apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: maidn-node-runtime-image
  namespace: tekton-pipelines
spec:
  params:
    - name: url
      type: string
    - name: revision
      type: string
    - name: image
      type: string
  volumes:
    - name: work
      emptyDir: {}
    - name: git-credentials
      secret:
        secretName: forgejo-git-credentials
    - name: registry-credentials
      secret:
        secretName: forgejo-registry-credentials
        items:
          - key: .dockerconfigjson
            path: config.json
  stepTemplate:
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      allowPrivilegeEscalation: false
      capabilities:
        drop: [ALL]
      seccompProfile:
        type: RuntimeDefault
  steps:
    - name: clone
      image: alpine/git:2.47.2
      env:
        - name: REPOSITORY_URL
          value: $(params.url)
        - name: REVISION
          value: $(params.revision)
        - name: IMAGE
          value: $(params.image)
      volumeMounts:
        - name: work
          mountPath: /work
        - name: git-credentials
          mountPath: /credentials
          readOnly: true
      script: |
        #!/bin/sh
        set -eu
        case "$REPOSITORY_URL" in https://git.pingu.pw/*) ;; *) exit 1 ;; esac
        repository_path=${REPOSITORY_URL#https://git.pingu.pw/}
        case "$repository_path" in [A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*.git) ;; *) exit 1 ;; esac
        case "$repository_path" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/|*/*/*) exit 1 ;; esac
        case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
        case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
        case "$IMAGE" in git.pingu.pw/*) ;; *) exit 1 ;; esac
        image_path=${IMAGE#git.pingu.pw/}
        case "$image_path" in [A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*) ;; *) exit 1 ;; esac
        case "$image_path" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/|*/*/*) exit 1 ;; esac
        cat >/work/askpass <<'EOF'
        #!/bin/sh
        case "$1" in *Username*) cat /credentials/username ;; *) cat /credentials/password ;; esac
        EOF
        chmod 0700 /work/askpass
        GIT_ASKPASS=/work/askpass GIT_TERMINAL_PROMPT=0 git clone "$REPOSITORY_URL" /work/source
        git -C /work/source checkout "$REVISION"
        rm -f /work/askpass
    - name: build-layer
      image: node:22-alpine
      computeResources:
        requests:
          memory: 256Mi
        limits:
          memory: 512Mi
      volumeMounts:
        - name: work
          mountPath: /work
      script: |
        #!/bin/sh
        set -eu
        cd /work/source
        npm install --ignore-scripts --no-audit --no-fund --package-lock=false
        npm run build
        npm prune --omit=dev --ignore-scripts --no-audit --no-fund
        test -f package.json
        test -d node_modules
        test -d dist
        mkdir -p /work/layer/app
        cp package.json /work/layer/app/
        cp -R node_modules dist /work/layer/app/
        tar -C /work/layer -cf /work/layer.tar app
        rm -rf /work/source /work/layer
    - name: append
      image: gcr.io/go-containerregistry/crane:v0.21.7
      env:
        - name: HOME
          value: /tekton/home
        - name: DOCKER_CONFIG
          value: /tekton/home/.docker
      args:
        - append
        - --base=node:22-alpine
        - --new_layer=/work/layer.tar
        - --new_tag=$(params.image):$(params.revision)
      volumeMounts:
        - name: work
          mountPath: /work
        - name: registry-credentials
          mountPath: /tekton/home/.docker
          readOnly: true
    - name: mutate
      image: gcr.io/go-containerregistry/crane:v0.21.7
      env:
        - name: HOME
          value: /tekton/home
        - name: DOCKER_CONFIG
          value: /tekton/home/.docker
      args:
        - mutate
        - $(params.image):$(params.revision)
        - --entrypoint=node
        - --cmd=dist/index.js
        - --workdir=/app
        - --user=node
        - --env=PORT=8080
        - --exposed-ports=8080/tcp
        - --tag=$(params.image):$(params.revision)
      volumeMounts:
        - name: registry-credentials
          mountPath: /tekton/home/.docker
          readOnly: true