version: v1.0
name: Publish official release
agent:
  machine:
    type: f1-standard-4
    os_image: ubuntu2404
execution_time_limit:
  hours: 14
blocks:
  - name: "Publish official release"
    dependencies: []
    skip:
      # Only run on branches, not PRs.
      when: "branch !~ '.+'"
    task:
      secrets:
        - name: quay-robot-calico+semaphoreci
        - name: docker
        - name: oss-release-secrets
        - name: google-service-account-for-gce
        - name: openstack-signing-publishing
      prologue:
        commands:
          # Load the github access secrets.  First fix the permissions.
          - chmod 0600 /home/semaphore/.keys/git_ssh_rsa
          - ssh-add /home/semaphore/.keys/git_ssh_rsa
          # Checkout the code and unshallow it.
          - checkout
          - retry git fetch --quiet --unshallow
          # Log in to container registries needed for release.
          - echo $DOCKER_TOKEN | docker login --username "$DOCKER_USER" --password-stdin
          - echo $QUAY_TOKEN | docker login --username "$QUAY_USER" --password-stdin quay.io
          - echo $QUAY_TOKEN | helm registry login --username "$QUAY_USER" --password-stdin quay.io
          # Credentials for accessing gcloud, needed to push images to gcr
          - export GOOGLE_APPLICATION_CREDENTIALS=$HOME/secrets/gcr-credentials.json
          - gcloud auth activate-service-account --key-file=${GOOGLE_APPLICATION_CREDENTIALS}
          # Manually log in to GCR until we can test the gcr credentials helper
          - cat ${GOOGLE_APPLICATION_CREDENTIALS} | docker login -u _json_key --password-stdin https://gcr.io
          - cat ${GOOGLE_APPLICATION_CREDENTIALS} | docker login -u _json_key --password-stdin https://eu.gcr.io
          - cat ${GOOGLE_APPLICATION_CREDENTIALS} | docker login -u _json_key --password-stdin https://asia.gcr.io
          - cat ${GOOGLE_APPLICATION_CREDENTIALS} | docker login -u _json_key --password-stdin https://us.gcr.io
      jobs:
        - name: "Release on Semaphore VM"
          execution_time_limit:
            minutes: 360
          env_vars:
            - name: VAR_FILE
              value: /home/semaphore/secrets/release.tfvars
          commands:
            - if [ -z "${SEMAPHORE_GIT_PR_NUMBER}" ]; then make GIT_BRANCH=${SEMAPHORE_GIT_BRANCH} release; fi
            - if [ -z "${SEMAPHORE_GIT_PR_NUMBER}" ]; then make GIT_BRANCH=${SEMAPHORE_GIT_BRANCH} release-publish; fi
  - name: "Build Openstack Packages"
    dependencies: ["Publish official release"]
    skip:
      when: "branch !~ '.+'"
    task:
      secrets:
        - name: quay-robot-calico+semaphoreci
        - name: docker
        - name: oss-release-secrets
        - name: google-service-account-for-gce
        - name: openstack-signing-publishing
      prologue:
        commands:
          # Load the github access secrets.  First fix the permissions.
          - chmod 0600 /home/semaphore/.keys/git_ssh_rsa
          - ssh-add /home/semaphore/.keys/git_ssh_rsa
          # Checkout the code (we don't need to unshallow it like we usually do)
          - checkout
          # Authenticate to google cloud (to upload RPM binaries to the repo)
          - gcloud config set project tigera-wp-tcp-redirect
          - gcloud auth activate-service-account --key-file=$GOOGLE_APPLICATION_CREDENTIALS
          # Install more tools
          - sudo apt update
          - sudo apt install -y moreutils patchelf jq devscripts
      jobs:
        - name: "Build Openstack Packages"
          execution_time_limit:
            minutes: 60
          commands:
            - if [ -z "${SEMAPHORE_GIT_PR_NUMBER}" ]; then make publish-openstack; fi
      epilogue:
        always:
          commands:
            - test -d release/packaging/output  && mv -v release/packaging/output release/packaging/openstack
            - artifact push workflow release/packaging/openstack
