apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  generateName: platform-infra-temporal-nc01-
  annotations:
    pipelinesascode.tekton.dev/on-event: "[push]"
    pipelinesascode.tekton.dev/on-target-branch: "[master]"
    pipelinesascode.tekton.dev/on-cel-expression: "event == 'push' && target_branch == 'master' && node == 'NC01'"
  labels:
    app.kubernetes.io/name: platform-infra-temporal-nc01-pac
    app.kubernetes.io/part-of: temporal
    unidesk.ai/source-commit: "{{revision}}"
spec:
  timeouts:
    pipeline: 600s
  taskRunTemplate:
    serviceAccountName: platform-infra-temporal-nc01-tekton-runner
    podTemplate:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      securityContext:
        fsGroup: 1000
  pipelineSpec:
    tasks:
      - name: validate-and-publish
        taskSpec:
          volumes:
            - name: workspace
              emptyDir:
                sizeLimit: 1Gi
            - name: gitea-auth
              secret:
                secretName: pac-gitea-sentinel-nc01-v03
                items:
                  - key: token
                    path: token
          steps:
            - name: publish-gitops
              image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
              imagePullPolicy: IfNotPresent
              workingDir: /workspace
              env:
                - name: SOURCE_COMMIT
                  value: "{{revision}}"
                - name: SOURCE_SNAPSHOT_PREFIX
                  value: "{{source_snapshot_prefix}}"
              script: |
                #!/bin/sh
                set -eu
                askpass=/workspace/gitea-askpass.sh
                trap 'rm -f "$askpass"' EXIT
                cat >"$askpass" <<'ASKPASS'
                #!/bin/sh
                case "$1" in
                  *Username*) printf '%s\n' "${GITEA_USERNAME:?}" ;;
                  *Password*) cat /workspace/gitea-auth/token ;;
                  *) exit 1 ;;
                esac
                ASKPASS
                chmod 700 "$askpass"
                export GITEA_USERNAME=unidesk-admin GIT_ASKPASS="$askpass" GIT_ASKPASS_REQUIRE=force GIT_TERMINAL_PROMPT=0
                git clone --filter=blob:none --no-checkout http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git source
                cd source
                git fetch --depth=1 --filter=blob:none origin "+$SOURCE_SNAPSHOT_PREFIX/$SOURCE_COMMIT:refs/remotes/origin/unidesk-source-snapshot"
                git checkout --detach "$SOURCE_COMMIT"
                test "$(git rev-parse HEAD)" = "$SOURCE_COMMIT"
                bun scripts/cli.ts platform-infra temporal plan --target NC01
                exec bun scripts/native/cicd/publish-platform-infra-temporal-gitops.ts \
                  --source-commit "$SOURCE_COMMIT" \
                  --worktree /workspace/temporal-gitops
              volumeMounts:
                - name: workspace
                  mountPath: /workspace
                - name: gitea-auth
                  mountPath: /workspace/gitea-auth
                  readOnly: true