265 lines
9 KiB
Go
265 lines
9 KiB
Go
package bootstrap
|
|
|
|
import (
|
|
"bytes"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
"github.com/Pingu-Studio/MaidnCLI/internal/config"
|
|
"github.com/Pingu-Studio/MaidnCLI/internal/forgejo"
|
|
"gopkg.in/yaml.v3"
|
|
)
|
|
|
|
// OnboardApp imports one clean checkout into the configured Forgejo owner,
|
|
// publishes its delivery branch, registers it with Flux, then adds its webhook.
|
|
func OnboardApp(cfg config.Config, sourceDir string) error {
|
|
resolved, err := config.ResolveAppOnboarding(cfg)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := forgejo.EnsureCleanCheckout(sourceDir); err != nil {
|
|
return err
|
|
}
|
|
branch, err := forgejo.CurrentBranch(sourceDir)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if branch != resolved.Delivery.AppRepoRef {
|
|
return errors.New("--from branch must match delivery appRepoRef")
|
|
}
|
|
owner, repository, err := forgejo.RepositoryFromURL(resolved.Delivery.AppRepoURL)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if owner != resolved.Git.Owner {
|
|
return errors.New("delivery appRepoUrl owner must match git owner for app onboarding")
|
|
}
|
|
deliveryBranch, err := forgejo.DeliveryBranch(resolved.Delivery.AppName, resolved.Delivery.AppRepoRef)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
manager := forgejo.NewRepoManager(resolved.Git.BaseURL, resolved.Git.Token, resolved.Git.Owner, resolved.Git.Username, "", "", resolved.Delivery.AppRepoRef, "")
|
|
if _, err := manager.EnsureRepository(repository, "Application source for Maidn CI/CD delivery"); err != nil {
|
|
return err
|
|
}
|
|
if err := manager.EnsureProtectedBranch(repository, resolved.Delivery.ProductionBranch); err != nil {
|
|
return fmt.Errorf("protect Forgejo production branch: %w", err)
|
|
}
|
|
if err := manager.PushRef(sourceDir, resolved.Delivery.AppRepoURL, branch, branch); err != nil {
|
|
return err
|
|
}
|
|
changed, err := manager.PublishDeliveryBranch(sourceDir, branch, resolved.Delivery.AppRepoURL, deliveryBranch, func(dir string) error {
|
|
return GenerateAppDelivery(dir, resolved)
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if changed {
|
|
if err := manager.EnsurePullRequest(repository, "feat: migrate delivery to Tekton", deliveryBranch, resolved.Delivery.AppRepoRef); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if open, err := manager.HasOpenPullRequest(repository, deliveryBranch); err != nil {
|
|
return err
|
|
} else if open {
|
|
if err := manager.MergePullRequest(repository, deliveryBranch); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
registrationBranch := "maidn/register-" + resolved.Delivery.AppName
|
|
if _, err := manager.PublishRepositoryPullRequest(resolved.Flux.RepoName, "feat: register "+resolved.Delivery.AppName+" delivery", registrationBranch, resolved.Flux.Branch, func(dir string) error {
|
|
return RegisterAppInCluster(dir, resolved)
|
|
}); err != nil {
|
|
return fmt.Errorf("register app in cluster repository: %w", err)
|
|
}
|
|
secrets, err := ReadOperationalSecrets(resolved.SOPS.OperationalSecretsPath, resolved.SOPS.AgeKeyPath)
|
|
if err != nil {
|
|
return fmt.Errorf("read encrypted webhook authorization: %w", err)
|
|
}
|
|
authorization := secrets["cicd/forgejo-webhook"]["authorization"]
|
|
if authorization == "" {
|
|
return errors.New("operational SOPS secrets requires cicd/forgejo-webhook.authorization")
|
|
}
|
|
generatedDir := filepath.Join(resolved.Git.CloneParent, resolved.Talos.RepoDirName, resolved.Talos.GeneratedDir)
|
|
if err := waitForWebhookTargets(generatedDir, resolved, authorization); err != nil {
|
|
return err
|
|
}
|
|
webhookURL := "https://tekton." + resolved.Flux.ClusterDomain + "/"
|
|
if err := manager.EnsureWebhook(repository, webhookURL, authorization); err != nil {
|
|
return fmt.Errorf("register Forgejo webhook: %w", err)
|
|
}
|
|
if err := manager.TriggerWebhookTest(repository, webhookURL, resolved.Delivery.AppRepoRef); err != nil {
|
|
return fmt.Errorf("trigger Forgejo webhook test: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// RegisterAppInCluster writes only the managed Flux registration for one app.
|
|
func RegisterAppInCluster(dir string, cfg config.Config) error {
|
|
content, err := renderAppRegistration(cfg)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
tektonDir := filepath.Join(dir, "base", "tekton")
|
|
rootPath := filepath.Join(tektonDir, "kustomization.yaml")
|
|
root, err := readRegularFile(rootPath)
|
|
if err != nil {
|
|
return fmt.Errorf("read Tekton Kustomization: %w", err)
|
|
}
|
|
updatedRoot, err := addKustomizationResource(root, "apps")
|
|
if err != nil {
|
|
return fmt.Errorf("Tekton Kustomization: %w", err)
|
|
}
|
|
appsDir := filepath.Join(tektonDir, "apps")
|
|
if info, statErr := os.Lstat(appsDir); statErr == nil && (info.Mode()&os.ModeSymlink != 0 || !info.IsDir()) {
|
|
return errors.New("Tekton apps path must be a directory")
|
|
} else if statErr != nil && !os.IsNotExist(statErr) {
|
|
return statErr
|
|
}
|
|
appsPath := filepath.Join(appsDir, "kustomization.yaml")
|
|
apps, err := os.ReadFile(appsPath)
|
|
if err != nil && !os.IsNotExist(err) {
|
|
return err
|
|
}
|
|
if err == nil {
|
|
if info, statErr := os.Lstat(appsPath); statErr != nil || info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
|
|
return errors.New("Tekton apps Kustomization must be a regular file")
|
|
}
|
|
} else {
|
|
apps = []byte("apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n")
|
|
}
|
|
updatedApps, err := addKustomizationResource(apps, cfg.Delivery.AppName+".yaml")
|
|
if err != nil {
|
|
return fmt.Errorf("Tekton apps Kustomization: %w", err)
|
|
}
|
|
registrationPath := filepath.Join(appsDir, cfg.Delivery.AppName+".yaml")
|
|
if existing, readErr := os.ReadFile(registrationPath); readErr == nil {
|
|
info, statErr := os.Lstat(registrationPath)
|
|
if statErr != nil || info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() || !bytes.Equal(existing, content) {
|
|
return errors.New("Tekton app registration conflicts with unmanaged content")
|
|
}
|
|
} else if !os.IsNotExist(readErr) {
|
|
return readErr
|
|
}
|
|
if err := os.MkdirAll(appsDir, 0755); err != nil {
|
|
return err
|
|
}
|
|
if err := os.WriteFile(rootPath, updatedRoot, 0644); err != nil {
|
|
return err
|
|
}
|
|
if err := os.WriteFile(appsPath, updatedApps, 0644); err != nil {
|
|
return err
|
|
}
|
|
return os.WriteFile(registrationPath, content, 0644)
|
|
}
|
|
|
|
func renderAppRegistration(cfg config.Config) ([]byte, error) {
|
|
if err := config.ValidateDelivery(cfg); err != nil {
|
|
return nil, err
|
|
}
|
|
branch, err := forgejo.DeliveryBranch(cfg.Delivery.AppName, cfg.Delivery.AppRepoRef)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return []byte(fmt.Sprintf(`apiVersion: source.toolkit.fluxcd.io/v1
|
|
kind: GitRepository
|
|
metadata:
|
|
name: %s
|
|
namespace: flux-system
|
|
spec:
|
|
interval: 1m
|
|
url: %s
|
|
secretRef:
|
|
name: forgejo-flux-credentials
|
|
ref:
|
|
branch: %s
|
|
---
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: %s
|
|
namespace: flux-system
|
|
spec:
|
|
interval: 5m
|
|
path: ./.tekton
|
|
prune: true
|
|
wait: true
|
|
targetNamespace: tekton-pipelines
|
|
dependsOn:
|
|
- name: tekton-catalog
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: %s
|
|
`, cfg.Delivery.AppName, cfg.Delivery.AppRepoURL, branch, cfg.Delivery.AppName, cfg.Delivery.AppName)), nil
|
|
}
|
|
|
|
func readRegularFile(path string) ([]byte, error) {
|
|
info, err := os.Lstat(path)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
|
|
return nil, errors.New("must be a regular file")
|
|
}
|
|
return os.ReadFile(path)
|
|
}
|
|
|
|
func addKustomizationResource(content []byte, resource string) ([]byte, error) {
|
|
decoder := yaml.NewDecoder(bytes.NewReader(content))
|
|
var document yaml.Node
|
|
if err := decoder.Decode(&document); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := decoder.Decode(&yaml.Node{}); !errors.Is(err, io.EOF) {
|
|
return nil, errors.New("must contain one YAML document")
|
|
}
|
|
if document.Kind != yaml.DocumentNode || len(document.Content) != 1 || document.Content[0].Kind != yaml.MappingNode {
|
|
return nil, errors.New("must be a Kustomization mapping")
|
|
}
|
|
root := document.Content[0]
|
|
apiVersion, err := yamlMappingValue(root, "apiVersion")
|
|
if err != nil || apiVersion == nil || apiVersion.Value != "kustomize.config.k8s.io/v1beta1" {
|
|
return nil, errors.New("must be a Kustomization")
|
|
}
|
|
kind, err := yamlMappingValue(root, "kind")
|
|
if err != nil || kind == nil || kind.Value != "Kustomization" {
|
|
return nil, errors.New("must be a Kustomization")
|
|
}
|
|
resources, err := yamlMappingValue(root, "resources")
|
|
if err != nil || resources == nil {
|
|
return nil, errors.New("must define a resources list")
|
|
}
|
|
if resources.Kind == yaml.ScalarNode && resources.Tag == "!!null" {
|
|
resources.Kind, resources.Tag, resources.Value = yaml.SequenceNode, "!!seq", ""
|
|
}
|
|
if resources.Kind != yaml.SequenceNode {
|
|
return nil, errors.New("must define a resources list")
|
|
}
|
|
for _, item := range resources.Content {
|
|
if item.Kind != yaml.ScalarNode || item.Value == "" {
|
|
return nil, errors.New("resources must contain non-empty scalar values")
|
|
}
|
|
if item.Value == resource {
|
|
var rendered bytes.Buffer
|
|
encoder := yaml.NewEncoder(&rendered)
|
|
encoder.SetIndent(2)
|
|
if err := encoder.Encode(&document); err != nil {
|
|
return nil, err
|
|
}
|
|
return rendered.Bytes(), nil
|
|
}
|
|
}
|
|
resources.Content = append(resources.Content, &yaml.Node{Kind: yaml.ScalarNode, Value: resource})
|
|
var rendered bytes.Buffer
|
|
encoder := yaml.NewEncoder(&rendered)
|
|
encoder.SetIndent(2)
|
|
if err := encoder.Encode(&document); err != nil {
|
|
return nil, err
|
|
}
|
|
return rendered.Bytes(), nil
|
|
}
|