release-pipeline.yaml

---
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: pipeline-release
spec:
  params:
  - name: package
    description: package to release
    default: github.com/tektoncd/pipeline
  - name: gitRevision
    description: the git revision to release
  - name: imageRegistry
    description: The target image registry
    default: gcr.io
  - name: imageRegistryPath
    description: The path (project) in the image registry
    default: tekton-releases
  - name: versionTag
    description: The X.Y.Z version that the artifacts should be tagged with
  - name: releaseBucket
    description: bucket where the release is stored. The bucket must be project specific.
    default: gs://tekton-releases-nightly/pipeline
  - name: releaseAsLatest
    description: Whether to tag and publish this release as Pipelines' latest
    default: "true"
  - name: platforms
    description: Platforms to publish for the images (e.g. linux/amd64,linux/arm64)
    default: linux/amd64,linux/arm,linux/arm64,linux/s390x,linux/ppc64le
  - name: serviceAccountPath
    description: The path to the service account file within the release-secret workspace
  workspaces:
    - name: workarea
      description: The workspace where the repo will be cloned.
    - name: release-secret
      description: The secret that contains a service account authorized to push to the imageRegistry and to the output bucket
  results:
    - name: commit-sha
      description: the sha of the commit that was released
      value: $(tasks.git-clone.results.commit)
    - name: release-file
      description: the URL of the release file
      value: $(tasks.report-bucket.results.release)
    - name: release-file-no-tag
      description: the URL of the release file
      value: $(tasks.report-bucket.results.release-no-tag)
  tasks:
    - name: git-clone
      taskRef:
        name: git-clone
      workspaces:
        - name: output
          workspace: workarea
          subpath: git
      params:
        - name: url
          value: https://$(params.package)
        - name: revision
          value: $(params.gitRevision)
    - name: precheck
      runAfter: [git-clone]
      taskRef:
        name: prerelease-checks
      params:
        - name: package
          value: $(params.package)
        - name: versionTag
          value: $(params.versionTag)
        - name: releaseBucket
          value: $(params.releaseBucket)
      workspaces:
        - name: source-to-release
          workspace: workarea
          subpath: git
    - name: unit-tests
      runAfter: [precheck]
      taskRef:
        name: golang-test
      params:
        - name: package
          value: $(params.package)
        - name: flags
          value: -v -mod=vendor
      workspaces:
        - name: source
          workspace: workarea
          subpath: git
    - name: build
      runAfter: [precheck]
      taskRef:
        name: golang-build
      params:
        - name: package
          value: $(params.package)
        - name: packages
          value: ./cmd/...
      workspaces:
        - name: source
          workspace: workarea
          subpath: git
    - name: build-base-image
      runAfter: [build, unit-tests]
      taskRef:
        name: build-multiarch-base-image
      params:
        - name: package
          value: $(params.package)
        - name: imageRegistry
          value: $(params.imageRegistry)
        - name: imageRegistryPath
          value: $(params.imageRegistryPath)
        - name: platforms
          value: $(params.platforms)
        - name: serviceAccountPath
          value: $(params.serviceAccountPath)
      workspaces:
        - name: source
          workspace: workarea
          subpath: git
        - name: release-secret
          workspace: release-secret
    - name: publish-images
      runAfter: [build-base-image]
      taskRef:
        name: publish-release
      params:
        - name: package
          value: $(params.package)
        - name: versionTag
          value: $(params.versionTag)
        - name: imageRegistry
          value: $(params.imageRegistry)
        - name: imageRegistryPath
          value: $(params.imageRegistryPath)
        - name: releaseAsLatest
          value: $(params.releaseAsLatest)
        - name: serviceAccountPath
          value: $(params.serviceAccountPath)
        # NOTE: We're purposefully *not* passing the pipeline's platforms to
        # this task. We want to use the task's default platforms, which include
        # windows.
      workspaces:
        - name: source
          workspace: workarea
          subpath: git
        - name: output
          workspace: workarea
          subpath: bucket
        - name: release-secret
          workspace: release-secret
    - name: publish-to-bucket
      runAfter: [publish-images]
      taskRef:
        name: gcs-upload
      workspaces:
        - name: credentials
          workspace: release-secret
        - name: source
          workspace: workarea
          subpath: bucket
      params:
        - name: location
          value: $(params.releaseBucket)/previous/$(params.versionTag)
        - name: path
          value: $(params.versionTag)
        - name: serviceAccountPath
          value: $(params.serviceAccountPath)
    - name: publish-to-bucket-latest
      runAfter: [publish-images]
      when:
        - input: "$(params.releaseAsLatest)"
          operator: in
          values: ["true"]
      taskRef:
        name: gcs-upload
      workspaces:
        - name: credentials
          workspace: release-secret
        - name: source
          workspace: workarea
          subpath: bucket
      params:
        - name: location
          value: $(params.releaseBucket)/latest
        - name: path
          value: $(params.versionTag)
        - name: serviceAccountPath
          value: $(params.serviceAccountPath)
    - name: report-bucket
      runAfter: [publish-to-bucket]
      params:
        - name: releaseBucket
          value: $(params.releaseBucket)
        - name: versionTag
          value: $(params.versionTag)
      taskSpec:
        params:
          - name: releaseBucket
          - name: versionTag
        results:
          - name: release
            description: The full URL of the release file in the bucket
          - name: release-no-tag
            description: The full URL of the release file (no tag) in the bucket
        steps:
          - name: create-results
            image: alpine
            script: |
              BASE_URL=$(echo "$(params.releaseBucket)/previous/$(params.versionTag)")
              # If the bucket is in the gs:// return the corresponding public https URL
              BASE_URL=$(echo ${BASE_URL} | sed 's,gs://,https://storage.googleapis.com/,g')
              echo "${BASE_URL}/release.yaml" > $(results.release.path)
              echo "${BASE_URL}/release.notag.yaml" > $(results.release-no-tag.path)