Increase the loop time.

Fixes #1

generic-pipelines/simple-ros-pipeline.yaml

@@ -43,5 +43,7 @@ spec:
       value: ./docker/Dockerfile
     - name: registry-login-secret-name
       value: $(params.registry-login-secret-name)
+    - name: cosign-secret-name
+      value: container-signing-secret
     taskRef:
       name: j7s-buildah

generic-tasks/j7s-buildah.yaml

@@ -16,6 +16,8 @@ spec:
     description: Path of the Containerfile relative to source.
   - name: registry-login-secret-name
     description: Name of the secret containing the credentials to push to the registry.
+  - name: cosign-secret-name
+    description: Name of the secret container the credentials for cosign.
   workspaces:
   - name: source
   steps:
@@ -23,9 +25,10 @@ spec:
     image: harbor.internal.jpace121.net/k8s/buildah:latest
     workingDir: $(workspaces.source.path)
     script: |
-      set -x
+      set -e
       # Login
       buildah login --tls-verify=false --username=$USERNAME --password=$PASSWORD $(params.registry)
+      cosign login --username=$USERNAME --password=$PASSWORD $(params.registry)
       # Build
       buildah --storage-driver=overlay bud --tls-verify=false --no-cache \
         -f $(params.containerfile)  -t $(params.name):$(params.version) .
@@ -36,6 +39,9 @@ spec:
       skopeo copy --debug --dest-tls-verify=false \
               containers-storage:localhost/$(params.name):$(params.version) \
               docker://$(params.registry)/$(params.name):latest
+
+      export COSIGN_PASSWORD=$(cat /etc/cosign-credentials/cosign.password)
+      cosign sign --tlog-upload=false --allow-insecure-registry --key /etc/cosign-credentials/cosign.key $(params.registry)/$(params.name):$(params.version)
     env:
     - name: USERNAME
       valueFrom:
@@ -50,8 +56,13 @@ spec:
     volumeMounts:
     - name: varlibcontainers
       mountPath: /var/lib/containers
+    - name: cosign-credentials
+      mountPath: /etc/cosign-credentials
     securityContext:
       privileged: true
   volumes:
   - name: varlibcontainers
-    emptyDir: {}
+    emptyDir: {}
+  - name: cosign-credentials
+    secret:
+      secretName: $(params.cosign-secret-name)

images/Dockerfile_buildah

@@ -3,4 +3,9 @@ FROM quay.io/buildah/upstream:latest
 # Add skopeo.
 RUN dnf install -y skopeo \
     --exclude container-selinux \
-    --enablerepo=updates-testing
+    --enablerepo=updates-testing
+
+# Add wget, use it to install cosign.
+RUN dnf install -y wget && \
+    wget https://github.com/sigstore/cosign/releases/download/v2.1.1/cosign-2.1.1.x86_64.rpm && \
+    rpm -ivh cosign*.rpm

images/Dockerfile_limbo_builder

@@ -0,0 +1,13 @@
+# For building limbo nightlies, including limbo-gui.
+FROM docker.io/library/fedora:latest
+
+RUN sudo dnf update -y && \
+    sudo dnf install -y nodejs yarnpkg \
+                        openssl-devel curl \
+                        just gcc openssh-clients \
+                        git
+RUN curl https://sh.rustup.rs -sSf | sh -s -- -y
+RUN /bin/bash -c "source $HOME/.cargo/env && rustup update"
+RUN /bin/bash -c "source $HOME/.cargo/env && rustup toolchain install nightly"
+RUN /bin/bash -c "source $HOME/.cargo/env && rustup default nightly"
+RUN /bin/bash -c "source $HOME/.cargo/env && cargo install wasm-pack"

j7s-os/j7s-os-buildah.yaml

@@ -14,13 +14,13 @@ spec:
     description: Registry to push to.
   - name: version
     description: Version for the image.
-  - name: registry-secret-name
+  - name: registry-login-secret-name
     description: Name of secret to get credentials for registry from.
   workspaces:
   - name: source
   steps:
   - name: build
-    image: quay.io/buildah/stable:v1.23.3
+    image: harbor.internal.jpace121.net/k8s/buildah:latest
     workingDir: $(workspaces.source.path)
     script: |
       set -x
@@ -31,8 +31,8 @@ spec:
         --build-arg commit=./$(params.commit) \
         -f ./hosting/Dockerfile -t $(params.image):$(params.version) .
       # Push
-      buildah --storage-driver=overlay push --tls-verify=false $(params.image) docker://$(params.registry)/$(params.image):$(params.version)
-      buildah --storage-driver=overlay push --tls-verify=false $(params.image) docker://$(params.registry)/$(params.image):latest
+      buildah --storage-driver=overlay push --tls-verify=false localhost/$(params.image):$(params.version) docker://$(params.registry)/$(params.image):$(params.version)
+      buildah --storage-driver=overlay push --tls-verify=false localhost/$(params.image):$(params.version) docker://$(params.registry)/$(params.image):latest
     env:
     - name: USERNAME
       valueFrom:

j7s-os/j7s-os-image-build.yaml

@@ -10,7 +10,7 @@ spec:
   results:
   - name: version-string
   steps:
-  - image: harbor.internal.jpace121.net/j7s-image-build:latest
+  - image: harbor.internal.jpace121.net/k8s/j7s-image-build:latest
     securityContext:
       privileged: true
     script: |

j7s-os/j7s-os-k8s-deploy.yaml

@@ -12,7 +12,7 @@ spec:
     - name: ssh-directory
   steps:
     - name: update-with-flux
-      image: harbor.internal.jpace121.net/gitssh:latest
+      image: harbor.internal.jpace121.net/k8s/gitssh:latest
       script: |
         #!/usr/bin/env bash
         set -x

j7s-os/j7s-os-pipeline.yaml

@@ -0,0 +1,81 @@
+# A pipeline to build j7s-os images.
+# Steps:
+#   Clone the j7s-os repo from onedev.
+#   Call make <> in the repo.
+#   Build and push a new deployment container.
+#   Deploy the deployment container as a service.
+---
+apiVersion: tekton.dev/v1beta1
+kind: Pipeline
+metadata:
+  name: j7s-os-pipeline
+  namespace: j7s-ci
+spec:
+  description: Build and deploy j7s-os images.
+  params:
+  - name: make-image-name
+    type: string
+    description: The name of image to make in the os repo.
+  - name: branch
+    type: string
+    default: main
+    description: branch of j7s-os image to build.
+  workspaces:
+  - name: shared-data
+    description: Shared data.
+  - name: git-credentials
+    description: Tekton's ssh credentials
+  tasks:
+  - name: fetch-repo
+    workspaces:
+    - name: output
+      workspace: shared-data
+    - name: ssh-directory
+      workspace: git-credentials
+    params:
+    - name: url
+      value: ssh://git@git.jpace121.net:2222/public/j7s-os.git
+    - name: branch
+      value: $(params.branch)
+    taskRef:
+      name: j7s-git-clone
+  - name: image-build
+    runAfter: ["fetch-repo"]
+    workspaces:
+    - name: source
+      workspace: shared-data
+    params:
+    - name: image-name
+      value: $(params.make-image-name)
+    taskRef:
+      name: j7s-os-image-build
+  - name: build-deploy-image
+    runAfter: ["image-build"]
+    workspaces:
+    - name: source
+      workspace: shared-data
+    params:
+    - name: commit
+      value: $(params.make-image-name)
+    - name: image
+      value: j7s-os-deploy
+    - name: registry
+      value: harbor.internal.jpace121.net/library
+    - name: version
+      value: $(tasks.image-build.results.version-string)
+    - name: registry-login-secret-name
+      value: harbor-login
+    taskRef:
+      name: j7s-os-buildah
+  - name: deploy-image
+    runAfter: ["build-deploy-image"]
+    workspaces:
+    - name: ssh-directory
+      workspace: git-credentials
+    params:
+    - name: image
+      value: harbor.internal.jpace121.net/library/j7s-os-deploy
+    - name: version
+      value: $(tasks.image-build.results.version-string)
+    taskRef:
+      name: j7s-os-k8s-deploy

j7s-os/kustomization.yaml

@@ -3,4 +3,5 @@ kind: Kustomization
 resources:
 - j7s-os-buildah.yaml
 - j7s-os-image-build.yaml
-- j7s-os-k8s-deploy.yaml
+- j7s-os-k8s-deploy.yaml
+- j7s-os-pipeline.yaml

limbo/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- limbo-just-build.yaml
+- limbo-pipeline.yaml
+- limbo-pipeline-listener.yaml
+- service-account.yaml
+- limbo-branch-trigger.yaml
+- limbo-web-branch-trigger.yaml
+- limbo-micro-host-branch-trigger.yaml
+- limbo-micro-branch-trigger.yaml

limbo/limbo-branch-trigger.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: limbo-branch-trigger-deployment
+  labels:
+    app: limbo-branch-trigger
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: limbo-branch-trigger
+  template:
+    metadata:
+      labels:
+        app: limbo-branch-trigger
+    spec:
+      volumes:
+      - name: git-credentials
+        secret:
+          secretName: git-credentials
+      containers:
+      - name: branch-trigger
+        image: harbor.internal.jpace121.net/k8s/j7s_branch_trigger:latest
+        command: ["/bin/sh","-c"]
+        args:
+        - mkdir ~/.ssh;
+          chmod 700 ~/.ssh;
+          cp -r /secrets/. ~/.ssh;
+          chmod -R 400 ~/.ssh/*;
+          ssh-keyscan -H -p 2222 git.jpace121.net >> ~/.ssh/known_hosts;
+          j7s_branch_trigger
+        env:
+        - name: J7S_REPO
+          value: "ssh://git@git.jpace121.net:2222/limbo/limbo.git"
+        - name: J7S_URL
+          value: "http://el-limbo-pipeline-listener.j7s-ci.svc.cluster.local:8080"
+        - name: J7S_ORG_NAME
+          value: "limbo"
+        - name: J7S_REPO_NAME
+          value: "limbo"
+        - name: J7S_JOB_NAME
+          value: "limbo"
+        - name: J7S_PATTERN
+          value: "^refs/heads/.*?$"
+        - name: J7S_LOOPTIME
+          value: "5.0"
+        volumeMounts:
+        - name: git-credentials
+          readOnly: true
+          mountPath: "/secrets"

limbo/limbo-just-build.yaml

@@ -0,0 +1,24 @@
+apiVersion: tekton.dev/v1beta1
+kind: Task
+metadata:
+  name: limbo-just-build
+spec:
+  workspaces:
+  - name: source
+  - name: ssh-directory
+  steps:
+  - image: harbor.internal.jpace121.net/k8s/limbo_builder:latest
+    script: |
+      #!/usr/bin/env bash
+      set -ex
+      # Set up ssh so we can pull private dependencies.
+      cp -r $(workspaces.ssh-directory.path) ~/.ssh
+      chmod 700 ~/.ssh
+      chmod -R 400 ~/.ssh/*
+      ssh-keyscan -H -p 2222 git.jpace121.net >> ~/.ssh/known_hosts
+      # Use just to run the ci steps.
+      source ~/.cargo/env
+      export CARGO_NET_GIT_FETCH_WITH_CLI=true
+      cd $(workspaces.source.path)
+      just ci-build
+      just ci-test

limbo/limbo-micro-branch-trigger.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: limbo-micro-branch-trigger-deployment
+  labels:
+    app: limbo-micro-branch-trigger
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: limbo-micro-branch-trigger
+  template:
+    metadata:
+      labels:
+        app: limbo-micro-branch-trigger
+    spec:
+      volumes:
+      - name: git-credentials
+        secret:
+          secretName: git-credentials
+      containers:
+      - name: branch-trigger
+        image: harbor.internal.jpace121.net/k8s/j7s_branch_trigger:latest
+        command: ["/bin/sh","-c"]
+        args:
+        - mkdir ~/.ssh;
+          chmod 700 ~/.ssh;
+          cp -r /secrets/. ~/.ssh;
+          chmod -R 400 ~/.ssh/*;
+          ssh-keyscan -H -p 2222 git.jpace121.net >> ~/.ssh/known_hosts;
+          j7s_branch_trigger
+        env:
+        - name: J7S_REPO
+          value: "ssh://git@git.jpace121.net:2222/limbo/limbo_micro.git"
+        - name: J7S_URL
+          value: "http://el-limbo-pipeline-listener.j7s-ci.svc.cluster.local:8080"
+        - name: J7S_PATTERN
+          value: "^refs/heads/.*?$"
+        - name: J7S_ORG_NAME
+          value: "limbo"
+        - name: J7S_REPO_NAME
+          value: "limbo_micro"
+        - name: J7S_JOB_NAME
+          value: "limbo-micro"
+        - name: J7S_LOOPTIME
+          value: "3.0"
+        volumeMounts:
+        - name: git-credentials
+          readOnly: true
+          mountPath: "/secrets"

limbo/limbo-micro-host-branch-trigger.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: limbo-micro-host-branch-trigger-deployment
+  labels:
+    app: limbo-micro-host-branch-trigger
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: limbo-micro-host-branch-trigger
+  template:
+    metadata:
+      labels:
+        app: limbo-micro-host-branch-trigger
+    spec:
+      volumes:
+      - name: git-credentials
+        secret:
+          secretName: git-credentials
+      containers:
+      - name: branch-trigger
+        image: harbor.internal.jpace121.net/k8s/j7s_branch_trigger:latest
+        command: ["/bin/sh","-c"]
+        args:
+        - mkdir ~/.ssh;
+          chmod 700 ~/.ssh;
+          cp -r /secrets/. ~/.ssh;
+          chmod -R 400 ~/.ssh/*;
+          ssh-keyscan -H -p 2222 git.jpace121.net >> ~/.ssh/known_hosts;
+          j7s_branch_trigger
+        env:
+        - name: J7S_REPO
+          value: "ssh://git@git.jpace121.net:2222/limbo/limbo_micro_host.git"
+        - name: J7S_URL
+          value: "http://el-limbo-pipeline-listener.j7s-ci.svc.cluster.local:8080"
+        - name: J7S_PATTERN
+          value: "^refs/heads/.*?$"
+        - name: J7S_ORG_NAME
+          value: "limbo"
+        - name: J7S_REPO_NAME
+          value: "limbo_micro_host"
+        - name: J7S_JOB_NAME
+          value: "limbo-micro-host"
+        - name: J7S_LOOPTIME
+          value: "3.0"
+        volumeMounts:
+        - name: git-credentials
+          readOnly: true
+          mountPath: "/secrets"

limbo/limbo-pipeline-listener.yaml

@@ -0,0 +1,69 @@
+---
+apiVersion: triggers.tekton.dev/v1beta1
+kind: EventListener
+metadata:
+  name: limbo-pipeline-listener
+spec:
+  serviceAccountName: limbo-serviceaccount
+  triggers:
+    - name: limbo-pipeline-trigger
+      bindings:
+        - ref: limbo-pipeline-binding
+      template:
+        ref: limbo-pipeline-template
+  resources:
+    kubernetesResource:
+      serviceType: ClusterIP
+---
+apiVersion: triggers.tekton.dev/v1beta1
+kind: TriggerBinding
+metadata:
+  name: limbo-pipeline-binding
+spec:
+  params:
+    - name: sha
+      value: $(body.sha)
+    - name: repo_name
+      value: $(body.repo_name)
+    - name: org_name
+      value: $(body.org_name)
+    - name: job_name
+      value: $(body.job_name)
+---
+apiVersion: triggers.tekton.dev/v1beta1
+kind: TriggerTemplate
+metadata:
+  name: limbo-pipeline-template
+spec:
+  params:
+  - name: sha
+  - name: repo_name
+  - name: org_name
+  - name: job_name
+  resourcetemplates:
+  - apiVersion: tekton.dev/v1beta1
+    kind: PipelineRun
+    metadata:
+      generateName: "$(tt.params.job_name)-pipeline-"
+    spec:
+      pipelineRef:
+        name: limbo-pipeline
+      params:
+      - name: sha
+        value: "$(tt.params.sha)"
+      - name: gitea-repo-name
+        value: "$(tt.params.repo_name)"
+      - name: gitea-org-name
+        value: "$(tt.params.org_name)"
+      workspaces:
+      - name: shared-data
+        volumeClaimTemplate:
+          spec:
+            accessModes:
+            - ReadWriteOnce
+            resources:
+              requests:
+                  storage: 1Gi
+      - name: git-credentials
+        secret:
+          secretName: git-credentials

limbo/limbo-pipeline.yaml

@@ -0,0 +1,63 @@
+# A pipeline to build limbo.
+---
+apiVersion: tekton.dev/v1beta1
+kind: Pipeline
+metadata:
+  name: limbo-pipeline
+spec:
+  description: "Pipeline for limbo project."
+  workspaces:
+  - name: shared-data
+    description: Shared data.
+  - name: git-credentials
+    description: tekton git credentials
+  params:
+  - name: sha
+    description: git hash to checkout
+    default: main
+  - name: gitea-repo-name
+    description: name of the repo in gitea (the part right before .git in the clone url)
+    default: limbo
+  - name: gitea-org-name
+    description: name of the org in gitea
+    default: limbo
+  tasks:
+  - name: fetch-repo
+    workspaces:
+    - name: output
+      workspace: shared-data
+    - name: ssh-directory
+      workspace: git-credentials
+    params:
+    - name: url
+      value: ssh://git@git.jpace121.net:2222/limbo/$(params.gitea-repo-name).git
+    - name: hash
+      value: $(params.sha)
+    taskRef:
+      name: j7s-git-clone-hash
+  - name: call-just
+    runAfter: ["fetch-repo"]
+    workspaces:
+    - name: source
+      workspace: shared-data
+    - name: ssh-directory
+      workspace: git-credentials
+    taskRef:
+      name: limbo-just-build
+  finally:
+    - name: gitea-status
+      params:
+        - name: git-owner
+          value: $(params.gitea-org-name)
+        - name: description
+          value: $(context.pipelineRun.name)
+        - name: git-repo-name
+          value: $(params.gitea-repo-name)
+        - name: name
+          value: j7s-ci/limbo-pipeline
+        - name: sha
+          value: $(tasks.fetch-repo.results.hash)
+        - name: status
+          value: $(tasks.status)
+      taskRef:
+        name: j7s-gitea-status

limbo/limbo-web-branch-trigger.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: limbo-web-branch-trigger-deployment
+  labels:
+    app: limbo-web-branch-trigger
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: limbo-web-branch-trigger
+  template:
+    metadata:
+      labels:
+        app: limbo-web-branch-trigger
+    spec:
+      volumes:
+      - name: git-credentials
+        secret:
+          secretName: git-credentials
+      containers:
+      - name: branch-trigger
+        image: harbor.internal.jpace121.net/k8s/j7s_branch_trigger:latest
+        command: ["/bin/sh","-c"]
+        args:
+        - mkdir ~/.ssh;
+          chmod 700 ~/.ssh;
+          cp -r /secrets/. ~/.ssh;
+          chmod -R 400 ~/.ssh/*;
+          ssh-keyscan -H -p 2222 git.jpace121.net >> ~/.ssh/known_hosts;
+          j7s_branch_trigger
+        env:
+        - name: J7S_REPO
+          value: "ssh://git@git.jpace121.net:2222/limbo/limbo_web.git"
+        - name: J7S_URL
+          value: "http://el-limbo-pipeline-listener.j7s-ci.svc.cluster.local:8080"
+        - name: J7S_PATTERN
+          value: "^refs/heads/.*?$"
+        - name: J7S_ORG_NAME
+          value: "limbo"
+        - name: J7S_REPO_NAME
+          value: "limbo_web"
+        - name: J7S_JOB_NAME
+          value: "limbo-web"
+        - name: J7S_LOOPTIME
+          value: "5.0"
+        volumeMounts:
+        - name: git-credentials
+          readOnly: true
+          mountPath: "/secrets"

limbo/service-account.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: limbo-serviceaccount
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: limbo-eventlistener-binding
+subjects:
+- kind: ServiceAccount
+  name: limbo-serviceaccount
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: tekton-triggers-eventlistener-roles
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: limbo-eventlistener-clusterbinding
+subjects:
+- kind: ServiceAccount
+  name: limbo-serviceaccount
+  namespace: j7s-ci
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: tekton-triggers-eventlistener-clusterroles

runs/dev-contain-debian.yaml

@@ -0,0 +1,28 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  generateName: dev-contain-debian-
+  namespace: j7s-ci
+spec:
+  pipelineRef:
+    name: dev-contain-pipeline
+  workspaces:
+  - name: shared-data
+    volumeClaimTemplate:
+      spec:
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 1Gi
+  - name: git-credentials
+    secret:
+      secretName: git-credentials
+  - name: deploy-credentials
+    secret:
+      secretName: deploy-credentials
+  params:
+  - name: branch
+    value: "packaging/debian"
+  - name: deploy
+    value: "true"

runs/dev-contain-rpm.yaml

@@ -0,0 +1,28 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  generateName: dev-contain-rpm-
+  namespace: j7s-ci
+spec:
+  pipelineRef:
+    name: dev-contain-pipeline
+  workspaces:
+  - name: shared-data
+    volumeClaimTemplate:
+      spec:
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 1Gi
+  - name: git-credentials
+    secret:
+      secretName: git-credentials
+  - name: deploy-credentials
+    secret:
+      secretName: deploy-credentials
+  params:
+  - name: branch
+    value: "packaging/fedora"
+  - name: deploy
+    value: "true"

runs/j7s-os-test.yaml

@@ -0,0 +1,25 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  generateName: j7s-os-test-
+  namespace: j7s-ci
+spec:
+  pipelineRef:
+    name: j7s-os-pipeline
+  workspaces:
+  - name: shared-data
+    volumeClaimTemplate:
+      spec:
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 3Gi
+  - name: git-credentials
+    secret:
+      secretName: git-credentials
+  params:
+  - name: make-image-name
+    value: cs9-qemu-minimal-ostree.x86_64.repo
+  - name: branch
+    value: main