Signed provenance for ros-clone.

tasks/j7s-ros-clone.yaml

@@ -0,0 +1,56 @@
+apiVersion: tekton.dev/v1beta1
+kind: Task
+metadata:
+  name: j7s-ros-clone
+  namespace: j7s-ci
+spec:
+  workspaces:
+  - name: output
+  - name: ssh-directory
+  params:
+  - name: url
+  - name: branch
+  - name: repos-file
+  results:
+  - name: workspace-git-commit-ARTIFACT_OUTPUTS
+    type: object
+    properties:
+       uri:
+          type: string
+       digest:
+          type: string
+  - name: vcs-exact-file-ARTIFACT_OUTPUTS
+    type: object
+    properties:
+       uri:
+          type: string
+       digest:
+          type: string
+  steps:
+  - image: 192.168.1.149:8443/vcs:latest
+    script: |
+      set -x
+      cp -r $(workspaces.ssh-directory.path) ~/.ssh
+      chmod 700 ~/.ssh
+      chmod -R 400 ~/.ssh/*
+
+      git clone --single-branch --branch $(params.branch) $(params.url) $(workspaces.output.path)
+      cd $(workspaces.output.path)
+      mkdir src
+      vcs import src < $(params.repos-file)
+
+      # Git hash is really sha1, rehashing to workaround Tekton bug.
+      GITHASH=`git rev-parse HEAD | sha256sum | cut -f 1 -d " "`
+      VCSEXACTHASH=`vcs export --exact ./src | sha256sum | cut -f 1 -d " "`
+      cat <<EOF > $(results.workspace-git-commit-ARTIFACT_OUTPUTS.path)
+      {
+         "uri": "$(params.url)",
+         "digest": "sha256:$GITHASH"
+      }
+      EOF
+      cat <<EOF > $(results.vcs-exact-file-ARTIFACT_OUTPUTS.path)
+      {
+         "uri": "vcs-exact-file",
+         "digest": "sha256:$VCSEXACTHASH"
+      }
+      EOF