Taskfile.yaml

Rama main · réplica de lectura del repositorio original.

version: "3"
run: once
vars:
  HARBOR_ADDR: "harbor.okwilkins.dev"
  HARBOR_TOKEN:
    sh: kubectl get secret harbor-dagger-robot-secret -n harbor -o json | jq -r '.data.SECRET' | base64 -d
  HARBOR_ROBOT_USER: "robot$dagger"
  REPO_NAME: "{{.HARBOR_ADDR}}/main"

  COSIGN_PASSWORD:
    sh: kubectl get secret cosign-key-pair -n cosign -o json | jq -r '.data.COSIGN_PASSWORD' | base64 -d
  COSIGN_KEY:
    sh: kubectl get secret cosign-key-pair -n cosign -o json | jq -r '.data."cosign.key"' | base64 -d
  COSIGN_PUB:
    sh: kubectl get secret cosign-key-pair -n cosign -o json | jq -r '.data."cosign.pub"' | base64 -d

  BUILDER_NAME: builder
  PUSH_LATEST: "false"

tasks:
  registry_login:
    desc: Login to Harbor for Buildah and Cosign.
    env:
      HARBOR_TOKEN: '{{.HARBOR_TOKEN}}'
    cmd: echo $HARBOR_TOKEN | buildah login "{{.HARBOR_ADDR}}" -u '{{.HARBOR_ROBOT_USER}}' --password-stdin

  create_manifest:
    desc: Creates a manifest for a multi-arch image.
    preconditions:
      - sh: '[ -n "{{.IMG_NAME}}" ]'
        msg: IMG_NAME is empty!
    cmd: buildah manifest create {{.IMG_NAME}}

  clean_manifest:
    desc: Removes a manifest for a multi-arch image.
    preconditions:
      - sh: '[ -n "{{.IMG_NAME}}" ]'
        msg: IMG_NAME is empty!
    cmd: buildah manifest rm {{.IMG_NAME}}

  build:
    desc: "Buildah builds the image and pushes to a remote repository. Requires that there is a container file in the current directory!"
    dir: "{{.USER_WORKING_DIR}}"
    preconditions:
      - sh: '[ -n "{{.IMG_NAME}}" ]'
        msg: IMG_NAME is empty!
      - sh: '[ -n "{{.TAG}}" ]'
        msg: TAG is empty!
    vars:
      IMG: "{{.REPO_NAME}}/{{.IMG_NAME}}"
      FULL_IMG_NAME: "{{.IMG}}:{{.TAG}}"
    cmds:
      - echo "{{.IMG}}"
      - "buildah build --tag {{.FULL_IMG_NAME}} --platform linux/amd64,linux/arm64 --manifest {{.IMG_NAME}}"

  push:
    desc: "Buildah pushes the built image to a remote repository."
    dir: "{{.USER_WORKING_DIR}}"
    preconditions:
      - sh: '[ -n "{{.IMG_NAME}}" ]'
        msg: IMG_NAME is empty!
      - sh: '[ -n "{{.TAG}}" ]'
        msg: TAG is empty!
    vars:
      IMG: "{{.REPO_NAME}}/{{.IMG_NAME}}"
      FULL_IMG_NAME: "{{.IMG}}:{{.TAG}}"
    cmds:
      - "buildah manifest push --all {{.IMG_NAME}} --digestfile digest docker://{{.FULL_IMG_NAME}}"

  push_latest:
    desc: "Buildah pushes the built image to a remote repository with the latest tag. Intended to be used in the publish task."
    internal: true
    status:
      - '[ "{{.PUSH_LATEST}}" = "false" ]'
    dir: "{{.USER_WORKING_DIR}}"
    preconditions:
      - sh: '[ -n "{{.IMG_NAME}}" ]'
        msg: IMG_NAME is empty!
    vars:
      IMG: "{{.REPO_NAME}}/{{.IMG_NAME}}"
      FULL_IMG_NAME: "{{.IMG}}:latest"
    cmds:
      - "buildah manifest push --all {{.IMG_NAME}} --digestfile digest docker://{{.FULL_IMG_NAME}}"

  clean_digestfile:
    desc: Cleans the digestfile generated in the push task.
    dir: "{{.USER_WORKING_DIR}}"
    cmd: rm -f digest

  cosign_sign:
    desc: Cosign sign by digest (recursive) for all manifests.
    dir: "{{.USER_WORKING_DIR}}"
    vars:
      IMG: "{{.REPO_NAME}}/{{.IMG_NAME}}"
    env:
      COSIGN_PASSWORD: '{{.COSIGN_PASSWORD}}'
      COSIGN_KEY: '{{.COSIGN_KEY}}'
      COSIGN_PUB: '{{.COSIGN_PUB}}'
      DIGEST:
        sh: "cat {{.USER_WORKING_DIR}}/digest"
    preconditions:
      - sh: '[ -n "{{.IMG_NAME}}" ]'
        msg: IMG_NAME is empty!
      - sh: '[ -f digest ]'
        msg: "digest file is missing! Did the push task run successfully?"
    cmds:
      - |
        cosign sign \
          --yes \
          --key env://COSIGN_KEY \
          --recursive \
          {{.IMG}}@$DIGEST

  publish:
    desc: "Orchestrate build, push and sign a container"
    preconditions:
      - sh: '[ -n "{{.IMG_NAME}}" ]'
        msg: IMG_NAME is empty!
      - sh: '[ -n "{{.TAG}}" ]'
        msg: TAG is empty!
    cmds:
      - defer:
          task: clean_manifest
          vars: {IMG_NAME: "{{.IMG_NAME}}"}
      - defer:
          task: clean_digestfile
      - task: registry_login
      - task: build
        vars: {IMG_NAME: "{{.IMG_NAME}}", TAG: "{{.TAG}}"}
      - task: push
        vars: {IMG_NAME: "{{.IMG_NAME}}", TAG: "{{.TAG}}"}
      # Only runs if PUSH_LATEST is not false
      - task: push_latest
        vars: {IMG_NAME: "{{.IMG_NAME}}", PUSH_LATEST: "{{.PUSH_LATEST}}"}
      - task: cosign_sign
        vars: {IMG_NAME: "{{.IMG_NAME}}", TAG: "{{.TAG}}"}