version: v1.0
name: Publish hashrelease
agent:
  machine:
    type: f1-standard-4
    os_image: ubuntu2204
execution_time_limit:
  hours: 6

global_job_config:
  priority:
    - value: 90
      when: "branch =~ '.*'"
  secrets:
    - name: oss-release-secrets
    # Github SSH secret for pulling private repositories.
    - name: private-repo
    # Secret for GitHub API access.
    - name: marvin-github-token
    # Secret for image registries
    - name: quay-hashrelease
    - name: docker
    - name: iss-image-scanning
    # Secrets for Slack notifications
    - name: releasebot-slack
    # OIDC-related credentials
    - name: oidc-credentials-gcp-projectcalico-org
    - name: oidc-credentials-gcp-oss-hashrelease-publish

  prologue:
    commands:
      - chmod 0600 ~/.keys/*
      - ssh-add ~/.keys/*
      # Checkout the code and unshallow it.
      - checkout
      - retry git fetch --quiet --unshallow
      # Log in to container registries needed for release.
      - echo $DOCKER_TOKEN | docker login --username "$DOCKER_USER" --password-stdin
      - echo $QUAY_TOKEN | docker login --username "$QUAY_USER" --password-stdin quay.io
      - echo $QUAY_TOKEN | helm registry login --username "$QUAY_USER" --password-stdin quay.io
      # Credentials for accessing gcloud
      - echo "${SEMAPHORE_OIDC_TOKEN}" > "${SEMAPHORE_TOKEN_FILE_PATH}"
      - |
        gcloud iam workload-identity-pools create-cred-config \
            $OIDC_GCP_POOL_URI \
            --quiet \
            --service-account="${OIDC_SERVICE_ACCOUNT_EMAIL}" \
            --service-account-token-lifetime-seconds="${OIDC_SERVICE_ACCOUNT_LIFETIME}" \
            --output-file="${GOOGLE_APPLICATION_CREDENTIALS}" \
            --credential-source-file="${SEMAPHORE_TOKEN_FILE_PATH}" \
            --credential-source-type="text"
      - gcloud auth login --quiet --cred-file="${GOOGLE_APPLICATION_CREDENTIALS}"
      - gcloud config set project --quiet "${OIDC_GCP_PROJECT_NAME}"
      # Configure docker to use the gcloud credential helper
      - gcloud auth configure-docker --quiet

blocks:
  - name: Publish hashrelease
    task:
      jobs:
        - name: Build and publish hashrelease
          commands:
            - make hashrelease
      prologue:
        commands:
          - export GITHUB_TOKEN=${MARVIN_GITHUB_TOKEN}
          - cd release
