apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  generateName: unidesk-host-
  annotations:
    pipelinesascode.tekton.dev/on-event: "[push]"
    pipelinesascode.tekton.dev/on-target-branch: "[master]"
    pipelinesascode.tekton.dev/on-cel-expression: "event == 'push' && target_branch == 'master' && node == 'NC01'"
  labels:
    app.kubernetes.io/name: unidesk-host-pac
    app.kubernetes.io/part-of: unidesk-host
    unidesk.ai/source-commit: "{{revision}}"
spec:
  timeouts:
    pipeline: 3600s
  taskRunTemplate:
    serviceAccountName: unidesk-host-tekton-runner
    podTemplate:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      securityContext:
        fsGroup: 1000
  pipelineSpec:
    tasks:
      - name: publish
        taskSpec:
          volumes:
            - name: workspace
              emptyDir:
                sizeLimit: 4Gi
            - name: gitea-auth
              secret:
                secretName: pac-gitea-sentinel-nc01-v03
                items:
                  - key: token
                    path: token
            - name: buildkit-state
              emptyDir:
                sizeLimit: 4Gi
            - name: tmp
              emptyDir: {}
          steps:
            - name: source
              image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
              imagePullPolicy: IfNotPresent
              workingDir: /workspace
              env:
                - name: SOURCE_COMMIT
                  value: "{{revision}}"
                - name: SOURCE_SNAPSHOT_PREFIX
                  value: "{{source_snapshot_prefix}}"
              script: |
                #!/bin/sh
                set -eu
                askpass=/workspace/gitea-askpass.sh
                trap 'rm -f "$askpass"' EXIT
                cat >"$askpass" <<'ASKPASS'
                #!/bin/sh
                case "$1" in
                  *Username*) printf '%s\n' "${GITEA_USERNAME:?}" ;;
                  *Password*) cat /workspace/gitea-auth/token ;;
                  *) exit 1 ;;
                esac
                ASKPASS
                chmod 700 "$askpass"
                export GITEA_USERNAME=unidesk-admin GIT_ASKPASS="$askpass" GIT_ASKPASS_REQUIRE=force GIT_TERMINAL_PROMPT=0
                rm -rf source release
                git clone --filter=blob:none --no-checkout http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git source
                cd source
                git fetch --depth=1 --filter=blob:none origin "+$SOURCE_SNAPSHOT_PREFIX/$SOURCE_COMMIT:refs/remotes/origin/unidesk-source-snapshot"
                git checkout --detach "$SOURCE_COMMIT"
                test "$(git rev-parse HEAD)" = "$SOURCE_COMMIT"
                bun scripts/native/cicd/prepare-unidesk-host-release.mjs \
                  --config config/unidesk-host-k8s.yaml \
                  --source-root /workspace/source \
                  --source-commit "$SOURCE_COMMIT" \
                  --source-snapshot-prefix "$SOURCE_SNAPSHOT_PREFIX" \
                  --output-dir /workspace/release
              volumeMounts:
                - name: workspace
                  mountPath: /workspace
                - name: gitea-auth
                  mountPath: /workspace/gitea-auth
                  readOnly: true
            - name: prepare-buildkit-state
              image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
              imagePullPolicy: IfNotPresent
              script: |
                #!/bin/sh
                set -eu
                mkdir -p /home/user/.local/share/buildkit
                chown -R 1000:1000 /home/user/.local/share/buildkit
              securityContext:
                runAsUser: 0
                runAsGroup: 0
              volumeMounts:
                - name: buildkit-state
                  mountPath: /home/user/.local/share/buildkit
            - name: image-build
              image: 127.0.0.1:5000/hwlab/buildkit:rootless
              imagePullPolicy: IfNotPresent
              workingDir: /workspace
              env:
                - name: SOURCE_COMMIT
                  value: "{{revision}}"
                - name: BUILDKITD_FLAGS
                  value: --oci-worker-no-process-sandbox --oci-worker-net=host --allow-insecure-entitlement network.host
              script: |
                #!/bin/sh
                exec /workspace/source/scripts/native/cicd/build-unidesk-host-image.sh
              securityContext:
                privileged: true
                runAsUser: 1000
                runAsGroup: 1000
              volumeMounts:
                - name: workspace
                  mountPath: /workspace
                - name: buildkit-state
                  mountPath: /home/user/.local/share/buildkit
                - name: tmp
                  mountPath: /tmp
            - name: gitops-publish
              image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
              imagePullPolicy: IfNotPresent
              workingDir: /workspace
              env:
                - name: SOURCE_COMMIT
                  value: "{{revision}}"
              script: |
                #!/bin/sh
                set -eu
                askpass=/workspace/gitea-askpass.sh
                trap 'rm -f "$askpass"' EXIT
                cat >"$askpass" <<'ASKPASS'
                #!/bin/sh
                case "$1" in
                  *Username*) printf '%s\n' "${GITEA_USERNAME:?}" ;;
                  *Password*) cat /workspace/gitea-auth/token ;;
                  *) exit 1 ;;
                esac
                ASKPASS
                chmod 700 "$askpass"
                export GITEA_USERNAME=unidesk-admin GIT_ASKPASS="$askpass" GIT_ASKPASS_REQUIRE=force GIT_TERMINAL_PROMPT=0
                exec bun /workspace/source/scripts/native/cicd/publish-unidesk-host-gitops.mjs \
                  --config /workspace/source/config/unidesk-host-k8s.yaml \
                  --source-root /workspace/source \
                  --metadata /workspace/build-metadata \
                  --release-dir /workspace/release \
                  --source-commit "$SOURCE_COMMIT" \
                  --worktree /workspace/unidesk-host-gitops
              volumeMounts:
                - name: workspace
                  mountPath: /workspace
                - name: gitea-auth
                  mountPath: /workspace/gitea-auth
                  readOnly: true