Merge pull request 'feat: combine static clone build and push' (#4) from feat/local-static-build into fix/static-build-resource-contract

Reviewed-on: #4

catalog/kustomization.yaml

@@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - maidn-node-static-image.yaml
-  - maidn-node-runtime-image.yaml
   - maidn-preview-orphan-reconciler.yaml

catalog/maidn-node-runtime-image.yaml

@@ -1,136 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: Task
-metadata:
-  name: maidn-node-runtime-image
-  namespace: tekton-pipelines
-spec:
-  params:
-    - name: url
-      type: string
-    - name: revision
-      type: string
-    - name: image
-      type: string
-  volumes:
-    - name: work
-      emptyDir: {}
-    - name: git-credentials
-      secret:
-        secretName: forgejo-git-credentials
-    - name: registry-credentials
-      secret:
-        secretName: forgejo-registry-credentials
-        items:
-          - key: .dockerconfigjson
-            path: config.json
-  stepTemplate:
-    securityContext:
-      runAsNonRoot: true
-      runAsUser: 1000
-      runAsGroup: 1000
-      allowPrivilegeEscalation: false
-      capabilities:
-        drop: [ALL]
-      seccompProfile:
-        type: RuntimeDefault
-  steps:
-    - name: clone
-      image: alpine/git:2.47.2
-      env:
-        - name: REPOSITORY_URL
-          value: $(params.url)
-        - name: REVISION
-          value: $(params.revision)
-        - name: IMAGE
-          value: $(params.image)
-      volumeMounts:
-        - name: work
-          mountPath: /work
-        - name: git-credentials
-          mountPath: /credentials
-          readOnly: true
-      script: |
-        #!/bin/sh
-        set -eu
-        case "$REPOSITORY_URL" in https://git.pingu.pw/*) ;; *) exit 1 ;; esac
-        repository_path=${REPOSITORY_URL#https://git.pingu.pw/}
-        case "$repository_path" in [A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*.git) ;; *) exit 1 ;; esac
-        case "$repository_path" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/|*/*/*) exit 1 ;; esac
-        case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
-        case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
-        case "$IMAGE" in git.pingu.pw/*) ;; *) exit 1 ;; esac
-        image_path=${IMAGE#git.pingu.pw/}
-        case "$image_path" in [A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*) ;; *) exit 1 ;; esac
-        case "$image_path" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/|*/*/*) exit 1 ;; esac
-        cat >/work/askpass <<'EOF'
-        #!/bin/sh
-        case "$1" in *Username*) cat /credentials/username ;; *) cat /credentials/password ;; esac
-        EOF
-        chmod 0700 /work/askpass
-        GIT_ASKPASS=/work/askpass GIT_TERMINAL_PROMPT=0 git clone "$REPOSITORY_URL" /work/source
-        git -C /work/source checkout "$REVISION"
-        rm -f /work/askpass
-    - name: build-layer
-      image: node:22-alpine
-      computeResources:
-        requests:
-          memory: 256Mi
-        limits:
-          memory: 512Mi
-      volumeMounts:
-        - name: work
-          mountPath: /work
-      script: |
-        #!/bin/sh
-        set -eu
-        cd /work/source
-        npm install --ignore-scripts --no-audit --no-fund --package-lock=false
-        npm run build
-        npm prune --omit=dev --ignore-scripts --no-audit --no-fund
-        test -f package.json
-        test -d node_modules
-        test -d dist
-        mkdir -p /work/layer/app
-        cp package.json /work/layer/app/
-        cp -R node_modules dist /work/layer/app/
-        tar -C /work/layer -cf /work/layer.tar app
-        rm -rf /work/source /work/layer
-    - name: append
-      image: gcr.io/go-containerregistry/crane:v0.21.7
-      env:
-        - name: HOME
-          value: /tekton/home
-        - name: DOCKER_CONFIG
-          value: /tekton/home/.docker
-      args:
-        - append
-        - --base=node:22-alpine
-        - --new_layer=/work/layer.tar
-        - --new_tag=$(params.image):$(params.revision)
-      volumeMounts:
-        - name: work
-          mountPath: /work
-        - name: registry-credentials
-          mountPath: /tekton/home/.docker
-          readOnly: true
-    - name: mutate
-      image: gcr.io/go-containerregistry/crane:v0.21.7
-      env:
-        - name: HOME
-          value: /tekton/home
-        - name: DOCKER_CONFIG
-          value: /tekton/home/.docker
-      args:
-        - mutate
-        - $(params.image):$(params.revision)
-        - --entrypoint=node
-        - --cmd=dist/index.js
-        - --workdir=/app
-        - --user=node
-        - --env=PORT=8080
-        - --exposed-ports=8080/tcp
-        - --tag=$(params.image):$(params.revision)
-      volumeMounts:
-        - name: registry-credentials
-          mountPath: /tekton/home/.docker
-          readOnly: true

catalog/maidn-node-static-image.yaml

@@ -3,7 +3,27 @@ kind: Task
 metadata:
   name: maidn-node-static-image
   namespace: tekton-pipelines
+  annotations:
+    # MaidnCLI's generated Pipeline invokes this as task `build-and-push`.
+    maidn.io/maidncli-pipeline-task: build-and-push
+    # Required params: url, revision, image, output-directory, build-configuration.
+    # Optional params: base-image, target-directory. Required workspace: artifacts.
+    maidn.io/contract: params=url,revision,image,output-directory,build-configuration[,base-image,target-directory];workspace=artifacts
 spec:
+  stepTemplate:
+    env:
+      - name: HOME
+        value: /tekton/home
+    securityContext:
+      runAsNonRoot: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      seccompProfile:
+        type: RuntimeDefault
   params:
     - name: url
       type: string
@@ -19,10 +39,18 @@ spec:
     - name: base-image
       type: string
       default: nginx:1.27-alpine
+    - name: target-directory
+      type: string
+      default: /www/target
+  workspaces:
+    # Persistent artifact workspace: this Task writes only layer.tar here.
+    - name: artifacts
   volumes:
-    - name: work
+    - name: local-source
       emptyDir: {}
-    - name: git-credentials
+    # Do not attach this annotated Secret to the TaskRun service account: Tekton
+    # would otherwise initialize it for every step instead of clone only.
+    - name: forgejo-git-credentials
       secret:
         secretName: forgejo-git-credentials
     - name: registry-credentials
@@ -31,16 +59,6 @@ spec:
         items:
           - key: .dockerconfigjson
             path: config.json
-  stepTemplate:
-    securityContext:
-      runAsNonRoot: true
-      runAsUser: 1000
-      runAsGroup: 1000
-      allowPrivilegeEscalation: false
-      capabilities:
-        drop: [ALL]
-      seccompProfile:
-        type: RuntimeDefault
   steps:
     - name: clone
       image: alpine/git:2.47.2
@@ -49,71 +67,111 @@ spec:
           value: $(params.url)
         - name: REVISION
           value: $(params.revision)
+        - name: SOURCE_PATH
+          value: /workspace/local-source
+        - name: GIT_CREDENTIALS_PATH
+          value: /var/run/secrets/forgejo-git-credentials
       volumeMounts:
-        - name: work
-          mountPath: /work
-        - name: git-credentials
-          mountPath: /credentials
+        - name: local-source
+          mountPath: /workspace/local-source
+        - name: forgejo-git-credentials
+          mountPath: /var/run/secrets/forgejo-git-credentials
           readOnly: true
       script: |
         #!/bin/sh
         set -eu
-        case "$REPOSITORY_URL" in https://git.pingu.pw/*.git) ;; *) exit 1 ;; esac
+        case "$REPOSITORY_URL" in https://git.pingu.pw/*) ;; *) exit 1 ;; esac
+        repository_path=${REPOSITORY_URL#https://git.pingu.pw/}
+        case "$repository_path" in *.git) ;; *) exit 1 ;; esac
+        case "$repository_path" in ''|*[!A-Za-z0-9._/-]*|/*|*//*|*..*) exit 1 ;; esac
         case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
         case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
-        cat >/work/askpass <<'EOF'
+        [ -r "$GIT_CREDENTIALS_PATH/username" ] && [ -r "$GIT_CREDENTIALS_PATH/password" ] || exit 1
+        cat > /tmp/git-askpass <<'EOF'
         #!/bin/sh
-        case "$1" in *Username*) cat /credentials/username ;; *) cat /credentials/password ;; esac
+        case "$1" in
+          *Username*) cat "$GIT_CREDENTIALS_PATH/username" ;;
+          *Password*) cat "$GIT_CREDENTIALS_PATH/password" ;;
+          *) exit 1 ;;
+        esac
         EOF
-        chmod 0700 /work/askpass
-        GIT_ASKPASS=/work/askpass GIT_TERMINAL_PROMPT=0 git clone "$REPOSITORY_URL" /work/source
-        git -C /work/source checkout "$REVISION"
-        rm -f /work/askpass
+        chmod 700 /tmp/git-askpass
+        trap 'rm -f /tmp/git-askpass' EXIT
+        GIT_ASKPASS=/tmp/git-askpass GIT_TERMINAL_PROMPT=0 git clone "$REPOSITORY_URL" "$SOURCE_PATH"
+        git -c safe.directory="$SOURCE_PATH" -C "$SOURCE_PATH" checkout "$REVISION"
     - name: build-layer
       image: node:22-alpine
-      computeResources:
+      env:
+        - name: OUTPUT_DIRECTORY
+          value: $(params.output-directory)
+        - name: SOURCE_PATH
+          value: /workspace/local-source
+        - name: ARTIFACT_PATH
+          value: $(workspaces.artifacts.path)
+        - name: TARGET_DIRECTORY
+          value: $(params.target-directory)
+        - name: BUILD_CONFIGURATION
+          value: $(params.build-configuration)
+        - name: NODE_OPTIONS
+          value: --max-old-space-size=384
+      volumeMounts:
+        - name: local-source
+          mountPath: /workspace/local-source
+      resources:
         requests:
           memory: 256Mi
         limits:
           memory: 512Mi
-      env:
-        - name: NODE_OPTIONS
-          value: --max-old-space-size=384
-        - name: OUTPUT_DIRECTORY
-          value: $(params.output-directory)
-        - name: BUILD_CONFIGURATION
-          value: $(params.build-configuration)
-      volumeMounts:
-        - name: work
-          mountPath: /work
       script: |
         #!/bin/sh
         set -eu
         case "$OUTPUT_DIRECTORY" in ''|/*|-*|*[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
+        case "$TARGET_DIRECTORY" in /*) ;; *) exit 1 ;; esac
+        target_path=${TARGET_DIRECTORY#/}
+        case "$target_path" in ''|-*|*[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
         case "$BUILD_CONFIGURATION" in ''|-*|*[!A-Za-z0-9._-]*) exit 1 ;; esac
-        cd /work/source
+        build_dir=$(mktemp -d)
+        layer_dir=$(mktemp -d)
+        trap 'rm -rf "$build_dir" "$layer_dir"' EXIT
+        cp -R "$SOURCE_PATH"/. "$build_dir"
+        cd "$build_dir"
+        # ponytail: no lockfile; skip install scripts and use npm ci when package-lock.json is committed.
         npm install --ignore-scripts --no-audit --no-fund --package-lock=false
         npm run build -- --configuration "$BUILD_CONFIGURATION"
         test -d "$OUTPUT_DIRECTORY"
-        mkdir -p /work/layer/www
-        cp -R "$OUTPUT_DIRECTORY"/. /work/layer/www/
-        tar -C /work/layer -cf /work/layer.tar www
-        rm -rf /work/source /work/layer
+        mkdir -p "$layer_dir/$target_path"
+        cp -R "$OUTPUT_DIRECTORY"/. "$layer_dir/$target_path/"
+        tar -C "$layer_dir" -cf "$ARTIFACT_PATH/layer.tar" "$target_path"
+        for memory_peak_path in /sys/fs/cgroup/memory.peak /sys/fs/cgroup/memory/memory.max_usage_in_bytes; do
+          if [ -r "$memory_peak_path" ] && memory_peak=$(cat "$memory_peak_path"); then
+            case "$memory_peak" in ''|*[!0-9]*) ;; *) printf 'cgroup memory peak: %s\n' "$memory_peak"; break ;; esac
+          fi
+        done
+    - name: validate-push-inputs
+      image: alpine:3.21.3
+      env:
+        - name: IMAGE
+          value: $(params.image)
+        - name: REVISION
+          value: $(params.revision)
+        - name: BASE_IMAGE
+          value: $(params.base-image)
+      script: |
+        #!/bin/sh
+        set -eu
+        case "$IMAGE" in git.pingu.pw/*) ;; *) exit 1 ;; esac
+        image_path=${IMAGE#git.pingu.pw/}
+        case "$image_path" in ''|*[!A-Za-z0-9._/-]*|/*|*//*|*..*|*/) exit 1 ;; esac
+        case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
+        case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
+        case "$BASE_IMAGE" in ''|-*|*[!A-Za-z0-9._/@:-]*|/*|*//*|*..*) exit 1 ;; esac
     - name: push
       image: gcr.io/go-containerregistry/crane:v0.21.7
-      env:
-        - name: HOME
-          value: /tekton/home
-        - name: DOCKER_CONFIG
-          value: /tekton/home/.docker
       args:
         - append
         - --base=$(params.base-image)
-        - --new_layer=/work/layer.tar
+        - --new_layer=$(workspaces.artifacts.path)/layer.tar
         - --new_tag=$(params.image):$(params.revision)
       volumeMounts:
-        - name: work
-          mountPath: /work
         - name: registry-credentials
           mountPath: /tekton/home/.docker
-          readOnly: true

catalog/test-node-runtime-image.sh

@@ -1,53 +0,0 @@
-#!/bin/sh
-set -eu
-
-root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
-task="$root/catalog/maidn-node-runtime-image.yaml"
-
-contains() {
-  grep -qF -- "$1" "$task"
-}
-
-for value in \
-  'apiVersion: tekton.dev/v1' \
-  'kind: Task' \
-  'name: maidn-node-runtime-image' \
-  'emptyDir: {}' \
-  'forgejo-git-credentials' \
-  'forgejo-registry-credentials' \
-  'case "$REPOSITORY_URL" in https://git.pingu.pw/*)' \
-  'case "$REVISION" in [A-Za-z0-9]*)' \
-  'case "$IMAGE" in git.pingu.pw/*)' \
-  'GIT_ASKPASS=/work/askpass' \
-  'runAsNonRoot: true' \
-  'allowPrivilegeEscalation: false' \
-  'drop: [ALL]' \
-  'type: RuntimeDefault' \
-  'npm install --ignore-scripts --no-audit --no-fund --package-lock=false' \
-  'memory: 256Mi' \
-  'memory: 512Mi' \
-  'computeResources:' \
-  'npm run build' \
-  'npm prune --omit=dev --ignore-scripts --no-audit --no-fund' \
-  'cp package.json /work/layer/app/' \
-  'cp -R node_modules dist /work/layer/app/' \
-  'tar -C /work/layer -cf /work/layer.tar app' \
-  '--base=node:22-alpine' \
-  '--new_tag=$(params.image):$(params.revision)' \
-  '- mutate' \
-  '--entrypoint=node' \
-  '--cmd=dist/index.js' \
-  '--workdir=/app' \
-  '--user=node' \
-  '--env=PORT=8080' \
-  '--exposed-ports=8080/tcp' \
-  '--tag=$(params.image):$(params.revision)'; do
-  contains "$value"
-done
-
-for param in url revision image; do
-  contains "name: $param"
-done
-
-! grep -qiE 'kaniko|privileged: true' "$task"
-! grep -q '^[[:space:]]*resources:' "$task"

catalog/test-node-static-image.sh

@@ -2,41 +2,59 @@
 set -eu
 
 root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
-task="$root/catalog/maidn-node-static-image.yaml"
+catalog="$root/catalog/maidn-node-static-image.yaml"
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
 
-contains() {
-  grep -qF -- "$1" "$task"
+step() {
+  awk -v name="$1" '
+    $0 == "    - name: " name { found=1 }
+    found && $0 ~ /^    - name: / && $0 != "    - name: " name { exit }
+    found { print }
+  ' "$catalog"
 }
 
-for value in \
-  'apiVersion: tekton.dev/v1' \
-  'kind: Task' \
-  'name: maidn-node-static-image' \
-  'emptyDir: {}' \
-  'forgejo-git-credentials' \
-  'forgejo-registry-credentials' \
-  'case "$REPOSITORY_URL" in https://git.pingu.pw/*.git)' \
-  'case "$REVISION" in [A-Za-z0-9]*)' \
-  'case "$OUTPUT_DIRECTORY" in' \
-  'case "$BUILD_CONFIGURATION" in' \
-  'GIT_ASKPASS=/work/askpass' \
-  'runAsNonRoot: true' \
-  'allowPrivilegeEscalation: false' \
-  'drop: [ALL]' \
-  'type: RuntimeDefault' \
-  'npm install --ignore-scripts --no-audit --no-fund --package-lock=false' \
-  'memory: 256Mi' \
-  'memory: 512Mi' \
-  'computeResources:' \
-  'tar -C /work/layer -cf /work/layer.tar www' \
-  '--base=$(params.base-image)' \
-  '--new_tag=$(params.image):$(params.revision)'; do
-  contains "$value"
-done
+[ "$(grep -c '^apiVersion: tekton.dev/v1$' "$catalog")" -eq 1 ]
+[ "$(grep -c '^kind: Task$' "$catalog")" -eq 1 ]
+grep -qF 'runAsNonRoot: true' "$catalog"
+grep -qF 'maidn.io/maidncli-pipeline-task: build-and-push' "$catalog"
+grep -qF 'workspace=artifacts' "$catalog"
 
-for param in url revision image output-directory build-configuration base-image; do
-  contains "name: $param"
+for param in url revision image output-directory build-configuration base-image target-directory; do
+  grep -qF "    - name: $param" "$catalog"
 done
+grep -qF '    - name: artifacts' "$catalog"
+! grep -qF 'maidn-git-clone' "$catalog"
+! grep -qF 'maidn-node-static-build' "$catalog"
+! grep -qF 'maidn-node-static-push' "$catalog"
 
-! grep -qiE 'kaniko|privileged: true' "$task"
-! grep -q '^[[:space:]]*resources:' "$task"
+step clone > "$tmp/clone"
+step build-layer > "$tmp/build-layer"
+step validate-push-inputs > "$tmp/validate-push-inputs"
+step push > "$tmp/push"
+
+grep -qF 'emptyDir: {}' "$catalog"
+grep -qF 'secretName: forgejo-git-credentials' "$catalog"
+grep -qF 'mountPath: /var/run/secrets/forgejo-git-credentials' "$tmp/clone"
+grep -qF 'GIT_ASKPASS=/tmp/git-askpass GIT_TERMINAL_PROMPT=0 git clone "$REPOSITORY_URL" "$SOURCE_PATH"' "$tmp/clone"
+! grep -qF 'registry-credentials' "$tmp/clone"
+! grep -qF 'forgejo-git-credentials' "$tmp/build-layer"
+! grep -qF 'GIT_CREDENTIALS_PATH' "$tmp/build-layer"
+! grep -qF 'registry-credentials' "$tmp/build-layer"
+grep -qF 'value: --max-old-space-size=384' "$tmp/build-layer"
+grep -qF 'memory: 256Mi' "$tmp/build-layer"
+grep -qF 'memory: 512Mi' "$tmp/build-layer"
+grep -qF 'tar -C "$layer_dir" -cf "$ARTIFACT_PATH/layer.tar" "$target_path"' "$tmp/build-layer"
+grep -qF 'for memory_peak_path in /sys/fs/cgroup/memory.peak /sys/fs/cgroup/memory/memory.max_usage_in_bytes; do' "$tmp/build-layer"
+grep -qF "if [ -r \"\$memory_peak_path\" ] && memory_peak=\$(cat \"\$memory_peak_path\"); then" "$tmp/build-layer"
+grep -qF 'image: alpine:3.21.3' "$tmp/validate-push-inputs"
+grep -qF 'case "$IMAGE" in git.pingu.pw/*) ;; *) exit 1 ;; esac' "$tmp/validate-push-inputs"
+! grep -qF 'forgejo-git-credentials' "$tmp/validate-push-inputs"
+grep -qF 'image: gcr.io/go-containerregistry/crane:v0.21.7' "$tmp/push"
+grep -qF 'mountPath: /tekton/home/.docker' "$tmp/push"
+grep -qF '        - --new_layer=$(workspaces.artifacts.path)/layer.tar' "$tmp/push"
+! grep -qF 'forgejo-git-credentials' "$tmp/push"
+
+kubectl kustomize "$root/catalog" > "$tmp/catalog.yaml"
+[ "$(grep -c '^kind: Task$' "$tmp/catalog.yaml")" -eq 2 ]
+grep -qF '  name: maidn-node-static-image' "$tmp/catalog.yaml"