apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: {{ .AppName }}-update-manifest
  namespace: tekton-pipelines
spec:
  stepTemplate:
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      allowPrivilegeEscalation: false
      capabilities:
        drop: [ALL]
      seccompProfile:
        type: RuntimeDefault
  params:
    - name: manifests-url
    - name: manifests-branch
    - name: app-name
    - name: app-repository
    - name: image
    - name: tag
    - name: environment
    - name: pr-number
      default: ""
    - name: app-url
      default: ""
    - name: app-revision
      default: ""
  steps:
    - name: update
      image: alpine/git:2.47.2
      env:
        - name: MANIFESTS_URL
          value: $(params.manifests-url)
        - name: MANIFESTS_BRANCH
          value: $(params.manifests-branch)
        - name: APP_NAME
          value: $(params.app-name)
        - name: APP_REPOSITORY
          value: $(params.app-repository)
        - name: IMAGE
          value: $(params.image)
        - name: TAG
          value: $(params.tag)
        - name: ENVIRONMENT
          value: $(params.environment)
        - name: PR_NUMBER
          value: $(params.pr-number)
        - name: APP_URL
          value: $(params.app-url)
        - name: APP_REVISION
          value: $(params.app-revision)
      script: |
        #!/bin/sh
        set -eu
        fail() { exit 1; }
        valid_name() { case "$1" in ''|*[!a-z0-9-]*|-*|*-) fail ;; esac; }
        valid_revision() { case "$1" in [A-Za-z0-9]*) ;; *) fail ;; esac; case "$1" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) fail ;; esac; }
        valid_commit() { [ "${#1}" -eq 40 ] || fail; case "$1" in *[!0-9a-fA-F]*) fail ;; esac; }
        valid_url() { case "$1" in https://*/*.git) ;; *) fail ;; esac; case "$1" in *[@?#]*) fail ;; esac; }
        valid_repository() { case "$1" in */*) ;; *) fail ;; esac; case "$1" in *..*|*//*|/*|*/) fail ;; esac; }
        valid_pr_number() { case "$1" in [1-9]*) ;; *) fail ;; esac; case "$1" in *[!0-9]*) fail ;; esac; [ $((${#APP_NAME} + ${#1} + 4)) -le 63 ] || fail; }
        valid_name "$APP_NAME"
        valid_url "$MANIFESTS_URL"
        valid_revision "$MANIFESTS_BRANCH"
        valid_repository "$APP_REPOSITORY"
        valid_commit "$TAG"
        git clone --branch "$MANIFESTS_BRANCH" "$MANIFESTS_URL" /tmp/manifests
        cd /tmp/manifests
        if [ "$ENVIRONMENT" = preview ]; then
          valid_pr_number "$PR_NUMBER"
          valid_url "$APP_URL"
          valid_revision "$APP_REVISION"
          app_dir="apps/previews/$APP_NAME-pr-$PR_NUMBER"
          marker="$app_dir/ownership.yaml"
          if [ -e "$app_dir" ]; then
            [ -d "$app_dir" ] && [ ! -L "$app_dir" ] && [ -f "$marker" ] && [ ! -L "$marker" ] || fail
            expected_marker=$(mktemp)
            trap 'rm -f "$expected_marker"' EXIT
            cat > "$expected_marker" <<EOF
        apiVersion: v1
        kind: ConfigMap
        metadata:
          name: maidn-preview-owner
          namespace: $APP_NAME-pr-$PR_NUMBER
          labels:
            maidn.io/preview-owner: "true"
            maidn.io/preview-app: "$APP_NAME"
            maidn.io/preview-pr: "$PR_NUMBER"
          annotations:
            maidn.io/preview-repository: "$APP_REPOSITORY"
        data:
          app: "$APP_NAME"
          repository: "$APP_REPOSITORY"
          pr-number: "$PR_NUMBER"
        EOF
            cmp -s "$expected_marker" "$marker" || fail
          fi
          git clone "$APP_URL" /tmp/app
          git -C /tmp/app checkout "$APP_REVISION"
          [ -f /tmp/app/preview/values.yaml ] || fail
          mkdir -p "$app_dir"
          cp /tmp/app/preview/values.yaml "$app_dir/values.yaml"
          sed -i "s/PLACEHOLDER_PR/$PR_NUMBER/g" "$app_dir/values.yaml"
          cat > "$marker" <<EOF
        apiVersion: v1
        kind: ConfigMap
        metadata:
          name: maidn-preview-owner
          namespace: $APP_NAME-pr-$PR_NUMBER
          labels:
            maidn.io/preview-owner: "true"
            maidn.io/preview-app: "$APP_NAME"
            maidn.io/preview-pr: "$PR_NUMBER"
          annotations:
            maidn.io/preview-repository: "$APP_REPOSITORY"
        data:
          app: "$APP_NAME"
          repository: "$APP_REPOSITORY"
          pr-number: "$PR_NUMBER"
        EOF
          cat > "$app_dir/namespace.yaml" <<EOF
        apiVersion: v1
        kind: Namespace
        metadata:
          name: $APP_NAME-pr-$PR_NUMBER
        EOF
          cat > "$app_dir/release.yaml" <<EOF
        apiVersion: helm.toolkit.fluxcd.io/v2
        kind: HelmRelease
        metadata:
          name: $APP_NAME
          namespace: $APP_NAME-pr-$PR_NUMBER
        spec:
          interval: 5m
          chart:
            spec:
              chart: ./charts/$APP_NAME
              sourceRef:
                kind: GitRepository
                name: $APP_NAME
                namespace: flux-system
          values:
            image:
              repository: $IMAGE
              tag: $TAG
        EOF
          cat > "$app_dir/kustomization.yaml" <<EOF
        apiVersion: kustomize.config.k8s.io/v1beta1
        kind: Kustomization
        namespace: $APP_NAME-pr-$PR_NUMBER
        resources:
          - namespace.yaml
          - ownership.yaml
          - release.yaml
        EOF
          root=apps/previews/kustomization.yaml
          grep -q '^resources:' "$root" || fail
          grep -qxF "  - $APP_NAME-pr-$PR_NUMBER" "$root" 2>/dev/null || printf '  - %s-pr-%s\n' "$APP_NAME" "$PR_NUMBER" >> "$root"
        elif [ "$ENVIRONMENT" = staging ] || [ "$ENVIRONMENT" = production ]; then
          app_dir="apps/$ENVIRONMENT/$APP_NAME"
          [ -f "$app_dir/release.yaml" ] || fail
          sed -i -E "s|^([[:space:]]*tag:).*|\1 $TAG|" "$app_dir/release.yaml"
        else
          fail
        fi
        git config user.name Maidn
        git config user.email maidn@free-maidn.com
        git add apps
        git diff --cached --quiet || git commit -m "chore: deploy $APP_NAME $TAG"
        git push origin "$MANIFESTS_BRANCH"
---
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: {{ .AppName }}
  namespace: tekton-pipelines
spec:
  params:
    - name: git-url
      default: {{ quote .AppRepoURL }}
    - name: git-revision
      default: {{ quote .AppRepoRef }}
    - name: branch
      default: {{ quote .AppRepoRef }}
    - name: event-type
      default: push
    - name: event-action
      default: ""
    - name: pr-number
      default: ""
    - name: image
      default: {{ quote .ImageRepository }}
    - name: manifests-url
      default: {{ quote .ManifestsURL }}
    - name: manifests-branch
      default: {{ quote .ManifestsBranch }}
  workspaces:
    - name: source
  taskRunTemplate:
    serviceAccountName: tekton-delivery
  tasks:
    - name: build-and-push
      when:
        - input: $(params.event-action)
          operator: notin
          values: [closed]
      taskRef:
        name: maidn-node-static-image
      params:
        - name: url
          value: {{ quote .AppRepoURL }}
        - name: revision
          value: $(params.git-revision)
        - name: image
          value: $(params.image)
        - name: output-directory
          value: {{ quote .BuildOutputDirectory }}
        - name: build-configuration
          value: {{ quote .BuildConfiguration }}
      workspaces:
        - name: source
          workspace: source
    - name: update-preview
      runAfter: [build-and-push]
      when:
        - input: $(params.event-type)
          operator: in
          values: [pull_request]
        - input: $(params.event-action)
          operator: in
          values: [opened, reopened, synchronize]
      taskRef:
        name: {{ .AppName }}-update-manifest
      params:
        - name: manifests-url
          value: $(params.manifests-url)
        - name: manifests-branch
          value: $(params.manifests-branch)
        - name: app-name
          value: {{ quote .AppName }}
        - name: app-repository
          value: {{ quote .AppRepository }}
        - name: image
          value: $(params.image)
        - name: tag
          value: $(params.git-revision)
        - name: environment
          value: preview
        - name: pr-number
          value: $(params.pr-number)
        - name: app-url
          value: {{ quote .AppRepoURL }}
        - name: app-revision
          value: $(params.git-revision)
    - name: update-staging
      runAfter: [build-and-push]
      when:
        - input: $(params.event-type)
          operator: in
          values: [push]
        - input: $(params.branch)
          operator: in
          values: [{{ quote .AppRepoRef }}]
      taskRef:
        name: {{ .AppName }}-update-manifest
      params:
        - name: manifests-url
          value: $(params.manifests-url)
        - name: manifests-branch
          value: $(params.manifests-branch)
        - name: app-name
          value: {{ quote .AppName }}
        - name: app-repository
          value: {{ quote .AppRepository }}
        - name: image
          value: $(params.image)
        - name: tag
          value: $(params.git-revision)
        - name: environment
          value: staging
    - name: promote-production
      runAfter: [build-and-push]
      when:
        - input: $(params.event-type)
          operator: in
          values: [promotion]
        - input: $(params.branch)
          operator: in
          values: [{{ quote .ProductionBranch }}]
      taskRef:
        name: {{ .AppName }}-update-manifest
      params:
        - name: manifests-url
          value: $(params.manifests-url)
        - name: manifests-branch
          value: $(params.manifests-branch)
        - name: app-name
          value: {{ quote .AppName }}
        - name: app-repository
          value: {{ quote .AppRepository }}
        - name: image
          value: $(params.image)
        - name: tag
          value: $(params.git-revision)
        - name: environment
          value: production
    - name: cleanup-preview
      when:
        - input: $(params.event-type)
          operator: in
          values: [pull_request]
        - input: $(params.event-action)
          operator: in
          values: [closed]
      taskRef:
        name: maidn-preview-orphan-reconciler
      params:
        - name: app-name
          value: {{ quote .AppName }}
        - name: pr-number
          value: $(params.pr-number)
        - name: app-repository
          value: {{ quote .AppRepository }}