#
# Copyright 2021 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

timeout: 3600s

steps:
- name: gcr.io/cloud-builders/git
  dir: "go/src/sigstore"
  args:
  - "clone"
  - "https://github.com/${_TOOL_ORG}/${_TOOL_REPO}"

- name: gcr.io/cloud-builders/git
  entrypoint: "bash"
  dir: "go/src/sigstore/rekor"
  args:
  - '-c'
  - |
    git fetch
    echo "Checking out ${_GIT_TAG}"
    git checkout ${_GIT_TAG}

- name: 'ghcr.io/sigstore/cosign/cosign:v3.0.6-dev@sha256:fd2e25faec7ea4c47bfbe6f50f00ff0e465fcea1f6d121eed7491b79278b19f7'
  dir: "go/src/sigstore/rekor"
  env:
  - TUF_ROOT=/tmp
  args:
  - 'verify'
  - 'ghcr.io/gythialy/golang-cross:v1.26.3-0@sha256:9f7a53d7205e2f1f2742d624ff0b6e1531e8c22863dfb24ca966be5efbdee48b'
  - '--certificate-oidc-issuer'
  - "https://token.actions.githubusercontent.com"
  - '--certificate-identity'
  - "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.26.3-0"

- name: ghcr.io/gythialy/golang-cross:v1.26.3-0@sha256:9f7a53d7205e2f1f2742d624ff0b6e1531e8c22863dfb24ca966be5efbdee48b
  entrypoint: /bin/sh
  dir: "go/src/sigstore/rekor"
  env:
  - "GOPATH=/workspace/go"
  - "GOBIN=/workspace/bin"
  - PROJECT_ID=${PROJECT_ID}
  - KEY_LOCATION=${_KEY_LOCATION}
  - KEY_RING=${_KEY_RING}
  - KEY_NAME=${_KEY_NAME}
  - KEY_VERSION=${_KEY_VERSION}
  - GIT_TAG=${_GIT_TAG}
  - GOOGLE_SERVICE_ACCOUNT_NAME=keyless@${PROJECT_ID}.iam.gserviceaccount.com
  - COSIGN_YES=true
  - KO_PREFIX=gcr.io/${PROJECT_ID}
  secretEnv:
  - GITHUB_TOKEN
  args:
    - '-c'
    - |
      gcloud auth configure-docker \
      && make release

- name: ghcr.io/gythialy/golang-cross:v1.26.3-0@sha256:9f7a53d7205e2f1f2742d624ff0b6e1531e8c22863dfb24ca966be5efbdee48b
  entrypoint: 'bash'
  dir: "go/src/sigstore/rekor"
  env:
  - "GOPATH=/workspace/go"
  - "GOBIN=/workspace/bin"
  - PROJECT_ID=${PROJECT_ID}
  - KEY_LOCATION=${_KEY_LOCATION}
  - KEY_RING=${_KEY_RING}
  - KEY_NAME=${_KEY_NAME}
  - KEY_VERSION=${_KEY_VERSION}
  - GIT_TAG=${_GIT_TAG}
  - KO_PREFIX=gcr.io/${PROJECT_ID}
  - COSIGN_EXPERIMENTAL=true
  - GOOGLE_SERVICE_ACCOUNT_NAME=keyless@${PROJECT_ID}.iam.gserviceaccount.com
  - GITHUB_USER=${_GITHUB_USER}
  - KO_PREFIX=gcr.io/${PROJECT_ID}
  secretEnv:
  - GITHUB_TOKEN
  args:
    - '-c'
    - |
      echo $$GITHUB_TOKEN | docker login ghcr.io -u $$GITHUB_USER --password-stdin \
      && make copy-signed-release-to-ghcr || true

availableSecrets:
  secretManager:
  - versionName: projects/${PROJECT_NUMBER}/secrets/GITHUB_TOKEN/versions/latest
    env: GITHUB_TOKEN

artifacts:
  objects:
    location: 'gs://${_STORAGE_LOCATION}/${_GIT_TAG}'
    paths:
    - "go/src/sigstore/rekor/dist/rekor*"
    - "go/src/sigstore/rekor/release/release-cosign.pub"
    - "go/src/sigstore/rekor/rekor*.yaml"

options:
  machineType: E2_HIGHCPU_8

tags:
- rekor-release
- ${_GIT_TAG}
- ${_TOOL_ORG}
- ${_TOOL_REPO}

substitutions:
  _GIT_TAG: 'v0.0.0'
  _TOOL_ORG: 'honk'
  _TOOL_REPO: 'honk-repo'
  _STORAGE_LOCATION: 'honk'
  _KEY_RING: 'honk-ring'
  _KEY_NAME: 'honk-crypto'
  _KEY_VERSION: '1'
  _KEY_LOCATION: 'global'
  _GITHUB_USER: 'placeholder'
