config.yml

version: 2.1

jobs:
  validate:
    machine:
      image: ubuntu-2204:2024.01.2
    steps:
      - checkout
      - run:
          name: Validate YAML
          command: |
            docker run --rm -it \
             -v $PWD:/workdir \
             -w /workdir \
             gsoci.azurecr.io/giantswarm/yamllint:1.26@sha256:1bf8270a671a2e5f2fea8ac2e80164d627e0c5fa083759862bbde80628f942b2 \
             --config-file /workdir/.yamllint \
             images/*.yaml
      - persist_to_workspace:
          root: .
          paths:
            - "images/"

  validate-skopeo:
    docker:
      - image: gsoci.azurecr.io/giantswarm/skopeo:v1.15.0
    resource_class: small
    steps:
      - checkout
      - attach_workspace:
          at: .
      - run:
          name: Run skopeo YAML files through 'skopeo sync --dry-run' for validation
          command: |
            for file in images/skopeo-*.yaml; do
              # The target does not matter here, so we use the non-existing `dummy.example.com/namespace/`.
              echo "Checking $file:"
              skopeo sync --dry-run --src yaml $file --dest docker dummy.example.com/namespace/  2>&1 | tee -a dry-run.log
              echo ""
            done

            # Skopeo sync exits with code 0 even of there were errors.
            # So let's make sure this test fails if there were some.
            if grep -q "level=error" dry-run.log; then
                echo -e "\033[0;31mERRORS OCCURRED\033[0m"
                echo "Here is the gist only. Scroll up to see them in context."
                echo ""
                grep "level=error" dry-run.log
                exit 1
            fi

  build-and-push-docker:
    machine:
      image: ubuntu-2204:2024.01.2
    parameters:
      username:
        type: string
      password:
        type: string
      registry:
        type: string
      tag:
        type: string
    steps:
      - checkout
      - attach_workspace:
          at: .
      - run:
          name: Build container image
          command: |
            docker build -t "<<parameters.registry>>/giantswarm/retagger:<<parameters.tag>>" .
      - run:
          name: Authenticate to registry
          command: |
            docker login -u "<<parameters.username>>" -p "<<parameters.password>>" "<<parameters.registry>>"
      - run:
          name: Push container image
          command: |
            echo "Pushing tag '<<parameters.tag>>' to <<parameters.registry>>..."
            docker push "<<parameters.registry>>/giantswarm/retagger:<<parameters.tag>>"

  filter-skopeo-tags:
    docker:
      - image: quay.io/giantswarm/retagger:${CIRCLE_TAG:-$CIRCLE_SHA1}
    resource_class: small
    parameters:
      filepath:
        type: string
    steps:
      - attach_workspace:
          at: .
      - run:
          name: "Log in to registries: docker"
          command: |
            docker login -u ${DOCKER_USERNAME} -p ${DOCKER_PASSWORD} docker.io
            docker login -u ${QUAY_USERNAME} -p ${QUAY_PASSWORD} quay.io
            docker login -u ${ACR_GSOCI_RETAGGER_USERNAME} -p ${ACR_GSOCI_RETAGGER_PASSWORD} gsoci.azurecr.io
            max_retry=5
            counter=1
            until docker login -u ${ALIYUN_USERNAME} -p ${ALIYUN_PASSWORD} giantswarm-registry.cn-shanghai.cr.aliyuncs.com
            do
                sleep 3
                [[ counter -eq $max_retry ]] && echo "Failed by exhausting $max_retry retries" && exit 1
                echo "Attempt $counter: trying again..."
                ((counter++))
            done
      - run:
          name: "Log in to registries: skopeo"
          command: |
            skopeo login -u ${DOCKER_USERNAME} -p ${DOCKER_PASSWORD} docker.io
            skopeo login -u ${QUAY_USERNAME} -p ${QUAY_PASSWORD} quay.io
            skopeo login -u ${ACR_GSOCI_RETAGGER_USERNAME} -p ${ACR_GSOCI_RETAGGER_PASSWORD} gsoci.azurecr.io
            max_retry=5
            counter=1
            until skopeo login -u ${ALIYUN_USERNAME} -p ${ALIYUN_PASSWORD} giantswarm-registry.cn-shanghai.cr.aliyuncs.com
            do
                sleep 3
                [[ counter -eq $max_retry ]] && echo "Failed by exhausting $max_retry retries" && exit 1
                echo "Attempt $counter: trying again..."
                ((counter++))
            done
      - run :
          name: Filter tags in Skopeo YAML
          command: |
            retagger filter "<<parameters.filepath>>"
      - persist_to_workspace:
          root: .
          paths:
            - "<<parameters.filepath>>.filtered"

  retag-registry:
    docker:
      - image: quay.io/giantswarm/retagger:${CIRCLE_TAG:-$CIRCLE_SHA1}
    resource_class: small
    parameters:
      username:
        type: string
      password:
        type: string
      registry:
        type: string
      images_file:
        type: string
    steps:
      - attach_workspace:
          at: .
      - run:
          name: Log in to Docker registry
          command: |
            skopeo login -u ${DOCKER_USERNAME} -p ${DOCKER_PASSWORD} docker.io
            max_retry=30
            counter=1
            until skopeo login -u "<<parameters.username>>" -p "<<parameters.password>>" "<<parameters.registry>>"
            do
                sleep 3
                [[ counter -eq $max_retry ]] && echo "Failed by exhausting $max_retry retries" && exit 1
                echo "Attempt $counter: trying again..."
                ((counter++))
            done
      - run:
          name: Retag images
          no_output_timeout: 1h
          command: |
            skopeo sync --all --keep-going --retry-times 3 --src yaml --dest docker \
              "<<parameters.images_file>>" "<<parameters.registry>>/giantswarm" | tee /tmp/skopeo.log
      - store_artifacts:
          path: /tmp/skopeo.log
          destination: "<<parameters.registry>>-<<parameters.images_file>>.log"

  retag-customized-images:
    docker:
      - image: quay.io/giantswarm/retagger:${CIRCLE_TAG:-$CIRCLE_SHA1}
    resource_class: small
    parameters:
      log_level:
        type: string
        default: "debug"
      executor_count:
        type: integer
        default: 1
      executor_id:
        type: integer
        default: 0
    steps:
      - setup_remote_docker:
          docker_layer_caching: true
      - attach_workspace:
          at: .
      - run:
          name: "Log in to registries: docker"
          command: |
            docker login -u ${DOCKER_USERNAME} -p ${DOCKER_PASSWORD} docker.io
            docker login -u ${QUAY_USERNAME} -p ${QUAY_PASSWORD} quay.io
            docker login -u ${ACR_GSOCI_RETAGGER_USERNAME} -p ${ACR_GSOCI_RETAGGER_PASSWORD} gsoci.azurecr.io
            max_retry=5
            counter=1
            until docker login -u ${ALIYUN_USERNAME} -p ${ALIYUN_PASSWORD} giantswarm-registry.cn-shanghai.cr.aliyuncs.com
            do
                sleep 3
                [[ counter -eq $max_retry ]] && echo "Failed by exhausting $max_retry retries" && exit 1
                echo "Attempt $counter: trying again..."
                ((counter++))
            done
      - run:
          name: "Log in to registries: skopeo"
          command: |
            skopeo login -u ${DOCKER_USERNAME} -p ${DOCKER_PASSWORD} docker.io
            skopeo login -u ${QUAY_USERNAME} -p ${QUAY_PASSWORD} quay.io
            skopeo login -u ${ACR_GSOCI_RETAGGER_USERNAME} -p ${ACR_GSOCI_RETAGGER_PASSWORD} gsoci.azurecr.io
            max_retry=5
            counter=1
            until skopeo login -u ${ALIYUN_USERNAME} -p ${ALIYUN_PASSWORD} giantswarm-registry.cn-shanghai.cr.aliyuncs.com
            do
                sleep 3
                [[ counter -eq $max_retry ]] && echo "Failed by exhausting $max_retry retries" && exit 1
                echo "Attempt $counter: trying again..."
                ((counter++))
            done
      - run:
          name: "Run retagger"
          no_output_timeout: 1h
          command: |
            retagger run --log-level "<<parameters.log_level>>" \
              --executor-count <<parameters.executor_count>> --executor-id <<parameters.executor_id>> | tee /tmp/retagger.log
      - store_artifacts:
          path: /tmp/retagger.log
          destination: "retagger-<<parameters.executor_id>>-of-<<parameters.executor_count>>.log"

  ping-heartbeat:
    docker:
      - image: curlimages/curl:latest
    steps:
      - run:
          name: Ping heartbeat
          environment:
            HEARTBEAT_NAME: retagger-cronjob
          command: |
            curl -X GET https://api.opsgenie.com/v2/heartbeats/$HEARTBEAT_NAME/ping --header "Authorization: GenieKey ${OPSGENIE_HEARTBEAT_KEY}"

# Define 'build_and_retag' workflow steps, so we can reuse it.
build_and_retag: &build_and_retag
  jobs:
    - validate:
        name: validate-images-yaml
    - validate-skopeo:
        name: validate-skopeo
        requires:
          - validate-images-yaml
    - build-and-push-docker:
        context: architect
        name: build-and-push-docker
        username: ${QUAY_USERNAME}
        password: ${QUAY_PASSWORD}
        registry: "quay.io"
        tag: ${CIRCLE_TAG:-$CIRCLE_SHA1}
        requires:
          - validate-skopeo
    - filter-skopeo-tags:
        context: architect
        name: filter-skopeo-docker-io
        filepath: images/skopeo-docker-io.yaml
        filters:
          branches:
            only:
              - main
        requires:
          - build-and-push-docker
    - filter-skopeo-tags:
        context: architect
        name: filter-skopeo-eu-gcr-io
        filepath: images/skopeo-eu-gcr-io.yaml
        filters:
          branches:
            only:
              - main
        requires:
          - build-and-push-docker
    - filter-skopeo-tags:
        context: architect
        name: filter-skopeo-gcr-io
        filepath: images/skopeo-gcr-io.yaml
        filters:
          branches:
            only:
              - main
        requires:
          - build-and-push-docker
    - filter-skopeo-tags:
        context: architect
        name: filter-skopeo-ghcr-io
        filepath: images/skopeo-ghcr-io.yaml
        filters:
          branches:
            only:
              - main
        requires:
          - build-and-push-docker
    - filter-skopeo-tags:
        context: architect
        name: filter-skopeo-mcr-microsoft-com
        filepath: images/skopeo-mcr-microsoft-com.yaml
        filters:
          branches:
            only:
              - main
        requires:
          - build-and-push-docker
    - filter-skopeo-tags:
        context: architect
        name: filter-skopeo-public-ecr-aws
        filepath: images/skopeo-public-ecr-aws.yaml
        filters:
          branches:
            only:
              - main
        requires:
          - build-and-push-docker
    - filter-skopeo-tags:
        context: architect
        name: filter-skopeo-quay-io
        filepath: images/skopeo-quay-io.yaml
        filters:
          branches:
            only:
              - main
        requires:
          - build-and-push-docker
    - filter-skopeo-tags:
        context: architect
        name: filter-skopeo-k8s-io
        filepath: images/skopeo-registry-k8s-io.yaml
        filters:
          branches:
            only:
              - main
        requires:
          - build-and-push-docker
    - filter-skopeo-tags:
        context: architect
        name: filter-skopeo-k8s-io-kubernetes
        filepath: images/skopeo-registry-k8s-io-kubernetes.yaml
        filters:
          branches:
            only:
              - main
        requires:
          - build-and-push-docker
    - retag-registry:
        context: architect
        name: retag-quay-<<matrix.images_file>>
        username: ${QUAY_USERNAME}
        password: ${QUAY_PASSWORD}
        registry: "quay.io"
        requires:
          - filter-skopeo-docker-io
          - filter-skopeo-eu-gcr-io
          - filter-skopeo-gcr-io
          - filter-skopeo-ghcr-io
          - filter-skopeo-mcr-microsoft-com
          - filter-skopeo-public-ecr-aws
          - filter-skopeo-quay-io
          - filter-skopeo-k8s-io
          - filter-skopeo-k8s-io-kubernetes
        matrix:
          parameters:
            images_file:
              - images/skopeo-docker-io.yaml.filtered
              - images/skopeo-eu-gcr-io.yaml.filtered
              - images/skopeo-gcr-io.yaml.filtered
              - images/skopeo-ghcr-io.yaml.filtered
              - images/skopeo-mcr-microsoft-com.yaml.filtered
              - images/skopeo-public-ecr-aws.yaml.filtered
              - images/skopeo-quay-io.yaml.filtered
              - images/skopeo-registry-k8s-io.yaml.filtered
              - images/skopeo-registry-k8s-io-kubernetes.yaml.filtered
    - retag-registry:
        context: architect
        name: retag-aliyun-<<matrix.images_file>>
        username: ${ALIYUN_USERNAME}
        password: ${ALIYUN_PASSWORD}
        registry: "giantswarm-registry.cn-shanghai.cr.aliyuncs.com"
        requires:
          - filter-skopeo-docker-io
          - filter-skopeo-eu-gcr-io
          - filter-skopeo-gcr-io
          - filter-skopeo-ghcr-io
          - filter-skopeo-mcr-microsoft-com
          - filter-skopeo-public-ecr-aws
          - filter-skopeo-quay-io
          - filter-skopeo-k8s-io
          - filter-skopeo-k8s-io-kubernetes
        matrix:
          parameters:
            images_file:
              - images/skopeo-docker-io.yaml.filtered
              - images/skopeo-eu-gcr-io.yaml.filtered
              - images/skopeo-gcr-io.yaml.filtered
              - images/skopeo-ghcr-io.yaml.filtered
              - images/skopeo-mcr-microsoft-com.yaml.filtered
              - images/skopeo-public-ecr-aws.yaml.filtered
              - images/skopeo-quay-io.yaml.filtered
              - images/skopeo-registry-k8s-io.yaml.filtered
              - images/skopeo-registry-k8s-io-kubernetes.yaml.filtered
    - retag-registry:
        context: architect
        name: retag-gsoci-<<matrix.images_file>>
        username: ${ACR_GSOCI_RETAGGER_USERNAME}
        password: ${ACR_GSOCI_RETAGGER_PASSWORD}
        registry: "gsoci.azurecr.io"
        requires:
          - filter-skopeo-docker-io
          - filter-skopeo-eu-gcr-io
          - filter-skopeo-gcr-io
          - filter-skopeo-ghcr-io
          - filter-skopeo-mcr-microsoft-com
          - filter-skopeo-public-ecr-aws
          - filter-skopeo-quay-io
          - filter-skopeo-k8s-io
          - filter-skopeo-k8s-io-kubernetes
        matrix:
          parameters:
            images_file:
              - images/skopeo-docker-io.yaml.filtered
              - images/skopeo-eu-gcr-io.yaml.filtered
              - images/skopeo-gcr-io.yaml.filtered
              - images/skopeo-ghcr-io.yaml.filtered
              - images/skopeo-mcr-microsoft-com.yaml.filtered
              - images/skopeo-public-ecr-aws.yaml.filtered
              - images/skopeo-quay-io.yaml.filtered
              - images/skopeo-registry-k8s-io.yaml.filtered
              - images/skopeo-registry-k8s-io-kubernetes.yaml.filtered
    - retag-customized-images:
        context: architect
        name: retag-customized-images
        requires:
          - build-and-push-docker
        executor_count: 5
        filters:
          branches:
            only:
              - main
        matrix:
          parameters:
            # i in range(executor_count)
            executor_id: [0, 1, 2, 3, 4]

    - ping-heartbeat:
        name: ping-heartbeat
        # Ideally we would wait for the end of the workflow. But we don't know what the last job is, since it's a matrix executed in parallel.
        # So this is better than nothing.
        requires:
          - filter-skopeo-k8s-io-kubernetes

workflows:
  build_retag:
    <<: *build_and_retag

  # Runs nightly at 21:38 UTC
  build_retag_nightly:
    triggers:
      - schedule:
          cron: "38 21 * * *"
          filters:
            branches:
              only: main
    <<: *build_and_retag