From 84b5a6f912178ad96daac9d4b32fee0a53e898ee Mon Sep 17 00:00:00 2001
From: eding <edin.grech@gmail.com>
Date: Thu, 30 Jul 2026 00:48:18 +0200
Subject: [PATCH] feat: add node static image Task catalog

---
 catalog/kustomization.yaml           |   4 +
 catalog/maidn-node-static-image.yaml | 114 +++++++++++++++++++++++++++
 2 files changed, 118 insertions(+)
 create mode 100644 catalog/kustomization.yaml
 create mode 100644 catalog/maidn-node-static-image.yaml

diff --git a/catalog/kustomization.yaml b/catalog/kustomization.yaml
new file mode 100644
index 0000000..b70b0c7
--- /dev/null
+++ b/catalog/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - maidn-node-static-image.yaml
diff --git a/catalog/maidn-node-static-image.yaml b/catalog/maidn-node-static-image.yaml
new file mode 100644
index 0000000..b3027fb
--- /dev/null
+++ b/catalog/maidn-node-static-image.yaml
@@ -0,0 +1,114 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: maidn-node-static-image
+  namespace: tekton-pipelines
+spec:
+  stepTemplate:
+    env:
+      - name: HOME
+        value: /tekton/home
+    securityContext:
+      runAsNonRoot: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      seccompProfile:
+        type: RuntimeDefault
+  params:
+    - name: url
+      type: string
+    - name: revision
+      type: string
+    - name: image
+      type: string
+    - name: output-directory
+      type: string
+    - name: build-configuration
+      type: string
+      default: ci
+    - name: base-image
+      type: string
+      default: nginx:1.27-alpine
+    - name: target-directory
+      type: string
+      default: /www/target
+  workspaces:
+    - name: source
+  volumes:
+    - name: registry-credentials
+      secret:
+        secretName: forgejo-registry-credentials
+        items:
+          - key: .dockerconfigjson
+            path: config.json
+  steps:
+    - name: clone
+      image: alpine/git:2.47.2
+      env:
+        - name: REPOSITORY_URL
+          value: $(params.url)
+        - name: REVISION
+          value: $(params.revision)
+        - name: SOURCE_PATH
+          value: $(workspaces.source.path)
+      script: |
+        #!/bin/sh
+        set -eu
+        case "$REPOSITORY_URL" in https://git.pingu.pw/*) ;; *) exit 1 ;; esac
+        repository_path=${REPOSITORY_URL#https://git.pingu.pw/}
+        case "$repository_path" in *.git) ;; *) exit 1 ;; esac
+        case "$repository_path" in ''|*[!A-Za-z0-9._/-]*|/*|*//*|*..*) exit 1 ;; esac
+        case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
+        case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
+        git clone "$REPOSITORY_URL" "$SOURCE_PATH"
+        git config --global --add safe.directory "$SOURCE_PATH"
+        git -C "$SOURCE_PATH" checkout "$REVISION"
+    - name: build-layer
+      image: node:22-alpine
+      workingDir: $(workspaces.source.path)
+      env:
+        - name: IMAGE
+          value: $(params.image)
+        - name: REVISION
+          value: $(params.revision)
+        - name: OUTPUT_DIRECTORY
+          value: $(params.output-directory)
+        - name: TARGET_DIRECTORY
+          value: $(params.target-directory)
+        - name: BUILD_CONFIGURATION
+          value: $(params.build-configuration)
+      script: |
+        #!/bin/sh
+        set -eu
+        case "$IMAGE" in git.pingu.pw/*) ;; *) exit 1 ;; esac
+        image_path=${IMAGE#git.pingu.pw/}
+        case "$image_path" in ''|*[!A-Za-z0-9._/-]*|/*|*//*|*..*|*/) exit 1 ;; esac
+        case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
+        case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
+        case "$OUTPUT_DIRECTORY" in ''|/*|-*|*[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
+        case "$TARGET_DIRECTORY" in /*) ;; *) exit 1 ;; esac
+        target_path=${TARGET_DIRECTORY#/}
+        case "$target_path" in ''|-*|*[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
+        # ponytail: no lockfile; skip install scripts and use npm ci when package-lock.json is committed.
+        npm install --ignore-scripts --no-audit --no-fund --package-lock=false
+        npm run build -- --configuration "$BUILD_CONFIGURATION"
+        test -d "$OUTPUT_DIRECTORY"
+        layer_dir=$(mktemp -d)
+        trap 'rm -rf "$layer_dir"' EXIT
+        mkdir -p "$layer_dir/$target_path"
+        cp -R "$OUTPUT_DIRECTORY"/. "$layer_dir/$target_path/"
+        tar -C "$layer_dir" -cf layer.tar "$target_path"
+    - name: push
+      image: gcr.io/go-containerregistry/crane:v0.21.7
+      args:
+        - append
+        - --base=$(params.base-image)
+        - --new_layer=$(workspaces.source.path)/layer.tar
+        - --new_tag=$(params.image):$(params.revision)
+      volumeMounts:
+        - name: registry-credentials
+          mountPath: /tekton/home/.docker