pikasTech-unidesk/.tekton/web-probe-sentinel-nc01-pac.yaml

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  generateName: hwlab-web-probe-sentinel-nc01-
  annotations:
    pipelinesascode.tekton.dev/on-event: "[push]"
    pipelinesascode.tekton.dev/on-target-branch: "[master]"
    pipelinesascode.tekton.dev/on-cel-expression: "event == 'push' && target_branch == 'master' && node == 'NC01'"
  labels:
    app.kubernetes.io/name: hwlab-web-probe-sentinel-nc01-pac
    app.kubernetes.io/part-of: hwlab-web-probe-sentinel
    unidesk.ai/source-commit: "{{revision}}"
    hwlab.pikastech.local/source-commit: "{{revision}}"
spec:
  timeouts:
    pipeline: 900s
  taskRunTemplate:
    serviceAccountName: default
    podTemplate:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      securityContext:
        fsGroup: 1000
  pipelineSpec:
    tasks:
      - name: publish
        taskSpec:
          volumes:
            - name: gitea-auth
              secret:
                secretName: "{{gitops_secret_name}}"
                items:
                  - key: token
                    path: token
            - name: workspace
              emptyDir:
                sizeLimit: 8Gi
            - name: buildkit-state
              hostPath:
                path: /var/lib/unidesk/web-probe-sentinel/buildkit-nc01
                type: DirectoryOrCreate
            - name: tmp
              emptyDir: {}
          steps:
            - name: source
              image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
              imagePullPolicy: IfNotPresent
              env:
                - name: OTEL_EXPORTER_OTLP_TRACES_ENDPOINT
                  value: "{{otel_traces_endpoint}}"
                - name: OTEL_EXPORTER_TIMEOUT_MS
                  value: "{{otel_exporter_timeout_ms}}"
                - name: OTEL_SERVICE_NAME
                  value: "{{otel_service_name}}"
                - name: OTEL_TRACES_SAMPLER_ARG
                  value: "{{otel_sampling_ratio}}"
              script: |
                #!/bin/sh
                set -eu
                export CICD_TRACE_STARTED_AT_MS=$(($(date +%s) * 1000))
                export TRACEPARENT=$(node -e 'const c=require("node:crypto");process.stdout.write(`00-${c.randomBytes(16).toString("hex")}-${c.randomBytes(8).toString("hex")}-01`)')
                rm -rf /workspace/bootstrap /workspace/generated
                git clone --filter=blob:none --no-checkout http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git /workspace/bootstrap
                cd /workspace/bootstrap
                git fetch --depth=1 --filter=blob:none origin "+refs/unidesk/snapshots/gitea-actions/unidesk-master-nc01/{{revision}}:refs/remotes/origin/unidesk-source-snapshot"
                git checkout --detach "{{revision}}"
                bun scripts/native/cicd/render-sentinel-publish-task.ts \
                  --node NC01 \
                  --lane v03 \
                  --repository-id sentinel-nc01-v03 \
                  --sentinel nc01-web-probe-sentinel \
                  --pipeline-run "$(context.pipelineRun.name)" \
                  --source-commit "{{revision}}" \
                  --source-stage-ref "refs/unidesk/snapshots/gitea-actions/unidesk-master-nc01/{{revision}}" \
                  --source-authority gitea-snapshot \
                  --output-dir /workspace/generated
                exec /workspace/generated/source.sh
              volumeMounts:
                - name: workspace
                  mountPath: /workspace
            - name: prepare-buildkit-state
              image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
              imagePullPolicy: IfNotPresent
              script: |
                #!/bin/sh
                set -eu
                mkdir -p /home/user/.local/share/buildkit
                chown -R 1000:1000 /home/user/.local/share/buildkit
              securityContext:
                runAsUser: 0
                runAsGroup: 0
              volumeMounts:
                - name: buildkit-state
                  mountPath: /home/user/.local/share/buildkit
            - name: image-build
              image: 127.0.0.1:5000/hwlab/buildkit:rootless
              imagePullPolicy: IfNotPresent
              env:
                - name: BUILDKITD_FLAGS
                  value: --oci-worker-no-process-sandbox --oci-worker-net=host --allow-insecure-entitlement network.host
              script: |
                #!/bin/sh
                exec /workspace/generated/image-build.sh
              securityContext:
                privileged: true
                runAsUser: 1000
                runAsGroup: 1000
              volumeMounts:
                - name: workspace
                  mountPath: /workspace
                - name: buildkit-state
                  mountPath: /home/user/.local/share/buildkit
                - name: tmp
                  mountPath: /tmp
            - name: publish
              image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
              imagePullPolicy: IfNotPresent
              env:
                - name: GITOPS_READ_URL
                  value: "{{gitops_read_url}}"
                - name: GITOPS_USERNAME
                  value: "{{gitops_username}}"
              script: |
                #!/bin/sh
                exec /workspace/generated/publish.sh
              volumeMounts:
                - name: workspace
                  mountPath: /workspace
                - name: gitea-auth
                  mountPath: /workspace/gitea-auth
                  readOnly: true