbnRydW4tYm9vdC5zaFwiLFxuICAgICAgXCJwcm92ZW5hbmNlXCI6IHtcbiAgICAgICAgXCJzb3VyY2VDb21taXRJZFwiOiBcIl9fQUdFTlRSVU5fU09VUkNFX0NPTU1JVF9fXCIsXG4gICAgICAgIFwic291cmNlXCI6IFwidW5pZGVzay15YW1sLW9ubHlcIixcbiAgICAgICAgXCJjb25maWdTb3VyY2VcIjogXCJjb25maWcvYWdlbnRydW4ueWFtbFwiLFxuICAgICAgICBcInZhbHVlc1ByaW50ZWRcIjogZmFsc2VcbiAgICAgIH1cbiAgICB9XG4gIF1cbn1cbiJ9LHsicGF0aCI6ImRlcGxveS9naXRvcHMvbm9kZS9uYzAxL2FyZ29jZC9wcm9qZWN0LnlhbWwiLCJjb250ZW50Ijoie2FwaVZlcnNpb246IGFyZ29wcm9qLmlvL3YxYWxwaGExLGtpbmQ6IEFwcFByb2plY3QsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMixuYW1lc3BhY2U6IGFyZ29jZCxsYWJlbHM6IHthcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mOiBhZ2VudHJ1bixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbGFuZTogdjAuMixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbm9kZTogTkMwMX19LHNwZWM6IHtkZXNjcmlwdGlvbjogQWdlbnRSdW4gdjAuMiBHaXRPcHMgbGFuZSxzb3VyY2VSZXBvczogW2h0dHA6Ly9naXQtbWlycm9yLWh0dHAuZGV2b3BzLWluZnJhLnN2Yy5jbHVzdGVyLmxvY2FsOjgwODAvcGlrYXNUZWNoL2FnZW50cnVuLmdpdCxodHRwOi8vZ2l0ZWEtaHR0cC5kZXZvcHMtaW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWw6MzAwMC9taXJyb3JzL3Bpa2FzVGVjaC1hZ2VudHJ1bi5naXRdLGRlc3RpbmF0aW9uczogW3tzZXJ2ZXI6IGh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2YyxuYW1lc3BhY2U6IGFnZW50cnVuLXYwMn1dLGNsdXN0ZXJSZXNvdXJjZVdoaXRlbGlzdDogW3tncm91cDogXCJcIixraW5kOiBOYW1lc3BhY2V9XSxuYW1lc3BhY2VSZXNvdXJjZVdoaXRlbGlzdDogW3tncm91cDogXCIqXCIsa2luZDogXCIqXCJ9XX19XG4ifSx7InBhdGgiOiJkZXBsb3kvZ2l0b3BzL25vZGUvbmMwMS9hcmdvY2QvYXBwbGljYXRpb24tdjAyLnlhbWwiLCJjb250ZW50Ijoie2FwaVZlcnNpb246IGFyZ29wcm9qLmlvL3YxYWxwaGExLGtpbmQ6IEFwcGxpY2F0aW9uLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbmMwMS12MDIsbmFtZXNwYWNlOiBhcmdvY2QsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fSxzcGVjOiB7cHJvamVjdDogYWdlbnRydW4tbmMwMS12MDIsc291cmNlOiB7cmVwb1VSTDogaHR0cDovL2dpdC1taXJyb3ItaHR0cC5kZXZvcHMtaW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWw6ODA4MC9waWthc1RlY2gvYWdlbnRydW4uZ2l0LHRhcmdldFJldmlzaW9uOiBuYzAxLXYwLjItZ2l0b3BzLHBhdGg6IGRlcGxveS9naXRvcHMvbm9kZS9uYzAxL3J1bnRpbWUtdjAyfSxkZXN0aW5hdGlvbjoge3NlcnZlcjogaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyfSxzeW5jUG9saWN5OiB7YXV0b21hdGVkOiB7cHJ1bmU6IGZhbHNlLHNlbGZIZWFsOiB0cnVlfSxzeW5jT3B0aW9uczogW0NyZWF0ZU5hbWVzcGFjZT10cnVlLEFwcGx5T3V0T2ZTeW5jT25seT10cnVlXX19fVxuIn0seyJwYXRoIjoiZGVwbG95L2dpdG9wcy9ub2RlL25jMDEvcnVudGltZS12MDIva3VzdG9taXphdGlvbi55YW1sIiwiY29udGVudCI6InthcGlWZXJzaW9uOiBrdXN0b21pemUuY29uZmlnLms4cy5pby92MWJldGExLGtpbmQ6IEt1c3RvbWl6YXRpb24scmVzb3VyY2VzOiBbbmFtZXNwYWNlLnlhbWwsbWdyLnlhbWwscnVubmVyLXJiYWMueWFtbF19XG4ifSx7InBhdGgiOiJkZXBsb3kvZ2l0b3BzL25vZGUvbmMwMS9ydW50aW1lLXYwMi9uYW1lc3BhY2UueWFtbCIsImNvbnRlbnQiOiJ7YXBpVmVyc2lvbjogdjEsa2luZDogTmFtZXNwYWNlLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX19XG4ifSx7InBhdGgiOiJkZXBsb3kvZ2l0b3BzL25vZGUvbmMwMS9ydW50aW1lLXYwMi9tZ3IueWFtbCIsImNvbnRlbnQiOiJ7YXBpVmVyc2lvbjogdjEsa2luZDogU2VydmljZUFjY291bnQsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1tZ3IsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fX1cbi0tLVxue2FwaVZlcnNpb246IHYxLGtpbmQ6IFNlcnZpY2UsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1tZ3IsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fSxzcGVjOiB7c2VsZWN0b3I6IHthcHAua3ViZXJuZXRlcy5pby9uYW1lOiBhZ2VudHJ1bi1tZ3J9LHBvcnRzOiBbe25hbWU6IGh0dHAscG9ydDogODA4MCx0YXJnZXRQb3J0OiBodHRwfV19fVxuLS0tXG57YXBpVmVyc2lvbjogYXBwcy92MSxraW5kOiBEZXBsb3ltZW50LG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbWdyLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX0sc3BlYzoge3JlcGxpY2FzOiAxLHNlbGVjdG9yOiB7bWF0Y2hMYWJlbHM6IHthcHAua3ViZXJuZXRlcy5pby9uYW1lOiBhZ2VudHJ1bi1tZ3J9fSx0ZW1wbGF0ZToge21ldGFkYXRhOiB7bGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDEsYXBwLmt1YmVybmV0ZXMuaW8vbmFtZTogYWdlbnRydW4tbWdyfSxhbm5vdGF0aW9uczoge2FnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9zb3VyY2UtY29tbWl0OiBfX0FHRU5UUlVOX1NPVVJDRV9DT01NSVRfXyxhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvZW52LWlkZW50aXR5OiBfX0FHRU5UUlVOX0VOVl9JREVOVElUWV9ffX0sc3BlYzoge3NlcnZpY2VBY2NvdW50TmFtZTogYWdlbnRydW4tbmMwMS12MDItbWdyLGNvbnRhaW5lcnM6IFt7bmFtZTogbWdyLGltYWdlOiAxMjcuMC4wLjE6NTAwMC9hZ2VudHJ1bi9hZ2VudHJ1bi1tZ3ItZW52QHNoYTI1NjphYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhLGltYWdlUHVsbFBvbGljeTogSWZOb3RQcmVzZW50LHBvcnRzOiBbe25hbWU6IGh0dHAsY29udGFpbmVyUG9ydDogODA4MH1dLGVudjogW3tuYW1lOiBBR0VOVFJVTl9MQU5FLHZhbHVlOiB2MC4yfSx7bmFtZTogREFUQUJBU0VfVVJMLHZhbHVlRnJvbToge3NlY3JldEtleVJlZjoge25hbWU6IGFnZW50cnVuLXYwMi1tZ3ItZGIsa2V5OiBEQVRBQkFTRV9VUkx9fX0se25hbWU6IEFHRU5UUlVOX1NPVVJDRV9DT01NSVQsdmFsdWU6IF9fQUdFTlRSVU5fU09VUkNFX0NPTU1JVF9ffSx7bmFtZTogQUdFTlRSVU5fQk9PVF9DT01NSVQsdmFsdWU6IF9fQUdFTlRSVU5fU09VUkNFX0NPTU1JVF9ffSx7bmFtZTogQUdFTlRSVU5fQk9PVF9NT0RFLHZhbHVlOiBtZ3J9LHtuYW1lOiBBR0VOVFJVTl9CT09UX1JFUE9fVVJMLHZhbHVlOiBodHRwOi8vZ2l0ZWEtaHR0cC5kZXZvcHMtaW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWw6MzAwMC9taXJyb3JzL3Bpa2FzVGVjaC1hZ2VudHJ1bi5naXR9LHtuYW1lOiBBR0VOVFJVTl9FTlZfSURFTlRJVFksdmFsdWU6IF9fQUdFTlRSVU5fRU5WX0lERU5USVRZX199LHtuYW1lOiBBR0VOVFJVTl9SVU5USU1FX05BTUVTUEFDRSx2YWx1ZTogYWdlbnRydW4tdjAyfSx7bmFtZTogQUdFTlRSVU5fSU5URVJOQUxfTUdSX1VSTCx2YWx1ZTogaHR0cDovL2FnZW50cnVuLW1nci5hZ2VudHJ1bi12MDIuc3ZjLmNsdXN0ZXIubG9jYWw6ODA4MH0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9JTUFHRSx2YWx1ZTogMTI3LjAuMC4xOjUwMDAvYWdlbnRydW4vYWdlbnRydW4tbWdyLWVudkBzaGEyNTY6YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYX0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9TRVJWSUNFX0FDQ09VTlQsdmFsdWU6IGFnZW50cnVuLW5jMDEtdjAyLXJ1bm5lcn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9KT0JfTkFNRV9QUkVGSVgsdmFsdWU6IGFnZW50cnVuLW5jMDEtdjAyLXJ1bm5lcn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9BUElfS0VZX1NFQ1JFVF9OQU1FLHZhbHVlOiBhZ2VudHJ1bi12MDItYXBpLWtleX0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9BUElfS0VZX1NFQ1JFVF9LRVksdmFsdWU6IEhXTEFCX0FQSV9LRVl9LHtuYW1lOiBBR0VOVFJVTl9HSVRfTUlSUk9SX0JBU0VfVVJMLHZhbHVlOiBodHRwOi8vZ2l0LW1pcnJvci1odHRwLmRldm9wcy1pbmZyYS5zdmMuY2x1c3Rlci5sb2NhbDo4MDgwfSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX0lETEVfVElNRU9VVF9NUyx2YWx1ZTogXCI2MDAwMDBcIn0se25hbWU6IEFHRU5UUlVOX0JBQ0tFTkRfUkVUUllfTUFYX0FUVEVNUFRTLHZhbHVlOiBcIjVcIn0se25hbWU6IEFHRU5UUlVOX0JBQ0tFTkRfUkVUUllfSU5JVElBTF9CQUNLT0ZGX01TLHZhbHVlOiBcIjEwMDBcIn0se25hbWU6IEFHRU5UUlVOX0JBQ0tFTkRfUkVUUllfTUFYX0JBQ0tPRkZfTVMsdmFsdWU6IFwiMzAwMDBcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9SRVRFTlRJT05fTUFYX1JVTk5FUlMsdmFsdWU6IFwiMjBcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9SRVRFTlRJT05fQ0xFQU5VUF9PUkRFUix2YWx1ZTogb2xkZXN0LWluYWN0aXZlLWxhc3QtYWN0aXZlLWZpcnN0fSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX1JFVEVOVElPTl9BQ1RJVkVfSEVBUlRCRUFUX01BWF9BR0VfTVMsdmFsdWU6IFwiOTAwMDAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfUkVURU5USU9OX1NUQUxFX1BFTkRJTkdfTUFYX0FHRV9NUyx2YWx1ZTogXCI5MDAwMDBcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9SRVRFTlRJT05fTUFUQ0hfTEFCRUxTX0pTT04sdmFsdWU6IFwie1xcXCJhcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mXFxcIjpcXFwiYWdlbnRydW5cXFwiLFxcXCJhcHAua3ViZXJuZXRlcy5pby9uYW1lXFxcIjpcXFwiYWdlbnRydW4tcnVubmVyXFxcIixcXFwiYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50XFxcIjpcXFwicnVubmVyXFxcIn1cIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9SRVRFTlRJT05fSk9CX05BTUVfUFJFRklYRVMsdmFsdWU6IFwiYWdlbnRydW4tbmMwMS12MDItcnVubmVyLGFnZW50cnVuLXYwMi1ydW5uZXIsYWdlbnRydW4tdjAxLXJ1bm5lclwifSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX1JFVEVOVElPTl9BR0VfQkFTRURfQ0xFQU5VUF9FTkFCTEVELHZhbHVlOiBcImZhbHNlXCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfUkVURU5USU9OX0FHRV9CQVNFRF9NQVhfQUdFX0hPVVJTLHZhbHVlOiBcIjQ4XCJ9LHtuYW1lOiBBR0VOVFJVTl9DQU5DRUxfREVMSVZFUllfTU9ERSx2YWx1ZTogbWFuYWdlci1lcG9jaH0se25hbWU6IEFHRU5UUlVOX0NBTkNFTF9HUkFDRUZVTF9BQk9SVF9NUyx2YWx1ZTogXCIxNTAwMFwifSx7bmFtZTogQUdFTlRSVU5fQ0FOQ0VMX0tJTExfRVNDQUxBVElPTl9NUyx2YWx1ZTogXCIzMDAwMFwifSx7bmFtZTogQUdFTlRSVU5fQ0FOQ0VMX1NUQUxFX0hFQVJUQkVBVF9GRU5DSU5HX01TLHZhbHVlOiBcIjkwMDAwMFwifSx7bmFtZTogQUdFTlRSVU5fQ0FOQ0VMX0xBVEVfV1JJVEVfRkVOQ0lOR19FTkFCTEVELHZhbHVlOiBcInRydWVcIn0se25hbWU6IEFHRU5UUlVOX0NBTkNFTF9FVkVOVF9TVEFHRVMsdmFsdWU6IFwiYWNjZXB0ZWQscGVyc2lzdGVkLGRlbGl2ZXJlZCxhYm9ydGluZyx0ZXJtaW5hbGl6ZWQsZmVuY2VkLGxhdGUtd3JpdGUtcmVqZWN0ZWRcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9FR1JFU1NfUFJPWFlfVVJMLHZhbHVlOiBodHRwOi8vMTAuNDIuMC4xOjEwODA4fSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX05PX1BST1hZX0VYVFJBLHZhbHVlOiBcImxvY2FsaG9zdCwxMjcuMC4wLjEsOjoxLC5zdmMsLnN2Yy5jbHVzdGVyLmxvY2FsLC5jbHVzdGVyLmxvY2FsLGh5dWVhcGkuY29tLC5oeXVlYXBpLmNvbSxhcGkucGlrYXB5dGhvbi5jb20sLnBpa2FweXRob24uY29tXCJ9LHtuYW1lOiBBR0VOVFJVTl9BUElfS0VZLHZhbHVlRnJvbToge3NlY3JldEtleVJlZjoge25hbWU6IGFnZW50cnVuLXYwMi1hcGkta2V5LGtleTogSFdMQUJfQVBJX0tFWX19fSx7bmFtZTogQUdFTlRSVU5fS0FGS0FfQk9PVFNUUkFQX1NFUlZFUlMsdmFsdWU6IHBsYXRmb3JtLWluZnJhLWthZmthLWthZmthLWJvb3RzdHJhcC5wbGF0Zm9ybS1pbmZyYS5zdmMuY2x1c3Rlci5sb2NhbDo5MDkyfSx7bmFtZTogQUdFTlRSVU5fS0FGS0FfQ0xJRU5UX0lELHZhbHVlOiBhZ2VudHJ1bi12MDItbWFuYWdlcn0se25hbWU6IEFHRU5UUlVOX0tBRktBX0VOQUJMRUQsdmFsdWU6IFwidHJ1ZVwifSx7bmFtZTogQUdFTlRSVU5fS0FGS0FfRVZFTlRfVE9QSUMsdmFsdWU6IGFnZW50cnVuLmV2ZW50LnYxfSx7bmFtZTogQUdFTlRSVU5fS0FGS0FfT1VUQk9YX0JBVENIX1NJWkUsdmFsdWU6IFwiMTAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9LQUZLQV9PVVRCT1hfSU5URVJWQUxfTVMsdmFsdWU6IFwiNTAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9LQUZLQV9PVVRCT1hfTEVBU0VfTVMsdmFsdWU6IFwiNjAwMDBcIn0se25hbWU6IEFHRU5UUlVOX0tBRktBX09VVEJPWF9SRVRSWV9CQUNLT0ZGX01TLHZhbHVlOiBcIjUwMDBcIn0se25hbWU6IEFHRU5UUlVOX0tBRktBX1NURElPX0NMSUVOVF9JRCx2YWx1ZTogYWdlbnRydW4tdjAyLXJ1bm5lcn0se25hbWU6IEFHRU5UUlVOX0tBRktBX1NURElPX1BST0RVQ0VfRU5BQkxFRCx2YWx1ZTogXCJ0cnVlXCJ9LHtuYW1lOiBBR0VOVFJVTl9LQUZLQV9TVERJT19UT1BJQyx2YWx1ZTogY29kZXgtc3RkaW8ucmF3LnYxfSx7bmFtZTogQUdFTlRSVU5fTUFOQUdFUl9SRUNPTkNJTEVSX0JBVENIX1NJWkUsdmFsdWU6IFwiMjBcIn0se25hbWU6IEFHRU5UUlVOX01BTkFHRVJfUkVDT05DSUxFUl9FTkFCTEVELHZhbHVlOiBcInRydWVcIn0se25hbWU6IEFHRU5UUlVOX01BTkFHRVJfUkVDT05DSUxFUl9JTlRFUlZBTF9NUyx2YWx1ZTogXCIzMDAwMFwifSx7bmFtZTogQUdFTlRSVU5fUE9TVEdSRVNfUE9PTF9NQVgsdmFsdWU6IFwiNFwifSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX0RJU1BBVENIRVJfQVRURU1QVF9USU1FT1VUX01TLHZhbHVlOiBcIjkwMDAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfRElTUEFUQ0hFUl9CQVRDSF9TSVpFLHZhbHVlOiBcIjEwXCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfRElTUEFUQ0hFUl9FTkFCTEVELHZhbHVlOiBcInRydWVcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9ESVNQQVRDSEVSX0lOVEVSVkFMX01TLHZhbHVlOiBcIjEwMDBcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9ESVNQQVRDSEVSX0xFQVNFX01TLHZhbHVlOiBcIjEyMDAwMFwifSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX0RJU1BBVENIRVJfTUFYX0FUVEVNUFRTLHZhbHVlOiBcIjVcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9ESVNQQVRDSEVSX1JFVFJZX0JBQ0tPRkZfTVMsdmFsdWU6IFwiNTAwMFwifSx7bmFtZTogSFdMQUJfUlVOVElNRV9MQU5FLHZhbHVlOiB2MC4zfSx7bmFtZTogT1RFTF9FWFBPUlRFUl9PVExQX1RSQUNFU19FTkRQT0lOVCx2YWx1ZTogaHR0cDovL290ZWwtY29sbGVjdG9yLnBsYXRmb3JtLWluZnJhLnN2Yy5jbHVzdGVyLmxvY2FsOjQzMTgvdjEvdHJhY2VzfSx7bmFtZTogT1RFTF9TRVJWSUNFX05BTUUsdmFsdWU6IGFnZW50cnVuLW1hbmFnZXJ9LHtuYW1lOiBVTklERVNLX05PREVfSUQsdmFsdWU6IE5DMDF9LHtuYW1lOiBVTklERVNLX01BSU5fU0VSVkVSX0lQLHZhbHVlOiAxNTIuNTMuMjI5LjE0OH1dLHJlYWRpbmVzc1Byb2JlOiB7aHR0cEdldDoge3BhdGg6IC9oZWFsdGgvcmVhZGluZXNzLHBvcnQ6IGh0dHB9LHRpbWVvdXRTZWNvbmRzOiAyfSxsaXZlbmVzc1Byb2JlOiB7aHR0cEdldDoge3BhdGg6IC9oZWFsdGgvbGl2ZSxwb3J0OiBodHRwfSx0aW1lb3V0U2Vjb25kczogMn0sc3RhcnR1cFByb2JlOiB7aHR0cEdldDoge3BhdGg6IC9oZWFsdGgvbGl2ZSxwb3J0OiBodHRwfSxwZXJpb2RTZWNvbmRzOiAxMCx0aW1lb3V0U2Vjb25kczogMixmYWlsdXJlVGhyZXNob2xkOiA5MH0scmVzb3VyY2VzOiB7cmVxdWVzdHM6IHtjcHU6IDEwMG0sbWVtb3J5OiAyNTZNaX0sbGltaXRzOiB7Y3B1OiA4MDBtLG1lbW9yeTogMUdpfX19XX19fX1cbi0tLVxue2FwaVZlcnNpb246IHJiYWMuYXV0aG9yaXphdGlvbi5rOHMuaW8vdjEsa2luZDogUm9sZSxtZXRhZGF0YToge25hbWU6IGFnZW50cnVuLW5jMDEtdjAyLW1nci1ydW5uZXItam9iLWNvbnRyb2xsZXIsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fSxydWxlczogW3thcGlHcm91cHM6IFtiYXRjaF0scmVzb3VyY2VzOiBbam9ic10sdmVyYnM6IFtjcmVhdGUsZGVsZXRlLGdldCxsaXN0LHdhdGNoXX0se2FwaUdyb3VwczogW1wiXCJdLHJlc291cmNlczogW3BvZHNdLHZlcmJzOiBbZGVsZXRlLGdldCxsaXN0LHdhdGNoXX0se2FwaUdyb3VwczogW1wiXCJdLHJlc291cmNlczogW2V2ZW50c10sdmVyYnM6IFtnZXQsbGlzdCx3YXRjaF19LHthcGlHcm91cHM6IFtcIlwiXSxyZXNvdXJjZXM6IFtwZXJzaXN0ZW50dm9sdW1lY2xhaW1zXSx2ZXJiczogW2NyZWF0ZSxnZXQsbGlzdCx3YXRjaCxkZWxldGVdfV19XG4tLS1cbnthcGlWZXJzaW9uOiByYmFjLmF1dGhvcml6YXRpb24uazhzLmlvL3YxLGtpbmQ6IFJvbGVCaW5kaW5nLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbmMwMS12MDItbWdyLXJ1bm5lci1qb2ItY29udHJvbGxlcixuYW1lc3BhY2U6IGFnZW50cnVuLXYwMixsYWJlbHM6IHthcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mOiBhZ2VudHJ1bixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbGFuZTogdjAuMixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbm9kZTogTkMwMX19LHN1YmplY3RzOiBbe2tpbmQ6IFNlcnZpY2VBY2NvdW50LG5hbWU6IGFnZW50cnVuLW5jMDEtdjAyLW1ncn1dLHJvbGVSZWY6IHthcGlHcm91cDogcmJhYy5hdXRob3JpemF0aW9uLms4cy5pbyxraW5kOiBSb2xlLG5hbWU6IGFnZW50cnVuLW5jMDEtdjAyLW1nci1ydW5uZXItam9iLWNvbnRyb2xsZXJ9fVxuLS0tXG57YXBpVmVyc2lvbjogcmJhYy5hdXRob3JpemF0aW9uLms4cy5pby92MSxraW5kOiBSb2xlLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbmMwMS12MDItbWdyLXByb3ZpZGVyLXNlY3JldC1tYW5hZ2VyLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX0scnVsZXM6IFt7YXBpR3JvdXBzOiBbXCJcIl0scmVzb3VyY2VzOiBbc2VjcmV0c10sdmVyYnM6IFtjcmVhdGUsZGVsZXRlLGdldCxsaXN0LHBhdGNoLHVwZGF0ZV19XX1cbi0tLVxue2FwaVZlcnNpb246IHJiYWMuYXV0aG9yaXphdGlvbi5rOHMuaW8vdjEsa2luZDogUm9sZUJpbmRpbmcsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1tZ3ItcHJvdmlkZXItc2VjcmV0LW1hbmFnZXIsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fSxzdWJqZWN0czogW3traW5kOiBTZXJ2aWNlQWNjb3VudCxuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1tZ3J9XSxyb2xlUmVmOiB7YXBpR3JvdXA6IHJiYWMuYXV0aG9yaXphdGlvbi5rOHMuaW8sa2luZDogUm9sZSxuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1tZ3ItcHJvdmlkZXItc2VjcmV0LW1hbmFnZXJ9fVxuIn0seyJwYXRoIjoiZGVwbG95L2dpdG9wcy9ub2RlL25jMDEvcnVudGltZS12MDIvcnVubmVyLXJiYWMueWFtbCIsImNvbnRlbnQiOiJ7YXBpVmVyc2lvbjogdjEsa2luZDogU2VydmljZUFjY291bnQsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1ydW5uZXIsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fX1cbi0tLVxue2FwaVZlcnNpb246IHJiYWMuYXV0aG9yaXphdGlvbi5rOHMuaW8vdjEsa2luZDogUm9sZSxtZXRhZGF0YToge25hbWU6IGFnZW50cnVuLW5jMDEtdjAyLXJ1bm5lci1zZWNyZXQtcmVhZGVyLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX0scnVsZXM6IFt7YXBpR3JvdXBzOiBbXCJcIl0scmVzb3VyY2VzOiBbc2VjcmV0c10sdmVyYnM6IFtnZXRdfV19XG4tLS1cbnthcGlWZXJzaW9uOiByYmFjLmF1dGhvcml6YXRpb24uazhzLmlvL3YxLGtpbmQ6IFJvbGVCaW5kaW5nLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbmMwMS12MDItcnVubmVyLXNlY3JldC1yZWFkZXIsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fSxzdWJqZWN0czogW3traW5kOiBTZXJ2aWNlQWNjb3VudCxuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1ydW5uZXJ9XSxyb2xlUmVmOiB7YXBpR3JvdXA6IHJiYWMuYXV0aG9yaXphdGlvbi5rOHMuaW8sa2luZDogUm9sZSxuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1ydW5uZXItc2VjcmV0LXJlYWRlcn19XG4ifV0=\"\ngit_write_url='$(params.git-write-url)'\ngit_auth_url=\"$git_write_url\"\nif printf '%s' \"$git_write_url\" | grep -q '^http://gitea-http\\.'; then\n test -n \"${GITEA_TOKEN:-}\"\n git_auth_url=$(printf '%s' \"$git_write_url\" | sed \"s#^http://#http://x-access-token:${GITEA_TOKEN}@#\")\nfi\nrm -rf \"$root/gitops\"\ngit clone \"$git_auth_url\" \"$root/gitops\"\ncd \"$root/gitops\"\ngit fetch origin \"$(params.gitops-branch)\" || true\nif git rev-parse --verify \"refs/remotes/origin/$(params.gitops-branch)^{commit}\" >/dev/null 2>&1; then git checkout -B \"$(params.gitops-branch)\" \"refs/remotes/origin/$(params.gitops-branch)\"; else git checkout --orphan \"$(params.gitops-branch)\"; git rm -rf . >/dev/null 2>&1 || true; fi\ngit rm -rf --ignore-unmatch \"$(params.gitops-root)\" \"$(params.artifact-catalog)\" source.json >/dev/null 2>&1 || true\nrm -rf \"$(params.gitops-root)\" \"$(params.artifact-catalog)\" source.json\nTEMPLATES_B64=\"$templates_b64\" BUILD_RESULT=\"$build_result\" node <<'NODE'\nconst { mkdirSync, readFileSync, writeFileSync } = require('node:fs');\nconst { dirname } = require('node:path');\nconst templates = JSON.parse(Buffer.from(process.env.TEMPLATES_B64, 'base64').toString('utf8'));\nconst build = JSON.parse(readFileSync(process.env.BUILD_RESULT, 'utf8'));\nconst replacements = new Map([\n ['__AGENTRUN_SOURCE_COMMIT__', build.sourceCommit],\n ['__AGENTRUN_ENV_IDENTITY__', build.envIdentity],\n ['sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', build.digest],\n ['__AGENTRUN_IMAGE_STATUS__', build.status],\n]);\nfor (const file of templates) {\n let content = file.content;\n for (const [from, to] of replacements) content = content.split(from).join(to);\n mkdirSync(dirname(file.path), { recursive: true });\n writeFileSync(file.path, content);\n}\nNODE\ngit add source.json \"$(params.artifact-catalog)\" \"$(params.gitops-root)\"\nif git diff --quiet --cached; then changed=false; else changed=true; git -c user.email=agentrun@unidesk.local -c user.name='UniDesk AgentRun PaC' commit -m \"deploy: render AgentRun $(params.gitops-branch) from PaC\"; fi\ngit remote set-url origin \"$git_auth_url\"\ngit push -u origin \"$(params.gitops-branch)\"\ngitops_commit=$(git rev-parse HEAD)\nBUILD_RESULT=\"$build_result\" CHANGED=\"$changed\" GITOPS_COMMIT=\"$gitops_commit\" node <<'NODE'\nconst { readFileSync } = require('node:fs');\nconst build = JSON.parse(readFileSync(process.env.BUILD_RESULT, 'utf8'));\nconsole.log(JSON.stringify({ ok: true, status: 'succeeded', phase: 'gitops-publish', changed: process.env.CHANGED === 'true', gitopsCommit: process.env.GITOPS_COMMIT, sourceCommit: build.sourceCommit, envIdentity: build.envIdentity, imageStatus: build.status, digest: build.digest, valuesPrinted: false }));\nNODE" + params: - name: git-read-url value: $(params.git-read-url) - name: git-write-url @@ -217,19 +215,19 @@ spec: value: $(params.gitops-root) - name: artifact-catalog value: $(params.artifact-catalog) - when: + when: - input: unidesk-yaml-only operator: in - values: + values: - unidesk-yaml-only - taskRunTemplate: + taskRunTemplate: serviceAccountName: "{{ service_account }}" - podTemplate: + podTemplate: hostNetwork: true dnsPolicy: ClusterFirstWithHostNet - securityContext: + securityContext: fsGroup: 1000 - params: + params: - name: git-url value: "{{ repo_url }}" - name: git-read-url @@ -244,12 +242,46 @@ spec: value: "{{ revision }}" - name: source-stage-ref value: "{{ source_snapshot_prefix }}/{{ revision }}" - workspaces: + - name: registry-prefix + value: 127.0.0.1:5000/agentrun + - name: tools-image + value: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 + - name: buildkit-image + value: 127.0.0.1:5000/hwlab/buildkit:rootless + - name: containerfile + value: deploy/container/Containerfile + - name: context-dir + value: "." + - name: image-repository + value: 127.0.0.1:5000/agentrun/agentrun-mgr-env + - name: build-network + value: host + - name: build-args-json + value: "[\"BUN_IMAGE=oven/bun:1-alpine\"]" + - name: build-http-proxy + value: http://127.0.0.1:10808 + - name: build-https-proxy + value: http://127.0.0.1:10808 + - name: build-no-proxy + value: "localhost,127.0.0.1,::1,127.0.0.1:5000,localhost:5000,.svc,.svc.cluster.local,.cluster.local,hyueapi.com,.hyueapi.com" + - name: container-http-proxy + value: http://127.0.0.1:10808 + - name: container-https-proxy + value: http://127.0.0.1:10808 + - name: container-no-proxy + value: "localhost,127.0.0.1,::1,127.0.0.1:5000,localhost:5000,.svc,.svc.cluster.local,.cluster.local,hyueapi.com,.hyueapi.com" + - name: env-identity-files-json + value: "[\"deploy/container/Containerfile\",\"deploy/runtime/boot/agentrun-boot.sh\",\"deploy/runtime/boot/agentrun-mgr.sh\",\"deploy/runtime/boot/agentrun-runner.sh\",\"src\",\"scripts\",\"package.json\",\"bun.lock\",\"tsconfig.json\"]" + - name: gitops-root + value: deploy/gitops/node/nc01 + - name: artifact-catalog + value: deploy/artifact-catalog.nc01-v02.json + workspaces: - name: source - volumeClaimTemplate: - spec: - accessModes: + volumeClaimTemplate: + spec: + accessModes: - ReadWriteOnce - resources: - requests: - storage: "{{ workspace_pvc_size }}" + resources: + requests: + storage: 2Gi diff --git a/docs/MDTODO/details/pac-source-artifact-alignment/R1.1_Task_Report.md b/docs/MDTODO/details/pac-source-artifact-alignment/R1.1_Task_Report.md new file mode 100644 index 0000000..38b2c6a --- /dev/null +++ b/docs/MDTODO/details/pac-source-artifact-alignment/R1.1_Task_Report.md @@ -0,0 +1,7 @@ +# R1.1 任务报告 + +- 使用 UniDesk source-artifact CLI 对 `agentrun-nc01-v02` 执行 `plan`。 +- 第一次 `write --confirm` 返回 `mutation=true`，只写入 `.tekton/agentrun-nc01-v02.yaml`。 +- 第二次 `write --confirm` 返回 `mutation=false`，证明生成过程幂等。 +- `check` 返回 `source.status=aligned`、`provenanceAligned=true`。 +- 期望与源 Pipeline canonical SHA256 均为 `sha256:9050045cf22359d1dab3d12c50b54068e1d1921127a5bb3cf285592aa3ca0f93`。 diff --git a/docs/MDTODO/details/pac-source-artifact-alignment/R1.2_Task_Report.md b/docs/MDTODO/details/pac-source-artifact-alignment/R1.2_Task_Report.md new file mode 100644 index 0000000..16a0828 --- /dev/null +++ b/docs/MDTODO/details/pac-source-artifact-alignment/R1.2_Task_Report.md @@ -0,0 +1,18 @@ +# R1.2 任务报告 + +- `git diff --check` 通过。 +- 定向 self-test 通过 61 项： + - `20-runner-k8s-job`； + - `22-runner-retention-stale-pending`； + - `37-user-message-event`； + - `80-cicd-tekton-contract`。 +- 变更范围： + - 生成的 `.tekton/agentrun-nc01-v02.yaml`； + - MDTODO 与任务报告。 +- 生成边界： + - 未手改 source artifact； + - 未部署； + - 未合并。 +- PR 关联 AgentRun #280/#282 与 UniDesk #1726/#1745，交由主代理审查： + - PR merge 后只允许自动执行 GitHub webhook → Gitea controlled mirror → PaC → Tekton → GitOps/Argo； + - 不执行 `closeout`、`apply`、`trigger-current`、mirror `sync`/`flush` 或手工创建 PipelineRun。 diff --git a/docs/MDTODO/details/pac-source-artifact-alignment/R1_Task_Report.md b/docs/MDTODO/details/pac-source-artifact-alignment/R1_Task_Report.md new file mode 100644 index 0000000..fc33846 --- /dev/null +++ b/docs/MDTODO/details/pac-source-artifact-alignment/R1_Task_Report.md @@ -0,0 +1,3 @@ +# R1 任务报告 + +AgentRun NC01/v0.2 PaC source artifact 已由 owning YAML 和 domain renderer 重新生成，并通过幂等写入与 source/provenance 对齐检查。交付只包含声明的生成物及审计文档，不包含部署或运行面修改。 diff --git a/docs/MDTODO/details/pac-source-artifact-alignment/R2_Task_Report.md b/docs/MDTODO/details/pac-source-artifact-alignment/R2_Task_Report.md new file mode 100644 index 0000000..26042c8 --- /dev/null +++ b/docs/MDTODO/details/pac-source-artifact-alignment/R2_Task_Report.md @@ -0,0 +1,36 @@ +# R2 任务报告 + +- 关联上下文： + - [UniDesk #1745](https://github.com/pikasTech/unidesk/issues/1745)； + - [UniDesk #1753](https://github.com/pikasTech/unidesk/issues/1753)。 +- 自动交付原则： + - 引用 [UniDesk #1755](https://github.com/pikasTech/unidesk/issues/1755) 与 [UniDesk PR #1757](https://github.com/pikasTech/unidesk/pull/1757)； + - PR merge 是唯一触发； + - 合并后自动完成 GitHub webhook → Gitea controlled mirror → PaC → Tekton → GitOps/Argo。 +- 生成工具： + - UniDesk `96020b082eea4968daf93606bc251b36fadf6c09`； + - 已包含 PR #1754 的 YAML 空白修复。 +- source-artifact 合同： + - 第一次 `write --confirm` 返回 `mutation=true`； + - 第二次返回 `mutation=false`； + - `check` 返回 `source.status=aligned`、`provenanceAligned=true`。 +- canonical SHA256： + - owning Pipeline：`sha256:9050045cf22359d1dab3d12c50b54068e1d1921127a5bb3cf285592aa3ca0f93`； + - source Pipeline：`sha256:9050045cf22359d1dab3d12c50b54068e1d1921127a5bb3cf285592aa3ca0f93`。 +- 静态验收： + - `.tekton/agentrun-nc01-v02.yaml` 通过 YAML 解析； + - 文件只有一个 EOF 换行； + - `git diff --check` 通过； + - 生成物没有手工修改。 +- 显式 self-test 运行配置下共 61 项通过： + - `20-runner-k8s-job`； + - `22-runner-retention-stale-pending`； + - `37-user-message-event`； + - `80-cicd-tekton-contract`。 +- 已创建非草稿 [AgentRun PR #292](https://github.com/pikasTech/agentrun/pull/292)： + - 目标分支为 `v0.2`； + - 交由主代理审查和合并。 +- 本任务只准备消费者 PR： + - 不合并； + - 不部署； + - 不执行 `closeout`、`apply`、`trigger-current`、mirror `sync`/`flush`、手工创建 PipelineRun 或其他人工补链。 diff --git a/docs/MDTODO/pac-source-artifact-alignment.md b/docs/MDTODO/pac-source-artifact-alignment.md new file mode 100644 index 0000000..a656a52 --- /dev/null +++ b/docs/MDTODO/pac-source-artifact-alignment.md @@ -0,0 +1,26 @@ +# AgentRun PaC 源工件对齐 + +来源： + +- [AgentRun #280](https://github.com/pikasTech/agentrun/issues/280) +- [AgentRun #282](https://github.com/pikasTech/agentrun/issues/282) +- [UniDesk #1726](https://github.com/pikasTech/unidesk/issues/1726) +- [UniDesk #1745](https://github.com/pikasTech/unidesk/issues/1745) + +边界：只使用 UniDesk YAML-first source-artifact renderer 生成 AgentRun consumer 的 PaC 源工件；不手改生成物、不部署、不合并。 + +## R1 [completed] + +生成并验证 AgentRun NC01 PaC source artifact，完成任务后将详细报告写入[任务报告](./details/pac-source-artifact-alignment/R1_Task_Report.md)。 + +### R1.1 [completed] + +使用 YAML authority 完成 plan/write 幂等/check，完成任务后将详细报告写入[任务报告](./details/pac-source-artifact-alignment/R1.1_Task_Report.md)。 + +### R1.2 [completed] + +验证唯一生成物并提交可审查 PR，完成任务后将详细报告写入[任务报告](./details/pac-source-artifact-alignment/R1.2_Task_Report.md)。 + +## R2 [completed] + +基于 [UniDesk #1753](https://github.com/pikasTech/unidesk/issues/1753) 修复后的生成器重新生成、验收并提交 AgentRun 消费者 PR，关联 [UniDesk #1745](https://github.com/pikasTech/unidesk/issues/1745)，完成任务后将详细报告写入[任务报告](./details/pac-source-artifact-alignment/R2_Task_Report.md)。 \ No newline at end of file