apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  generateName: hwlab-web-probe-sentinel-jd01-
  annotations:
    pipelinesascode.tekton.dev/on-event: "[push]"
    pipelinesascode.tekton.dev/on-target-branch: "[master]"
    pipelinesascode.tekton.dev/on-cel-expression: "event == 'push' && target_branch == 'master' && node == 'JD01'"
  labels:
    app.kubernetes.io/name: hwlab-web-probe-sentinel-jd01-pac
    app.kubernetes.io/part-of: hwlab-web-probe-sentinel
    unidesk.ai/source-commit: "{{revision}}"
    hwlab.pikastech.local/source-commit: "{{revision}}"
spec:
  timeouts:
    pipeline: 900s
  taskRunTemplate:
    serviceAccountName: default
    podTemplate:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      securityContext:
        fsGroup: 1000
  pipelineSpec:
    tasks:
      - name: publish
        taskSpec:
          volumes:
            - name: cache
              persistentVolumeClaim:
                claimName: hwlab-git-mirror-cache
            - name: git-ssh
              secret:
                secretName: git-mirror-github-ssh
                defaultMode: 256
            - name: workspace
              emptyDir:
                sizeLimit: 8Gi
            - name: buildkit-state
              hostPath:
                path: /var/lib/unidesk/web-probe-sentinel/buildkit-jd01
                type: DirectoryOrCreate
            - name: tmp
              emptyDir: {}
          steps:
            - name: source
              image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
              imagePullPolicy: IfNotPresent
              env:
                - name: OTEL_EXPORTER_OTLP_TRACES_ENDPOINT
                  value: "{{otel_traces_endpoint}}"
                - name: OTEL_EXPORTER_TIMEOUT_MS
                  value: "{{otel_exporter_timeout_ms}}"
                - name: OTEL_SERVICE_NAME
                  value: "{{otel_service_name}}"
                - name: OTEL_TRACES_SAMPLER_ARG
                  value: "{{otel_sampling_ratio}}"
              script: |
                #!/bin/sh
                set -eu
                export CICD_TRACE_STARTED_AT_MS=$(($(date +%s) * 1000))
                export TRACEPARENT=$(node -e 'const c=require("node:crypto");process.stdout.write(`00-${c.randomBytes(16).toString("hex")}-${c.randomBytes(8).toString("hex")}-01`)')
                rm -rf /workspace/bootstrap /workspace/generated
                git clone --filter=blob:none --no-checkout http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git /workspace/bootstrap
                cd /workspace/bootstrap
                git fetch --depth=1 --filter=blob:none origin "+refs/unidesk/snapshots/gitea-actions/unidesk-master/{{revision}}:refs/remotes/origin/unidesk-source-snapshot"
                git checkout --detach "{{revision}}"
                bun scripts/native/cicd/render-sentinel-publish-task.ts \
                  --node JD01 \
                  --lane v03 \
                  --repository-id sentinel-jd01-v03 \
                  --sentinel jd01-web-probe-sentinel \
                  --pipeline-run "$(context.pipelineRun.name)" \
                  --source-commit "{{revision}}" \
                  --source-stage-ref "refs/unidesk/snapshots/gitea-actions/unidesk-master/{{revision}}" \
                  --source-authority gitea-snapshot \
                  --output-dir /workspace/generated
                exec /workspace/generated/source.sh
              volumeMounts:
                - name: workspace
                  mountPath: /workspace
                - name: git-ssh
                  mountPath: /git-ssh
                  readOnly: true
            - name: prepare-buildkit-state
              image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
              imagePullPolicy: IfNotPresent
              script: |
                #!/bin/sh
                set -eu
                mkdir -p /home/user/.local/share/buildkit
                chown -R 1000:1000 /home/user/.local/share/buildkit
              securityContext:
                runAsUser: 0
                runAsGroup: 0
              volumeMounts:
                - name: buildkit-state
                  mountPath: /home/user/.local/share/buildkit
            - name: image-build
              image: 127.0.0.1:5000/hwlab/buildkit:rootless
              imagePullPolicy: IfNotPresent
              env:
                - name: BUILDKITD_FLAGS
                  value: --oci-worker-no-process-sandbox --oci-worker-net=host --allow-insecure-entitlement network.host
              script: |
                #!/bin/sh
                exec /workspace/generated/image-build.sh
              securityContext:
                privileged: true
                runAsUser: 1000
                runAsGroup: 1000
              volumeMounts:
                - name: workspace
                  mountPath: /workspace
                - name: buildkit-state
                  mountPath: /home/user/.local/share/buildkit
                - name: tmp
                  mountPath: /tmp
            - name: publish
              image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
              imagePullPolicy: IfNotPresent
              script: |
                #!/bin/sh
                exec /workspace/generated/publish.sh
              volumeMounts:
                - name: workspace
                  mountPath: /workspace
                - name: cache
                  mountPath: /cache
                - name: git-ssh
                  mountPath: /git-ssh
                  readOnly: true