120 lines
3.5 KiB
YAML
120 lines
3.5 KiB
YAML
apiVersion: tekton.dev/v1
|
|
kind: Task
|
|
metadata:
|
|
name: maidn-node-static-image
|
|
namespace: tekton-pipelines
|
|
spec:
|
|
params:
|
|
- name: url
|
|
type: string
|
|
- name: revision
|
|
type: string
|
|
- name: image
|
|
type: string
|
|
- name: output-directory
|
|
type: string
|
|
- name: build-configuration
|
|
type: string
|
|
default: ci
|
|
- name: base-image
|
|
type: string
|
|
default: nginx:1.27-alpine
|
|
volumes:
|
|
- name: work
|
|
emptyDir: {}
|
|
- name: git-credentials
|
|
secret:
|
|
secretName: forgejo-git-credentials
|
|
- name: registry-credentials
|
|
secret:
|
|
secretName: forgejo-registry-credentials
|
|
items:
|
|
- key: .dockerconfigjson
|
|
path: config.json
|
|
stepTemplate:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
steps:
|
|
- name: clone
|
|
image: alpine/git:2.47.2
|
|
env:
|
|
- name: REPOSITORY_URL
|
|
value: $(params.url)
|
|
- name: REVISION
|
|
value: $(params.revision)
|
|
volumeMounts:
|
|
- name: work
|
|
mountPath: /work
|
|
- name: git-credentials
|
|
mountPath: /credentials
|
|
readOnly: true
|
|
script: |
|
|
#!/bin/sh
|
|
set -eu
|
|
case "$REPOSITORY_URL" in https://git.pingu.pw/*.git) ;; *) exit 1 ;; esac
|
|
case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
|
|
case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
|
|
cat >/work/askpass <<'EOF'
|
|
#!/bin/sh
|
|
case "$1" in *Username*) cat /credentials/username ;; *) cat /credentials/password ;; esac
|
|
EOF
|
|
chmod 0700 /work/askpass
|
|
GIT_ASKPASS=/work/askpass GIT_TERMINAL_PROMPT=0 git clone "$REPOSITORY_URL" /work/source
|
|
git -C /work/source checkout "$REVISION"
|
|
rm -f /work/askpass
|
|
- name: build-layer
|
|
image: node:22-alpine
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
env:
|
|
- name: NODE_OPTIONS
|
|
value: --max-old-space-size=384
|
|
- name: OUTPUT_DIRECTORY
|
|
value: $(params.output-directory)
|
|
- name: BUILD_CONFIGURATION
|
|
value: $(params.build-configuration)
|
|
volumeMounts:
|
|
- name: work
|
|
mountPath: /work
|
|
script: |
|
|
#!/bin/sh
|
|
set -eu
|
|
case "$OUTPUT_DIRECTORY" in ''|/*|-*|*[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
|
|
case "$BUILD_CONFIGURATION" in ''|-*|*[!A-Za-z0-9._-]*) exit 1 ;; esac
|
|
cd /work/source
|
|
npm install --ignore-scripts --no-audit --no-fund --package-lock=false
|
|
npm run build -- --configuration "$BUILD_CONFIGURATION"
|
|
test -d "$OUTPUT_DIRECTORY"
|
|
mkdir -p /work/layer/www
|
|
cp -R "$OUTPUT_DIRECTORY"/. /work/layer/www/
|
|
tar -C /work/layer -cf /work/layer.tar www
|
|
rm -rf /work/source /work/layer
|
|
- name: push
|
|
image: gcr.io/go-containerregistry/crane:v0.21.7
|
|
env:
|
|
- name: HOME
|
|
value: /tekton/home
|
|
- name: DOCKER_CONFIG
|
|
value: /tekton/home/.docker
|
|
args:
|
|
- append
|
|
- --base=$(params.base-image)
|
|
- --new_layer=/work/layer.tar
|
|
- --new_tag=$(params.image):$(params.revision)
|
|
volumeMounts:
|
|
- name: work
|
|
mountPath: /work
|
|
- name: registry-credentials
|
|
mountPath: /tekton/home/.docker
|
|
readOnly: true
|