version: 1
kind: platform-infra-pipelines-as-code
metadata:
  id: pac-gitea-consumers
  owner: unidesk
  spec: GH-1552/GH-1555/GH-1560
  relatedIssues:
    - 1552
    - 1555
    - 1557
    - 1560
    - 1649
    - 1760
    - 1769
    - 1802
    - 1811
    - 2165
    - 2274
    - 2628
    - 2721
defaults:
  targetId: NC01
  consumerId: hwlab-nc01-v03
display:
  timeZone: Asia/Shanghai
deliveryTiming:
  endToEndBudgetSeconds: 120
deliveryTrigger:
  mode: manual-plan-confirm
  mechanism: pac-webhook
observability:
  configRef: config/platform-infra/observability.yaml
  readOnlyCapture:
    timeoutMs: 25000
  tracesEndpoint: http://otel-collector.platform-infra.svc.cluster.local:4318/v1/traces
  serviceName: unidesk-cicd
  propagation:
    - tracecontext
    - baggage
  sampling:
    mode: parentbased_traceidratio
    ratio: 1
  exporterFailure:
    warning: true
    blocking: false
    timeoutMs: 300
release:
  version: v0.48.0
  manifestUrl: https://github.com/openshift-pipelines/pipelines-as-code/releases/download/v0.48.0/release.k8s.yaml
  namespace: pipelines-as-code
  controllerServiceName: pipelines-as-code-controller
  controllerServicePort: 8080
  waitTimeoutSeconds: 55
  workloads:
    watcher:
      deploymentName: pipelines-as-code-watcher
      containerName: pac-watcher
      startupProbe:
        httpGet:
          path: /live
          port: probes
        initialDelaySeconds: 30
        periodSeconds: 10
        timeoutSeconds: 5
        failureThreshold: 60
        successThreshold: 1
      readinessProbe:
        httpGet:
          path: /live
          port: probes
        initialDelaySeconds: 5
        periodSeconds: 10
        timeoutSeconds: 5
        failureThreshold: 3
        successThreshold: 1
      livenessProbe:
        httpGet:
          path: /live
          port: probes
        initialDelaySeconds: 180
        periodSeconds: 10
        timeoutSeconds: 5
        failureThreshold: 6
        successThreshold: 1
deliveryProvenance:
  version: admission-pac-v2
  markerAnnotation: unidesk.ai/pac-admission-provenance
  child:
    enabled: false
    parentNameAnnotation: unidesk.ai/pac-parent-pipelinerun
    parentUidAnnotation: unidesk.ai/pac-parent-pipelinerun-uid
  controller:
    namespace: pipelines-as-code
    serviceAccountName: pipelines-as-code-controller
  queueTransition:
    controller:
      namespace: pipelines-as-code
      serviceAccountName: pipelines-as-code-watcher
    stateLabel: pipelinesascode.tekton.dev/state
    allowed:
      - fromSpecStatus: PipelineRunPending
        toSpecStatus: absent
        fromState: queued
        toState: started
  admission:
    policyName: unidesk-pac-delivery-provenance-v2
    bindingName: unidesk-pac-delivery-provenance-v2
    failurePolicy: Ignore
    validationActions:
      - Warn
      - Audit
capabilities:
  sentinelInternalPublish:
    enabled: false
    admissionProvenance: unavailable
    trackingIssue: https://github.com/pikasTech/unidesk/issues/1769
closeout:
  gitOpsMirrorFlush:
    enabled: true
    waitTimeoutSeconds: 55
    maxAttempts: 5
targets:
  - id: JD01
    route: JD01:k3s
    namespace: agentrun-ci
    role: manual-cicd-trigger-authority
    enabled: true
  - id: NC01
    route: NC01:k3s
    namespace: agentrun-ci
    role: manual-cicd-trigger-authority
    enabled: true
gitea:
  configRef: "config/platform-infra/gitea.yaml#sourceAuthority.repositories"
  internalBaseUrl: http://gitea-http.devops-infra.svc.cluster.local:3000
  admin:
    sourceRoot: /root/.unidesk/.env
    sourceRef: gitea.auth
    format: line-pair
    usernameLine: 1
    passwordLine: 2
    apiUsername: unidesk-admin
  webhook:
    enabled: false
    secretRoot: /root/.unidesk/.env
    secretSourceRef: pipelines-as-code.webhook
    events:
      - push
    branch: params.source_branch
repositories:
  - extends: templates.repositories.agentrunV02
    variables:
      NODE: JD01
      LANE: v02
    url: https://gitea.hwpod.com/mirrors/pikasTech-agentrun
  - extends: templates.repositories.agentrunV02
    variables:
      NODE: NC01
      LANE: v02
  - extends: templates.repositories.sentinelV03
    variables:
      NODE: JD01
      LANE: v03
      sourceSnapshotPrefix: refs/unidesk/snapshots/gitea-actions/unidesk-master
    url: https://gitea.hwpod.com/mirrors/pikasTech-unidesk
  - extends: templates.repositories.sentinelV03
    variables:
      NODE: NC01
      LANE: v03
      sourceSnapshotPrefix: refs/unidesk/snapshots/gitea-actions/unidesk-master-nc01
    params:
      unidesk_host_image_repository: 127.0.0.1:5000/unidesk/todo-note
      unidesk_host_registry_probe_base: http://127.0.0.1:5000
      unidesk_host_gitops_branch: unidesk-host-gitops
      unidesk_host_gitops_manifest_path: deploy/gitops/unidesk-host/todo-note.yaml
      unidesk_host_runtime_namespace: unidesk
      unidesk_host_runtime_deployment: todo-note
      unidesk_host_runtime_service: todo-note
      unidesk_host_runtime_service_port: "4288"
      unidesk_host_health_path: /health
      unidesk_host_health_url: http://todo-note.unidesk.svc.cluster.local:4288/health
  - id: sub2rank-nc01
    name: sub2rank-nc01
    namespace: devops-infra
    providerType: gitea
    url: https://gitea.hwpod.com/mirrors/pikasTech-apistate
    cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-apistate.git
    owner: mirrors
    repo: pikasTech-apistate
    secretName: pac-gitea-sub2rank-nc01
    tokenKey: token
    webhookSecretKey: webhook.secret
    concurrencyLimit: 1
    params:
      git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-apistate.git
      source_branch: master
      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/apistate-master-nc01
      node: NC01
      image_repository: 127.0.0.1:5000/sub2rank/sub2rank
      registry_probe_base: http://127.0.0.1:5000
      gitops_branch: unidesk-host-gitops
      gitops_manifest_path: deploy/gitops/platform-infra/sub2rank-nc01/resources.yaml
      pipeline_name: platform-infra-sub2rank-nc01-pac
      pipeline_run_prefix: sub2rank-nc01
      service_account: sub2rank-nc01-tekton-runner
      pipeline_timeout: 600s
      workspace_pvc_size: 4Gi
      runtime_namespace: platform-infra
      runtime_deployment: sub2rank
      runtime_service: sub2rank
      runtime_service_port: "8080"
      health_path: /health
      health_url: http://sub2rank.platform-infra.svc.cluster.local:8080/health
  - id: sub2rank-development-nc01
    name: sub2rank-development-nc01
    namespace: devops-infra
    providerType: gitea
    url: https://gitea.hwpod.com/mirrors/pikasTech-apistate-development
    cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-apistate-development.git
    owner: mirrors
    repo: pikasTech-apistate-development
    secretName: pac-gitea-sub2rank-development-nc01
    tokenKey: token
    webhookSecretKey: webhook.secret
    concurrencyLimit: 1
    params:
      git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-apistate-development.git
      source_branch: development
      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/apistate-development-nc01
      node: NC01
      image_repository: 127.0.0.1:5000/sub2rank/sub2rank
      registry_probe_base: http://127.0.0.1:5000
      gitops_branch: unidesk-host-gitops
      gitops_manifest_path: deploy/gitops/platform-infra/sub2rank-development-nc01/resources.yaml
      pipeline_name: platform-infra-sub2rank-development-nc01-pac
      pipeline_run_prefix: sub2rank-development-nc01
      service_account: sub2rank-development-nc01-tekton-runner
      pipeline_timeout: 600s
      workspace_pvc_size: 4Gi
      runtime_namespace: platform-infra-development
      runtime_deployment: sub2rank
      runtime_service: sub2rank
      runtime_service_port: "8080"
      health_path: /health
      health_url: http://sub2rank.platform-infra-development.svc.cluster.local:8080/health
  - id: hwpod-home-nc01
    name: hwpod-home-nc01
    namespace: devops-infra
    providerType: gitea
    url: https://gitea.hwpod.com/mirrors/pikainc-hwpod-home
    cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-hwpod-home.git
    owner: mirrors
    repo: pikainc-hwpod-home
    secretName: pac-gitea-hwpod-home-nc01
    tokenKey: token
    webhookSecretKey: webhook.secret
    concurrencyLimit: 1
    params:
      git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-hwpod-home.git
      source_branch: main
      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/hwpod-home-main-nc01
      node: NC01
      image_repository: 127.0.0.1:5000/hwpod/home
      registry_probe_base: http://127.0.0.1:5000
      gitops_branch: unidesk-host-gitops
      gitops_manifest_path: deploy/gitops/platform-infra/hwpod-home-nc01/resources.yaml
      pipeline_name: platform-infra-hwpod-home-nc01-pac
      pipeline_run_prefix: hwpod-home-nc01
      service_account: hwpod-home-nc01-tekton-runner
      pipeline_timeout: 600s
      workspace_pvc_size: 2Gi
      runtime_namespace: hwpod-home
      runtime_deployment: hwpod-home
      runtime_service: hwpod-home
      runtime_service_port: "8080"
      health_path: /healthz
      health_url: http://hwpod-home.hwpod-home.svc.cluster.local:8080/healthz
  - extends: templates.repositories.hwlabV03
    variables:
      NODE: JD01
      LANE: v03
    url: https://gitea.hwpod.com/mirrors/pikasTech-HWLAB
  - extends: templates.repositories.hwlabV03
    variables:
      NODE: NC01
      LANE: v03
  - id: selfmedia-nc01
    name: selfmedia-nc01
    namespace: selfmedia-ci
    providerType: gitea
    url: https://gitea.hwpod.com/mirrors/pikainc-selfmedia
    cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
    owner: mirrors
    repo: pikainc-selfmedia
    secretName: pac-gitea-selfmedia-nc01
    tokenKey: token
    webhookSecretKey: webhook.secret
    concurrencyLimit: 1
    params:
      git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
      source_branch: master
      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/selfmedia-master-nc01
      node: NC01
      pipeline_name: selfmedia-nc01-pac
      pipeline_run_prefix: selfmedia-nc01
      service_account: selfmedia-nc01-tekton-runner
      pipeline_timeout: 2h0m0s
      image_repository: 127.0.0.1:5000/selfmedia/newsroom
      registry_probe_base: http://127.0.0.1:5000
      gitops_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
      gitops_write_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
      gitops_branch: nc01-selfmedia-gitops
      gitops_username: unidesk-admin
      gitops_secret_name: pac-gitea-selfmedia-nc01
      gitops_manifest_path: deploy/gitops/nc01/resources.yaml
      runtime_namespace: selfmedia
      runtime_deployment: selfmedia
      runtime_service: selfmedia
      runtime_service_port: "4317"
      health_path: /healthz
      health_url: http://selfmedia.selfmedia.svc.cluster.local:4317/healthz
  - id: pikaoa-dev-nc01
    name: pikaoa-dev-nc01
    namespace: pikaoa-ci
    providerType: gitea
    url: https://gitea.hwpod.com/mirrors/pikainc-pikaoa
    cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
    owner: mirrors
    repo: pikainc-pikaoa
    secretName: pac-gitea-pikaoa-dev-nc01
    tokenKey: token
    webhookSecretKey: webhook.secret
    concurrencyLimit: 1
    params:
      git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
      source_branch: master
      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/pikaoa-master-nc01
      node: NC01
      pipeline_name: pikaoa-dev-nc01-pac
      pipeline_run_prefix: pikaoa-dev-nc01
      service_account: pikaoa-dev-nc01-tekton-runner
      pipeline_timeout: 20m0s
      workspace_pvc_size: 8Gi
      image_repository: 127.0.0.1:5000/pikaoa/api
      api_image_repository: 127.0.0.1:5000/pikaoa/api
      worker_image_repository: 127.0.0.1:5000/pikaoa/worker
      web_image_repository: 127.0.0.1:5000/pikaoa/web
      registry_probe_base: http://127.0.0.1:5000
      gitops_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
      gitops_write_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
      gitops_branch: nc01-pikaoa-dev-gitops
      gitops_username: unidesk-admin
      gitops_secret_name: pac-gitea-pikaoa-dev-nc01
      gitops_manifest_path: deploy/gitops/nc01-dev/resources.yaml
      runtime_namespace: pikaoa-dev
      runtime_deployment: pikaoa-api
      runtime_service: pikaoa-web
      runtime_service_port: "8080"
      health_path: /healthz
      health_url: http://pikaoa-web.pikaoa-dev.svc.cluster.local:8080/healthz
  - id: superapi-development-nc01
    name: superapi-development-nc01
    namespace: devops-infra
    providerType: gitea
    url: https://gitea.hwpod.com/mirrors/pikainc-superapi
    cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-superapi.git
    owner: mirrors
    repo: pikainc-superapi
    secretName: pac-gitea-superapi-development-nc01
    tokenKey: token
    webhookSecretKey: webhook.secret
    concurrencyLimit: 1
    params:
      git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-superapi.git
      source_branch: master
      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/superapi-master-nc01
      node: NC01
      image_repository: 127.0.0.1:5000/superapi/superapi
      pipeline_name: superapi-development-nc01-pac
      pipeline_run_prefix: superapi-development-nc01
      service_account: superapi-development-nc01-tekton-runner
      pipeline_timeout: 900s
      workspace_pvc_size: 4Gi
      runtime_namespace: superapi-development
      runtime_deployment: superapi-gateway
      runtime_service: superapi-gateway
      runtime_service_port: "8080"
      health_path: /health
      health_url: http://superapi-gateway.superapi-development.svc.cluster.local:8080/health
consumers:
  - extends: templates.consumers.agentrunV02
    variables:
      NODE: JD01
      LANE: v02
  - extends: templates.consumers.agentrunV02
    variables:
      NODE: NC01
      LANE: v02
    closeoutGitOpsMirrorFlush: false
    argoBootstrap:
      project: agentrun-nc01-v02
      repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
      targetRevision: nc01-v0.2-gitops
      path: deploy/gitops/node/nc01/runtime-v02
      destinationNamespace: agentrun-v02
      automated: true
      repositoryCredential:
        secretName: argocd-repo-agentrun-nc01-v02
        username: unidesk-admin
    deliveryProvenance:
      required: true
      markerValue: admission-pac-v2:agentrun-nc01-v02
      executionServiceAccountName: agentrun-nc01-v02-tekton-runner
      gitOps:
        repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        targetRevision: nc01-v0.2-gitops
    sourceArtifact:
      mode: embedded-pipeline-spec
      renderer: agentrun-control-plane
      configRef: config/agentrun.yaml#controlPlane.lanes.nc01-v02
      pipelineRunPath: .tekton/agentrun-nc01-v02.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
        nodeSelector:
          unidesk.ai/node-id: NC01
  - extends: templates.consumers.agentrunRelease
    variables:
      NODE: NC01
      LANE: release
    repositoryRef: agentrun-nc01-v02
    closeoutGitOpsMirrorFlush: false
    argoBootstrap:
      project: agentrun-nc01-release
      repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
      targetRevision: nc01-release-gitops
      path: deploy/gitops/node/nc01/runtime-release
      destinationNamespace: agentrun-release
      automated: true
      repositoryCredential:
        secretName: argocd-repo-agentrun-nc01-release
        username: unidesk-admin
    deliveryProvenance:
      required: true
      markerValue: admission-pac-v2:agentrun-nc01-release
      executionServiceAccountName: agentrun-nc01-release-tekton-runner
      gitOps:
        repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        targetRevision: nc01-release-gitops
    sourceArtifact:
      mode: embedded-pipeline-spec
      renderer: agentrun-control-plane
      configRef: config/agentrun.yaml#controlPlane.lanes.nc01-release
      pipelineRunPath: .tekton/agentrun-nc01-release.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - extends: templates.consumers.sentinelV03
    variables:
      NODE: JD01
      LANE: v03
  - extends: templates.consumers.sentinelV03
    variables:
      NODE: NC01
      LANE: v03
  - id: unidesk-host
    repositoryRef: sentinel-nc01-v03
    node: NC01
    lane: host-k8s
    namespace: devops-infra
    pipeline: unidesk-host-pac
    pipelineRunPrefix: unidesk-host-
    argoNamespace: argocd
    argoApplication: unidesk-host
    deliveryObservation:
      runtimeEvidence: required
    closeoutGitOpsMirrorFlush: true
    closeoutGitOpsMirrorLane: v03
    argoBootstrap:
      project: default
      repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
      targetRevision: unidesk-host-gitops
      path: deploy/gitops/unidesk-host
      destinationNamespace: unidesk
      automated: true
  - id: platform-infra-gitea-nc01
    repositoryRef: sentinel-nc01-v03
    node: NC01
    lane: platform-infra
    namespace: devops-infra
    pipeline: platform-infra-gitea-nc01-pac
    pipelineRunPrefix: platform-infra-gitea-nc01-
    argoNamespace: argocd
    argoApplication: platform-infra-gitea-nc01
    deliveryObservation:
      runtimeEvidence: not-applicable
    closeoutGitOpsMirrorFlush: false
  - id: platform-infra-sub2rank-nc01
    repositoryRef: sub2rank-nc01
    node: NC01
    lane: platform-infra
    namespace: devops-infra
    pipeline: platform-infra-sub2rank-nc01-pac
    pipelineRunPrefix: sub2rank-nc01
    argoNamespace: argocd
    argoApplication: sub2rank-nc01
    deliveryObservation:
      runtimeEvidence: required
    closeoutGitOpsMirrorFlush: true
    closeoutGitOpsMirrorLane: v03
    argoBootstrap:
      project: default
      repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
      targetRevision: unidesk-host-gitops
      path: deploy/gitops/platform-infra/sub2rank-nc01
      destinationNamespace: platform-infra
      automated: true
    deliveryProvenance:
      required: true
      markerValue: admission-pac-v2:platform-infra-sub2rank-nc01
      executionServiceAccountName: sub2rank-nc01-tekton-runner
      gitOps:
        repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
        targetRevision: unidesk-host-gitops
    runnerServiceAccount:
      name: sub2rank-nc01-tekton-runner
      automountServiceAccountToken: false
      roleBindingName: sub2rank-nc01-tekton-runner
    sourceArtifact:
      mode: embedded-pipeline-spec
      renderer: sub2rank-platform-service
      configRef: config/platform-infra/sub2rank.yaml#delivery
      pipelineRunPath: .tekton/sub2rank-nc01-pac.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - id: platform-infra-sub2rank-development-nc01
    repositoryRef: sub2rank-development-nc01
    node: NC01
    lane: platform-infra-development
    namespace: devops-infra
    pipeline: platform-infra-sub2rank-development-nc01-pac
    pipelineRunPrefix: sub2rank-development-nc01
    argoNamespace: argocd
    argoApplication: sub2rank-development-nc01
    deliveryObservation:
      runtimeEvidence: required
    closeoutGitOpsMirrorFlush: false
    argoBootstrap:
      project: default
      repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
      targetRevision: unidesk-host-gitops
      path: deploy/gitops/platform-infra/sub2rank-development-nc01
      destinationNamespace: platform-infra-development
      automated: true
    deliveryProvenance:
      required: true
      markerValue: admission-pac-v2:platform-infra-sub2rank-development-nc01
      executionServiceAccountName: sub2rank-development-nc01-tekton-runner
      gitOps:
        repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
        targetRevision: unidesk-host-gitops
    runnerServiceAccount:
      name: sub2rank-development-nc01-tekton-runner
      automountServiceAccountToken: false
      roleBindingName: sub2rank-development-nc01-tekton-runner
    sourceArtifact:
      mode: embedded-pipeline-spec
      renderer: sub2rank-platform-service
      configRef: config/platform-infra/sub2rank.yaml#delivery.profiles.development
      pipelineRunPath: .tekton/sub2rank-development-nc01-pac.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - id: platform-infra-hwpod-home-nc01
    repositoryRef: hwpod-home-nc01
    node: NC01
    lane: platform-infra
    namespace: devops-infra
    pipeline: platform-infra-hwpod-home-nc01-pac
    pipelineRunPrefix: hwpod-home-nc01
    argoNamespace: argocd
    argoApplication: hwpod-home-nc01
    deliveryObservation:
      runtimeEvidence: required
    closeoutGitOpsMirrorFlush: true
    closeoutGitOpsMirrorLane: v03
    argoBootstrap:
      project: default
      repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
      targetRevision: unidesk-host-gitops
      path: deploy/gitops/platform-infra/hwpod-home-nc01
      destinationNamespace: hwpod-home
      automated: true
    deliveryProvenance:
      required: true
      markerValue: admission-pac-v2:platform-infra-hwpod-home-nc01
      executionServiceAccountName: hwpod-home-nc01-tekton-runner
      gitOps:
        repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
        targetRevision: unidesk-host-gitops
    runnerServiceAccount:
      name: hwpod-home-nc01-tekton-runner
      automountServiceAccountToken: false
      roleBindingName: hwpod-home-nc01-tekton-runner
    sourceArtifact:
      mode: embedded-pipeline-spec
      renderer: static-site-runtime
      configRef: config/platform-infra/hwpod-home.yaml#delivery
      pipelineRunPath: .tekton/hwpod-home-nc01-pac.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - extends: templates.consumers.hwlabV03
    variables:
      NODE: JD01
      LANE: v03
  - extends: templates.consumers.hwlabV03
    variables:
      NODE: NC01
      LANE: v03
    sourceArtifact:
      mode: remote-pipeline-annotation
      renderer: hwlab-runtime-lane
      configRef: config/hwlab-node-lanes.yaml#lanes.v03.targets.NC01
      pipelinePath: ci/pipelines/hwlab-nc01-v03-ci-image-publish.yaml
      pipelineRunPath: .tekton/hwlab-nc01-v03-pac.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - extends: templates.consumers.hwlabV03
    variables:
      NODE: NC01
      LANE: production
    id: hwlab-nc01-production
    repositoryRef: hwlab-nc01-v03
    lane: production
    pipeline: hwlab-nc01-production-ci-image-publish
    pipelineRunPrefix: hwlab-nc01-production-ci-poll
    argoApplication: hwlab-node-production
    params:
      source_branch: release
      gitops_branch: release-gitops
      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/hwlab-node-runtime/release
      pipeline_name: hwlab-nc01-production-ci-image-publish
      pipeline_run_prefix: hwlab-nc01-production-ci-poll
      service_account: hwlab-nc01-production-tekton-runner
      lane: production
      runtime_namespace: hwlab-production
    sourceArtifact:
      mode: remote-pipeline-annotation
      renderer: hwlab-runtime-lane
      configRef: config/hwlab-node-lanes.yaml#lanes.production.targets.NC01
      pipelinePath: ci/pipelines/hwlab-nc01-production-ci-image-publish.yaml
      pipelineRunPath: .tekton/hwlab-nc01-production-pac.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - id: selfmedia-nc01
    repositoryRef: selfmedia-nc01
    node: NC01
    lane: selfmedia
    namespace: selfmedia-ci
    pipeline: selfmedia-nc01-pac
    pipelineRunPrefix: selfmedia-nc01
    argoNamespace: argocd
    argoApplication: selfmedia-nc01
    deliveryObservation:
      runtimeEvidence: required
    closeoutGitOpsMirrorFlush: false
    argoBootstrap:
      project: default
      repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
      targetRevision: nc01-selfmedia-gitops
      path: deploy/gitops/nc01
      destinationNamespace: selfmedia
      automated: true
      repositoryCredential:
        secretName: argocd-repo-selfmedia-nc01
        username: unidesk-admin
    deliveryProvenance:
      required: true
      markerValue: admission-pac-v2:selfmedia-nc01
      executionServiceAccountName: selfmedia-nc01-tekton-runner
      gitOps:
        repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
        targetRevision: nc01-selfmedia-gitops
    runnerServiceAccount:
      name: selfmedia-nc01-tekton-runner
      automountServiceAccountToken: false
      roleBindingName: selfmedia-nc01-tekton-runner
    sourceArtifact:
      mode: embedded-pipeline-spec
      renderer: selfmedia-runtime
      configRef: config/selfmedia.yaml#delivery.targets.NC01
      pipelineRunPath: .tekton/selfmedia-nc01-pac.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - id: selfmedia-production-nc01
    repositoryRef: selfmedia-nc01
    node: NC01
    lane: selfmedia-production
    namespace: selfmedia-ci
    pipeline: selfmedia-production-nc01-pac
    pipelineRunPrefix: selfmedia-production-nc01
    argoNamespace: argocd
    argoApplication: selfmedia-production-nc01
    deliveryObservation:
      runtimeEvidence: required
    closeoutGitOpsMirrorFlush: false
    params:
      source_branch: release
      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/selfmedia-release-nc01
      pipeline_name: selfmedia-production-nc01-pac
      pipeline_run_prefix: selfmedia-production-nc01
      service_account: selfmedia-production-nc01-tekton-runner
      image_repository: 127.0.0.1:5000/selfmedia/newsroom-production
      gitops_branch: nc01-selfmedia-production-gitops
      gitops_manifest_path: deploy/gitops/nc01-production/resources.yaml
      runtime_namespace: selfmedia-production
      runtime_deployment: selfmedia-production
      runtime_service: selfmedia-production
      health_url: http://selfmedia-production.selfmedia-production.svc.cluster.local:4317/healthz
    argoBootstrap:
      project: default
      repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
      targetRevision: nc01-selfmedia-production-gitops
      path: deploy/gitops/nc01-production
      destinationNamespace: selfmedia-production
      automated: true
      repositoryCredential:
        secretName: argocd-repo-selfmedia-production-nc01
        username: unidesk-admin
    deliveryProvenance:
      required: true
      markerValue: admission-pac-v2:selfmedia-production-nc01
      executionServiceAccountName: selfmedia-production-nc01-tekton-runner
      gitOps:
        repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
        targetRevision: nc01-selfmedia-production-gitops
    runnerServiceAccount:
      name: selfmedia-production-nc01-tekton-runner
      automountServiceAccountToken: false
      roleBindingName: selfmedia-production-nc01-tekton-runner
    sourceArtifact:
      mode: embedded-pipeline-spec
      renderer: selfmedia-runtime
      configRef: config/selfmedia.yaml#delivery.targets.NC01_PRODUCTION
      pipelineRunPath: .tekton/selfmedia-production-nc01-pac.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - id: pikaoa-dev-nc01
    repositoryRef: pikaoa-dev-nc01
    node: NC01
    lane: pikaoa-dev
    namespace: pikaoa-ci
    pipeline: pikaoa-dev-nc01-pac
    pipelineRunPrefix: pikaoa-dev-nc01
    argoNamespace: argocd
    argoApplication: pikaoa-dev-nc01
    deliveryObservation:
      runtimeEvidence: required
    closeoutGitOpsMirrorFlush: false
    argoBootstrap:
      project: default
      repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
      targetRevision: nc01-pikaoa-dev-gitops
      path: deploy/gitops/nc01-dev
      destinationNamespace: pikaoa-dev
      automated: true
      repositoryCredential:
        secretName: argocd-repo-pikaoa-dev-nc01
        username: unidesk-admin
    deliveryProvenance:
      required: true
      markerValue: admission-pac-v2:pikaoa-dev-nc01
      executionServiceAccountName: pikaoa-dev-nc01-tekton-runner
      gitOps:
        repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
        targetRevision: nc01-pikaoa-dev-gitops
    runnerServiceAccount:
      name: pikaoa-dev-nc01-tekton-runner
      automountServiceAccountToken: false
      roleBindingName: pikaoa-dev-nc01-tekton-runner
    sourceArtifact:
      mode: embedded-pipeline-spec
      renderer: pikaoa-development-runtime
      configRef: config/pikaoa.yaml#developmentRuntime.targets.NC01
      pipelineRunPath: .tekton/pikaoa-dev-nc01-pac.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - id: pikaoa-nc01
    repositoryRef: pikaoa-dev-nc01
    node: NC01
    lane: pikaoa
    namespace: pikaoa-ci
    pipeline: pikaoa-nc01-pac
    pipelineRunPrefix: pikaoa-nc01
    argoNamespace: argocd
    argoApplication: pikaoa-nc01
    deliveryObservation:
      runtimeEvidence: required
    closeoutGitOpsMirrorFlush: false
    params:
      source_branch: release
      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/pikaoa-release-nc01
      pipeline_name: pikaoa-nc01-pac
      pipeline_run_prefix: pikaoa-nc01
      service_account: pikaoa-nc01-tekton-runner
      gitops_branch: nc01-pikaoa-gitops
      gitops_secret_name: pac-gitea-pikaoa-nc01
      gitops_manifest_path: deploy/gitops/nc01/resources.yaml
      runtime_namespace: pikaoa
      runtime_deployment: pikaoa-api
      runtime_service: pikaoa-web
      health_url: http://pikaoa-web.pikaoa.svc.cluster.local:8080/healthz
    argoBootstrap:
      project: default
      repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
      targetRevision: nc01-pikaoa-gitops
      path: deploy/gitops/nc01
      destinationNamespace: pikaoa
      automated: true
      repositoryCredential:
        secretName: argocd-repo-pikaoa-nc01
        username: unidesk-admin
    deliveryProvenance:
      required: true
      markerValue: admission-pac-v2:pikaoa-nc01
      executionServiceAccountName: pikaoa-nc01-tekton-runner
      gitOps:
        repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
        targetRevision: nc01-pikaoa-gitops
    runnerServiceAccount:
      name: pikaoa-nc01-tekton-runner
      automountServiceAccountToken: false
      roleBindingName: pikaoa-nc01-tekton-runner
    sourceArtifact:
      mode: embedded-pipeline-spec
      renderer: pikaoa-release-runtime
      configRef: config/pikaoa.yaml#releaseRuntime.targets.NC01
      pipelineRunPath: .tekton/pikaoa-nc01-pac.yaml
      maxKeepRuns: 8
      taskRunTemplate:
        hostNetwork: true
        dnsPolicy: ClusterFirstWithHostNet
        fsGroup: 1000
  - id: superapi-development-nc01
    repositoryRef: superapi-development-nc01
    node: NC01
    lane: superapi-development
    namespace: devops-infra
    pipeline: superapi-development-nc01-pac
    pipelineRunPrefix: superapi-development-nc01
    argoNamespace: argocd
    argoApplication: superapi-development-nc01
    deliveryObservation:
      runtimeEvidence: required
    closeoutGitOpsMirrorFlush: false
    argoBootstrap:
      project: default
      repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
      targetRevision: unidesk-host-gitops
      path: deploy/gitops/platform-infra/superapi-development-nc01
      destinationNamespace: superapi-development
      automated: true
      repositoryCredential:
        secretName: argocd-repo-superapi-development-nc01
        username: unidesk-admin
    runnerServiceAccount:
      name: superapi-development-nc01-tekton-runner
      automountServiceAccountToken: false
      roleBindingName: superapi-development-nc01-tekton-runner
  - id: superapi-production-nc01
    repositoryRef: superapi-development-nc01
    node: NC01
    lane: superapi-production
    namespace: devops-infra
    pipeline: superapi-production-nc01-pac
    pipelineRunPrefix: superapi-production-nc01
    argoNamespace: argocd
    argoApplication: superapi-production-nc01
    deliveryObservation:
      runtimeEvidence: required
    closeoutGitOpsMirrorFlush: false
    params:
      source_branch: release
      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/superapi-release-nc01
      pipeline_name: superapi-production-nc01-pac
      pipeline_run_prefix: superapi-production-nc01
      service_account: superapi-production-nc01-tekton-runner
      runtime_namespace: superapi-production
      health_url: http://superapi-gateway.superapi-production.svc.cluster.local:8080/health
    argoBootstrap:
      project: default
      repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
      targetRevision: unidesk-host-gitops
      path: deploy/gitops/platform-infra/superapi-production-nc01
      destinationNamespace: superapi-production
      automated: true
      repositoryCredential:
        secretName: argocd-repo-superapi-production-nc01
        username: unidesk-admin
    runnerServiceAccount:
      name: superapi-production-nc01-tekton-runner
      automountServiceAccountToken: false
      roleBindingName: superapi-production-nc01-tekton-runner
templates:
  repositories:
    agentrunV02:
      id: "agentrun-${nodeLower}-v02"
      name: "agentrun-${nodeLower}-v02"
      namespace: agentrun-ci
      providerType: gitea
      url: https://gitea.hwpod.com/mirrors/pikasTech-agentrun
      cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
      owner: mirrors
      repo: pikasTech-agentrun
      secretName: "pac-gitea-agentrun-${nodeLower}-v02"
      tokenKey: token
      webhookSecretKey: webhook.secret
      concurrencyLimit: 1
      params:
        git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        git_write_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        source_branch: v0.2
        node: "${NODE}"
        gitops_branch: "${nodeLower}-v0.2-gitops"
        source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/agentrun-v0.2
        pipeline_name: "agentrun-${nodeLower}-v02-ci-image-publish"
        pipeline_run_prefix: "agentrun-${nodeLower}-v02-ci"
        service_account: "agentrun-${nodeLower}-v02-tekton-runner"
        workspace_pvc_size: 2Gi
    sentinelV03:
      id: "sentinel-${nodeLower}-v03"
      name: "sentinel-${nodeLower}-v03"
      namespace: devops-infra
      providerType: gitea
      url: https://gitea.hwpod.com/mirrors/pikasTech-unidesk
      cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git
      owner: mirrors
      repo: pikasTech-unidesk
      secretName: "pac-gitea-sentinel-${nodeLower}-v03"
      tokenKey: token
      webhookSecretKey: webhook.secret
      concurrencyLimit: 1
      params:
        git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git
        source_branch: master
        source_snapshot_prefix: "${sourceSnapshotPrefix}"
        node: "${NODE}"
        lane: v03
        sentinel_id: "${nodeLower}-web-probe-sentinel"
        image_repository: "127.0.0.1:5000/hwlab/web-probe-sentinel-${nodeLower}"
        registry_probe_base: http://127.0.0.1:5000
        gitops_branch: v0.3-gitops
        gitops_manifest_path: "deploy/gitops/node/${nodeLower}/web-probe-sentinel/web-probe-sentinel.yaml"
        pipeline_name: "hwlab-web-probe-sentinel-${nodeLower}-pac"
        pipeline_run_prefix: "hwlab-web-probe-sentinel-${nodeLower}"
        service_account: default
        otel_traces_endpoint: http://otel-collector.platform-infra.svc.cluster.local:4318/v1/traces
        otel_service_name: "unidesk-cicd-sentinel-${nodeLower}"
        otel_sampling_ratio: "1"
        otel_exporter_timeout_ms: "300"
    hwlabV03:
      id: "hwlab-${nodeLower}-v03"
      name: "hwlab-${nodeLower}-v03"
      namespace: hwlab-ci
      providerType: gitea
      url: https://gitea.hwpod.com/mirrors/pikasTech-HWLAB
      cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-HWLAB.git
      owner: mirrors
      repo: pikasTech-HWLAB
      secretName: "pac-gitea-hwlab-${nodeLower}-v03"
      tokenKey: token
      webhookSecretKey: webhook.secret
      concurrencyLimit: 1
      params:
        git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-HWLAB.git
        git_write_url: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
        gitops_read_url: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
        source_branch: v0.3
        gitops_branch: v0.3-gitops
        source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/hwlab-node-runtime/v0.3
        pipeline_name: "hwlab-${nodeLower}-v03-ci-image-publish"
        pipeline_run_prefix: "hwlab-${nodeLower}-v03-ci-poll"
        service_account: "hwlab-${nodeLower}-v03-tekton-runner"
        workspace_pvc_size: 8Gi
        git_ssh_secret: hwlab-git-ssh
        pipeline_timeout: 1h0m0s
        node: "${NODE}"
        lane: v03
        runtime_namespace: hwlab-v03
  consumers:
    agentrunV02:
      id: "agentrun-${nodeLower}-v02"
      repositoryRef: "agentrun-${nodeLower}-v02"
      node: "${NODE}"
      lane: "${nodeLower}-v02"
      namespace: agentrun-ci
      pipeline: "agentrun-${nodeLower}-v02-ci-image-publish"
      pipelineRunPrefix: "agentrun-${nodeLower}-v02-ci"
      argoNamespace: argocd
      argoApplication: "agentrun-${nodeLower}-v02"
      deliveryObservation:
        runtimeEvidence: required
      closeoutGitOpsMirrorFlush: false
    agentrunRelease:
      id: "agentrun-${nodeLower}-release"
      repositoryRef: "agentrun-${nodeLower}-release"
      node: "${NODE}"
      lane: "${nodeLower}-release"
      namespace: agentrun-ci
      pipeline: "agentrun-${nodeLower}-release-ci-image-publish"
      pipelineRunPrefix: "agentrun-${nodeLower}-release-ci"
      argoNamespace: argocd
      argoApplication: "agentrun-${nodeLower}-release"
      deliveryObservation:
        runtimeEvidence: required
      closeoutGitOpsMirrorFlush: false
      params:
        git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        git_write_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        source_branch: release
        node: "${NODE}"
        gitops_branch: "${nodeLower}-release-gitops"
        source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/agentrun-release
        pipeline_name: "agentrun-${nodeLower}-release-ci-image-publish"
        pipeline_run_prefix: "agentrun-${nodeLower}-release-ci"
        service_account: "agentrun-${nodeLower}-release-tekton-runner"
        workspace_pvc_size: 2Gi
    sentinelV03:
      id: "sentinel-${nodeLower}-v03"
      repositoryRef: "sentinel-${nodeLower}-v03"
      node: "${NODE}"
      lane: v03
      namespace: devops-infra
      pipeline: "hwlab-web-probe-sentinel-${nodeLower}-pac"
      pipelineRunPrefix: "hwlab-web-probe-sentinel-${nodeLower}"
      argoNamespace: argocd
      argoApplication: "hwlab-web-probe-sentinel-${nodeLower}"
      deliveryObservation:
        runtimeEvidence: required
      closeoutGitOpsMirrorFlush: true
      closeoutGitOpsMirrorLane: v03
    hwlabV03:
      id: "hwlab-${nodeLower}-v03"
      repositoryRef: "hwlab-${nodeLower}-v03"
      node: "${NODE}"
      lane: v03
      namespace: hwlab-ci
      pipeline: "hwlab-${nodeLower}-v03-ci-image-publish"
      pipelineRunPrefix: "hwlab-${nodeLower}-v03-ci-poll"
      argoNamespace: argocd
      argoApplication: hwlab-node-v03
      deliveryObservation:
        runtimeEvidence: required
      closeoutGitOpsMirrorFlush: true
      argoBootstrap:
        project: hwlab-v03
        repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
        targetRevision: v0.3-gitops
        path: "deploy/gitops/node/${nodeLower}/runtime-v03"
        destinationNamespace: hwlab-v03
        automated: true
