#
# Copyright 2021 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
timeout: 3600s

steps:
  - name: gcr.io/cloud-builders/git
    dir: "go/src/sigstore"
    args:
      - "clone"
      - "https://github.com/${_TOOL_ORG}/${_TOOL_REPO}"

  - name: gcr.io/cloud-builders/git
    entrypoint: "bash"
    dir: "go/src/sigstore/fulcio"
    args:
      - '-c'
      - |
        git fetch
        echo "Checking out ${_GIT_TAG}"
        git checkout ${_GIT_TAG}

  - name: 'ghcr.io/sigstore/cosign/cosign:v3.0.2-dev@sha256:322c53c5f3e4516351bd8cb793ff46ad3809eed48a53daf0da1bae8f4d550e18'
    dir: "go/src/sigstore/fulcio"
    env:
      - TUF_ROOT=/tmp
    args:
      - 'verify'
      - 'ghcr.io/gythialy/golang-cross:v1.25.5-0@sha256:3a7d463d9e3438513b6bd597c79f7d5db756023e04718259cc25aabd5d00fc17'
      - '--certificate-oidc-issuer'
      - "https://token.actions.githubusercontent.com"
      - '--certificate-identity'
      - "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.25.5-0"

  - name: ghcr.io/gythialy/golang-cross:v1.25.5-0@sha256:3a7d463d9e3438513b6bd597c79f7d5db756023e04718259cc25aabd5d00fc17
    entrypoint: /bin/sh
    dir: "go/src/sigstore/fulcio"
    env:
      - "GOPATH=/workspace/go"
      - "GOBIN=/workspace/bin"
      - PROJECT_ID=${PROJECT_ID}
      - KEY_LOCATION=${_KEY_LOCATION}
      - KEY_RING=${_KEY_RING}
      - KEY_NAME=${_KEY_NAME}
      - KEY_VERSION=${_KEY_VERSION}
      - GIT_TAG=${_GIT_TAG}
      - GOOGLE_SERVICE_ACCOUNT_NAME=keyless@${PROJECT_ID}.iam.gserviceaccount.com
      - KO_PREFIX=gcr.io/${PROJECT_ID}
      - TUF_ROOT=/tmp
    secretEnv:
      - GITHUB_TOKEN
    args:
      - '-c'
      - |
        gcloud auth configure-docker \
        && make release

  - name: ghcr.io/gythialy/golang-cross:v1.25.5-0@sha256:3a7d463d9e3438513b6bd597c79f7d5db756023e04718259cc25aabd5d00fc17
    entrypoint: 'bash'
    dir: "go/src/sigstore/fulcio"
    env:
      - "GOPATH=/workspace/go"
      - "GOBIN=/workspace/bin"
      - PROJECT_ID=${PROJECT_ID}
      - KEY_LOCATION=${_KEY_LOCATION}
      - KEY_RING=${_KEY_RING}
      - KEY_NAME=${_KEY_NAME}
      - KEY_VERSION=${_KEY_VERSION}
      - GIT_TAG=${_GIT_TAG}
      - KO_PREFIX=gcr.io/${PROJECT_ID}
      - GOOGLE_SERVICE_ACCOUNT_NAME=keyless@${PROJECT_ID}.iam.gserviceaccount.com
      - GITHUB_USER=${_GITHUB_USER}
      - TUF_ROOT=/tmp
    secretEnv:
      - GITHUB_TOKEN
    args:
      - '-c'
      - |
        echo $$GITHUB_TOKEN | docker login ghcr.io -u $$GITHUB_USER --password-stdin \
        && make copy-signed-release-to-ghcr

availableSecrets:
  secretManager:
    - versionName: projects/${PROJECT_NUMBER}/secrets/GITHUB_TOKEN/versions/latest
      env: GITHUB_TOKEN

artifacts:
  objects:
    location: 'gs://${_STORAGE_LOCATION}/${_GIT_TAG}'
    paths:
    - "go/src/sigstore/fulcio/dist/fulcio*"
    - "go/src/sigstore/fulcio/release/release-cosign.pub"
    - "go/src/sigstore/fulcio/fulcio*.yaml"

options:
  machineType: E2_HIGHCPU_8

tags:
  - fulcio-release
  - ${_GIT_TAG}
  - ${_TOOL_ORG}
  - ${_TOOL_REPO}

substitutions:
  _GIT_TAG: 'v0.0.0'
  _TOOL_ORG: 'honk'
  _TOOL_REPO: 'honk-repo'
  _STORAGE_LOCATION: 'honk'
  _KEY_RING: 'honk-ring'
  _KEY_NAME: 'honk-crypto'
  _KEY_VERSION: '1'
  _KEY_LOCATION: 'global'
  _GITHUB_USER: 'placeholder'
