apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  generateName: platform-infra-gitea-nc01-
  annotations:
    pipelinesascode.tekton.dev/on-event: "[push]"
    pipelinesascode.tekton.dev/on-target-branch: "[master]"
    pipelinesascode.tekton.dev/on-cel-expression: "event == 'push' && target_branch == 'master' && node == 'NC01'"
  labels:
    app.kubernetes.io/name: platform-infra-gitea-nc01-pac
    app.kubernetes.io/part-of: platform-infra
    unidesk.ai/source-commit: "{{revision}}"
spec:
  timeouts:
    pipeline: 180s
  taskRunTemplate:
    serviceAccountName: default
    podTemplate:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      securityContext:
        fsGroup: 1000
  pipelineSpec:
    tasks:
      - name: publish-desired-state
        taskSpec:
          volumes:
            - name: workspace
              emptyDir:
                sizeLimit: 2Gi
            - name: gitea-auth
              secret:
                secretName: "{{gitops_secret_name}}"
                items:
                  - key: token
                    path: token
          steps:
            - name: publish
              image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
              imagePullPolicy: IfNotPresent
              workingDir: /workspace
              env:
                - name: SOURCE_COMMIT
                  value: "{{revision}}"
                - name: SOURCE_SNAPSHOT_PREFIX
                  value: "{{source_snapshot_prefix}}"
              script: |
                #!/bin/sh
                set -eu
                askpass=/workspace/gitea-askpass.sh
                trap 'rm -f "$askpass"' EXIT
                cat >"$askpass" <<'ASKPASS'
                #!/bin/sh
                case "$1" in
                  *Username*) printf '%s\n' "${GITEA_USERNAME:?}" ;;
                  *Password*) cat /workspace/gitea-auth/token ;;
                  *) exit 1 ;;
                esac
                ASKPASS
                chmod 700 "$askpass"
                export GITEA_USERNAME="{{gitops_username}}" GIT_ASKPASS="$askpass" GIT_ASKPASS_REQUIRE=force GIT_TERMINAL_PROMPT=0
                rm -rf source platform-infra-gitea-gitops
                git clone --filter=blob:none --no-checkout http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git source
                cd source
                git fetch --filter=blob:none origin "+$SOURCE_SNAPSHOT_PREFIX/$SOURCE_COMMIT:refs/remotes/origin/platform-infra-gitea-source"
                git checkout --detach "$SOURCE_COMMIT"
                test "$(git rev-parse HEAD)" = "$SOURCE_COMMIT"
                exec bun scripts/native/cicd/publish-platform-infra-gitea-gitops.mjs \
                  --source-root /workspace/source \
                  --source-commit "$SOURCE_COMMIT" \
                  --worktree /workspace/platform-infra-gitea-gitops
              volumeMounts:
                - name: workspace
                  mountPath: /workspace
                - name: gitea-auth
                  mountPath: /workspace/gitea-auth
                  readOnly: true
            - name: reconcile-public-edge
              image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
              imagePullPolicy: IfNotPresent
              workingDir: /workspace
              env:
                - name: SOURCE_COMMIT
                  value: "{{revision}}"
                - name: SOURCE_SNAPSHOT_PREFIX
                  value: "{{source_snapshot_prefix}}"
                - name: UNIDESK_SSH_CLIENT_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: public-edge-trans
                      key: UNIDESK_SSH_CLIENT_TOKEN
              script: |
                #!/bin/sh
                set -eu
                rm -rf public-edge-source
                git clone --filter=blob:none --no-checkout http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git public-edge-source
                cd public-edge-source
                git fetch --filter=blob:none origin "+$SOURCE_SNAPSHOT_PREFIX/$SOURCE_COMMIT:refs/remotes/origin/public-edge-source"
                git checkout --detach "$SOURCE_COMMIT"
                test "$(git rev-parse HEAD)" = "$SOURCE_COMMIT"
                exec bun scripts/native/cicd/deliver-platform-infra-public-edge.mjs \
                  --source-root /workspace/public-edge-source \
                  --source-commit "$SOURCE_COMMIT" \
                  --confirm
              volumeMounts:
                - name: workspace
                  mountPath: /workspace