137 lines
4.2 KiB
YAML
137 lines
4.2 KiB
YAML
apiVersion: tekton.dev/v1
|
|
kind: Task
|
|
metadata:
|
|
name: maidn-node-runtime-image
|
|
namespace: tekton-pipelines
|
|
spec:
|
|
params:
|
|
- name: url
|
|
type: string
|
|
- name: revision
|
|
type: string
|
|
- name: image
|
|
type: string
|
|
volumes:
|
|
- name: work
|
|
emptyDir: {}
|
|
- name: git-credentials
|
|
secret:
|
|
secretName: forgejo-git-credentials
|
|
- name: registry-credentials
|
|
secret:
|
|
secretName: forgejo-registry-credentials
|
|
items:
|
|
- key: .dockerconfigjson
|
|
path: config.json
|
|
stepTemplate:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
steps:
|
|
- name: clone
|
|
image: alpine/git:2.47.2
|
|
env:
|
|
- name: REPOSITORY_URL
|
|
value: $(params.url)
|
|
- name: REVISION
|
|
value: $(params.revision)
|
|
- name: IMAGE
|
|
value: $(params.image)
|
|
volumeMounts:
|
|
- name: work
|
|
mountPath: /work
|
|
- name: git-credentials
|
|
mountPath: /credentials
|
|
readOnly: true
|
|
script: |
|
|
#!/bin/sh
|
|
set -eu
|
|
case "$REPOSITORY_URL" in https://git.pingu.pw/*) ;; *) exit 1 ;; esac
|
|
repository_path=${REPOSITORY_URL#https://git.pingu.pw/}
|
|
case "$repository_path" in [A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*.git) ;; *) exit 1 ;; esac
|
|
case "$repository_path" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/|*/*/*) exit 1 ;; esac
|
|
case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
|
|
case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
|
|
case "$IMAGE" in git.pingu.pw/*) ;; *) exit 1 ;; esac
|
|
image_path=${IMAGE#git.pingu.pw/}
|
|
case "$image_path" in [A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*) ;; *) exit 1 ;; esac
|
|
case "$image_path" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/|*/*/*) exit 1 ;; esac
|
|
cat >/work/askpass <<'EOF'
|
|
#!/bin/sh
|
|
case "$1" in *Username*) cat /credentials/username ;; *) cat /credentials/password ;; esac
|
|
EOF
|
|
chmod 0700 /work/askpass
|
|
GIT_ASKPASS=/work/askpass GIT_TERMINAL_PROMPT=0 git clone "$REPOSITORY_URL" /work/source
|
|
git -C /work/source checkout "$REVISION"
|
|
rm -f /work/askpass
|
|
- name: build-layer
|
|
image: node:22-alpine
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- name: work
|
|
mountPath: /work
|
|
script: |
|
|
#!/bin/sh
|
|
set -eu
|
|
cd /work/source
|
|
npm install --ignore-scripts --no-audit --no-fund --package-lock=false
|
|
npm run build
|
|
npm prune --omit=dev --ignore-scripts --no-audit --no-fund
|
|
test -f package.json
|
|
test -d node_modules
|
|
test -d dist
|
|
mkdir -p /work/layer/app
|
|
cp package.json /work/layer/app/
|
|
cp -R node_modules dist /work/layer/app/
|
|
tar -C /work/layer -cf /work/layer.tar app
|
|
rm -rf /work/source /work/layer
|
|
- name: append
|
|
image: gcr.io/go-containerregistry/crane:v0.21.7
|
|
env:
|
|
- name: HOME
|
|
value: /tekton/home
|
|
- name: DOCKER_CONFIG
|
|
value: /tekton/home/.docker
|
|
args:
|
|
- append
|
|
- --base=node:22-alpine
|
|
- --new_layer=/work/layer.tar
|
|
- --new_tag=$(params.image):$(params.revision)
|
|
volumeMounts:
|
|
- name: work
|
|
mountPath: /work
|
|
- name: registry-credentials
|
|
mountPath: /tekton/home/.docker
|
|
readOnly: true
|
|
- name: mutate
|
|
image: gcr.io/go-containerregistry/crane:v0.21.7
|
|
env:
|
|
- name: HOME
|
|
value: /tekton/home
|
|
- name: DOCKER_CONFIG
|
|
value: /tekton/home/.docker
|
|
args:
|
|
- mutate
|
|
- $(params.image):$(params.revision)
|
|
- --entrypoint=node
|
|
- --cmd=dist/index.js
|
|
- --workdir=/app
|
|
- --user=node
|
|
- --env=PORT=8080
|
|
- --exposed-ports=8080/tcp
|
|
- --tag=$(params.image):$(params.revision)
|
|
volumeMounts:
|
|
- name: registry-credentials
|
|
mountPath: /tekton/home/.docker
|
|
readOnly: true
|