0dcb2e14e9Drop all runtime installs from release pipeline tasks: - goreleaser-release: remove curl syft install + go install goreleaser; switch GO_IMAGE/SYFT_VERSION/GORELEASER_VERSION params to single RELEASE_TOOLS_IMAGE; split install+run into separate named steps now possible since image has all tools - cosign-sign-release: remove COSIGN_IMAGE/TOOLS_IMAGE params + microdnf jq+curl install; both steps now use RELEASE_TOOLS_IMAGE - mcpb-pack: remove NODE_IMAGE/TOOLS_IMAGE params + apt-get jq+curl + npx -y; replace npx -y @anthropic-ai/mcpb with mcpb (pre-baked binary) - go-ci: remove GOVULNCHECK_VERSION param + go install govulncheck; govulncheck step uses RELEASE_TOOLS_IMAGE; GO_IMAGE + GOLANGCI_LINT_IMAGE unchanged (no runtime installs there) - openspec-validate: remove NODE_IMAGE/OPENSPEC_VERSION params + npm install -g; single step uses RELEASE_TOOLS_IMAGE All tasks default to codeberg.org/operate-first/release-tools:latest. Pin to a specific tag after first image publish.
94 lines
3.4 KiB
YAML
94 lines
3.4 KiB
YAML
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: goreleaser-release
|
|
annotations:
|
|
tekton.dev/displayName: "goreleaser release + syft SBOMs + smoke-test"
|
|
spec:
|
|
description: |
|
|
Runs `goreleaser release` against the tagged HEAD, producing platform
|
|
archives, per-archive CycloneDX SBOMs (via syft), and checksums. After
|
|
publish, boots the freshly-built linux/amd64 binary and verifies its
|
|
version banner matches the tag. Mirrors the GoReleaser + smoke-test
|
|
steps from .forgejo/workflows/release.yml.
|
|
|
|
Outputs land in `dist/` on the source workspace so downstream Tasks
|
|
(cosign-sign-release, mcpb-pack) can attach them to the Codeberg
|
|
release without rebuilding.
|
|
|
|
All tools (go, goreleaser, syft) are pre-baked into RELEASE_TOOLS_IMAGE.
|
|
No runtime installs.
|
|
params:
|
|
- name: RELEASE_TOOLS_IMAGE
|
|
description: |
|
|
Pre-built release-tools image containing go, goreleaser, syft, cosign,
|
|
govulncheck, node, npm, jq, curl, mcpb, and openspec.
|
|
type: string
|
|
default: codeberg.org/operate-first/release-tools:latest
|
|
- name: TAG
|
|
description: Tag ref name (e.g. v2.24.0). Must match a git tag on HEAD.
|
|
type: string
|
|
workspaces:
|
|
- name: source
|
|
mountPath: /workspace/src
|
|
stepTemplate:
|
|
workingDir: $(workspaces.source.path)
|
|
env:
|
|
- name: GOFLAGS
|
|
value: "-buildvcs=false"
|
|
# GOCACHE / GOMODCACHE must live OUTSIDE the workspace mount.
|
|
# GoReleaser refuses to publish when `git status` is dirty; Go's
|
|
# caches inside the repo show up as untracked directories and
|
|
# trip the check. /tmp is per-Step but release runs in a single
|
|
# Step, so we lose nothing.
|
|
- name: GOCACHE
|
|
value: /tmp/gocache
|
|
- name: GOMODCACHE
|
|
value: /tmp/gomodcache
|
|
- name: GOTOOLCHAIN
|
|
value: local
|
|
steps:
|
|
- name: release
|
|
image: $(params.RELEASE_TOOLS_IMAGE)
|
|
env:
|
|
- name: GORELEASER_FORCE_TOKEN
|
|
value: gitea
|
|
- name: GITEA_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: op1st-release-token
|
|
key: token
|
|
script: |
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
git config --global --add safe.directory "$(workspaces.source.path)"
|
|
# GoReleaser needs full history for changelog generation. PaC
|
|
# git-clone defaults to a shallow checkout; deepen here.
|
|
git fetch --unshallow || true
|
|
git fetch --tags --force
|
|
|
|
goreleaser release --clean --parallelism 2
|
|
|
|
- name: smoke-test
|
|
image: $(params.RELEASE_TOOLS_IMAGE)
|
|
script: |
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
# Boot the freshly-built linux/amd64 binary and verify the version
|
|
# banner contains the tag. Catches LDFLAGS-injection regressions and
|
|
# dead binaries before the .mcpb packaging step ships them to users.
|
|
TAG="$(params.TAG)"
|
|
VERSION="${TAG#v}"
|
|
BIN=$(find dist -type f -name forgejo-mcp -path "*linux_amd64*" | head -1)
|
|
if [ -z "$BIN" ]; then
|
|
echo "ERROR: No linux/amd64 binary found in dist/" >&2
|
|
exit 1
|
|
fi
|
|
chmod +x "$BIN"
|
|
BANNER=$("$BIN" version 2>&1 | head -1 || true)
|
|
echo "Banner: $BANNER"
|
|
if ! echo "$BANNER" | grep -qE "^forgejo-mcp ${VERSION}([+-]|$)"; then
|
|
echo "ERROR: Smoke-test failed: banner '$BANNER' does not match expected version '${VERSION}'" >&2
|
|
exit 1
|
|
fi
|