Fix loading the PGP WKD and AST explorer into the homepage image.

This version does not launch the ssh agent if no keys are mounted.

.webhook_bridge/pipeline-build-homepage-staging.yaml

@@ -123,7 +123,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 3411d0cd39a749464bbf70ba40e2ca83ee9e2d02
+              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -136,6 +136,8 @@ spec:
             value: $(params.path-to-dockerfile)
           - name: EXTRA_ARGS
             value:
+              - "--opt"
+              - "target=$(params.target-name)"
               - --import-cache
               - "type=registry,ref=$(params.image-name):buildcache"
               - --export-cache
@@ -230,36 +232,6 @@ spec:
             requests:
               storage: 10Gi
       subPath: rust-source
-    - name: git-source-private
-      volumeClaimTemplate:
-        spec:
-          storageClassName: "nfs-client"
-          accessModes:
-            - ReadWriteOnce
-          resources:
-            requests:
-              storage: 10Gi
-      subPath: git-source
-    - name: git-source-explorer
-      volumeClaimTemplate:
-        spec:
-          storageClassName: "nfs-client"
-          accessModes:
-            - ReadWriteOnce
-          resources:
-            requests:
-              storage: 10Gi
-      subPath: git-source
-    - name: git-source-organic
-      volumeClaimTemplate:
-        spec:
-          storageClassName: "nfs-client"
-          accessModes:
-            - ReadWriteOnce
-          resources:
-            requests:
-              storage: 10Gi
-      subPath: git-source
     - name: docker-credentials
       secret:
         secretName: harbor-plain

.webhook_bridge/pipeline-build-homepage.yaml

@@ -24,7 +24,7 @@ spec:
         description: The path to the Dockerfile
         type: string
     tasks:
-      - name: get-time
+      - name: get-git-commit-time
         taskSpec:
           metadata: {}
           stepTemplate:
@@ -33,17 +33,22 @@ spec:
               requests:
                 cpu: 10m
                 memory: 600Mi
-            workingDir: "/"
+            workingDir: "$(workspaces.repo.path)"
           results:
             - name: unix-time
-              description: The current date in unix timestamp format.
+              description: The time of the git commit in unix timestamp format.
           steps:
-            - image: alpine:3.20
+            - image: alpine/git:v2.34.2
-              name: get-time-step
+              name: detect-tag-step
               script: |
                 #!/usr/bin/env sh
                 set -euo pipefail
-                echo -n "$(date +%s)" | tee $(results.unix-time.path)
+                echo -n "$(git log -1 --pretty=%ct)" | tee $(results.unix-time.path)
+        workspaces:
+          - name: repo
+            workspace: git-source
+        runAfter:
+          - fetch-repository
       - name: detect-tag
         taskSpec:
           metadata: {}
@@ -88,9 +93,6 @@ spec:
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
         runAfter:
           - fetch-repository
-          - fetch-repository-private
-          - fetch-repository-explorer
-          - fetch-repository-organic
         params:
           - name: CONTEXT
             value: "$(params.JOB_NAME)"
@@ -126,218 +128,49 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
-      - name: fetch-repository-private
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source-private
-        params:
-          - name: url
-            value: git@code.fizz.buzz:talexander/homepage_private.git
-          - name: revision
-            value: main
-          - name: deleteExisting
-            value: "true"
-      - name: fetch-repository-explorer
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source-explorer
-        params:
-          - name: url
-            value: git@code.fizz.buzz:talexander/organic_ast_explorer.git
-          - name: revision
-            value: main
-          - name: deleteExisting
-            value: "true"
-      - name: fetch-repository-organic
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source-organic
-        params:
-          - name: url
-            value: git@code.fizz.buzz:talexander/organic.git
-          - name: revision
-            value: main
-          - name: deleteExisting
-            value: "true"
-      - name: copy-private-files
-        taskSpec:
-          metadata: {}
-          stepTemplate:
-            image: alpine:3.20
-            computeResources:
-              requests:
-                cpu: 10m
-                memory: 600Mi
-            workingDir: "$(workspaces.source.path)"
-          steps:
-            - image: alpine:3.20
-              name: copy-private-files
-              script: |
-                #!/usr/bin/env sh
-                set -euo pipefail
-                cp -r "$(workspaces.source-private.path)/static/"* "$(workspaces.source.path)/static/"
-        workspaces:
-          - name: source
-            workspace: git-source
-          - name: source-private
-            workspace: git-source-private
-        runAfter:
-          - fetch-repository
-          - fetch-repository-private
-      - name: build-explorer-image
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/kaniko/0.6/kaniko.yaml
-        params:
-          - name: IMAGE
-            value: "harbor.fizz.buzz/private/homepage-build-organic:$(tasks.get-time.results.unix-time)"
-          - name: CONTEXT
-            value: .
-          - name: DOCKERFILE
-            value: docker/organic/Dockerfile
-          - name: BUILDER_IMAGE
-            value: "gcr.io/kaniko-project/executor:v1.23.2"
-          - name: EXTRA_ARGS
-            value:
-              - "--destination=harbor.fizz.buzz/private/homepage-build-organic" # Also write the :latest image
-              - "--target="
-              - --cache=true
-              - --cache-copy-layers
-              - --cache-repo=harbor.fizz.buzz/kanikocache/cache
-              - --use-new-run # Should result in a speed-up
-              - --reproducible # To remove timestamps so layer caching works.
-              - --snapshot-mode=redo
-              - --skip-unused-stages=true
-              - --registry-mirror=dockerhub.dockerhub.svc.cluster.local
-        workspaces:
-          - name: source
-            workspace: git-source
-          - name: dockerconfig
-            workspace: docker-credentials
-        runAfter:
-          - fetch-repository
-      - name: build-explorer-wasm
-        taskSpec:
-          metadata: {}
-          stepTemplate:
-            image: alpine:3.20
-            computeResources:
-              requests:
-                cpu: 10m
-                memory: 600Mi
-            workingDir: "$(workspaces.organic.path)"
-          steps:
-            - image: "$(params.IMAGE)"
-              name: build-explorer-wasm
-        params:
-          - name: IMAGE
-            value: "harbor.fizz.buzz/private/homepage-build-organic:$(tasks.get-time.results.unix-time)"
-        workspaces:
-          - name: organic
-            workspace: git-source-organic
-        runAfter:
-          - build-explorer-image
-      - name: copy-explorer-files
-        taskSpec:
-          metadata: {}
-          stepTemplate:
-            image: alpine:3.20
-            computeResources:
-              requests:
-                cpu: 10m
-                memory: 600Mi
-            workingDir: "$(workspaces.source-explorer.path)"
-          steps:
-            - image: node:lts-alpine3.20
-              name: copy-explorer-files
-              script: |
-                #!/usr/bin/env sh
-                set -euo pipefail
-                npm install
-                npm run release
-                mkdir -p "$(workspaces.source.path)/static/organic/ast_explorer/"
-                cp -r "$(workspaces.source-explorer.path)/dist/"* "$(workspaces.source.path)/static/organic/ast_explorer/"
-        workspaces:
-          - name: source
-            workspace: git-source
-          - name: source-explorer
-            workspace: git-source-explorer
-          - name: organic
-            workspace: git-source-organic
-        runAfter:
-          - build-explorer-wasm
       - name: build-image
         taskRef:
           resolver: git
           params:
             - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: 7ee31a185243ee6da13dcd26a592c585b64c80e5
             - name: pathInRepo
-              value: task/kaniko/0.6/kaniko.yaml
+              value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
-          - name: IMAGE
+          - name: OUTPUT
-            value: "$(params.image-name):$(tasks.detect-tag.results.tag)"
+            value: >-
+              type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.detect-tag.results.tag)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true
           - name: CONTEXT
             value: $(params.path-to-image-context)
           - name: DOCKERFILE
             value: $(params.path-to-dockerfile)
-          - name: BUILDER_IMAGE
-            value: "gcr.io/kaniko-project/executor:v1.23.2"
           - name: EXTRA_ARGS
             value:
-              - "--destination=$(params.image-name)" # Also write the :latest image
+              - "--opt"
-              - "--target=$(params.target-name)"
+              - "target=$(params.target-name)"
-              - --cache=true
+              - --import-cache
-              - --cache-copy-layers
+              - "type=registry,ref=$(params.image-name):buildcache"
-              - --cache-repo=harbor.fizz.buzz/kanikocache/cache
+              - --export-cache
-              - --use-new-run # Should result in a speed-up
+              - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
-              - --reproducible # To remove timestamps so layer caching works.
+              - --opt
-              - --snapshot-mode=redo
+              - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --skip-unused-stages=true
+          - name: BUILDKITD_TOML
-              - --registry-mirror=dockerhub.dockerhub.svc.cluster.local
+            value: |
+              debug = true
+              [registry."docker.io"]
+                mirrors = ["dockerhub.dockerhub.svc.cluster.local"]
+              [registry."dockerhub.dockerhub.svc.cluster.local"]
+                http = true
+                insecure = true
         workspaces:
           - name: source
             workspace: git-source
           - name: dockerconfig
             workspace: docker-credentials
         runAfter:
-          - copy-private-files
+          - fetch-repository
-          - copy-explorer-files
     finally:
       - name: report-success
         when:
@@ -411,36 +244,6 @@ spec:
             requests:
               storage: 10Gi
       subPath: rust-source
-    - name: git-source-private
-      volumeClaimTemplate:
-        spec:
-          storageClassName: "nfs-client"
-          accessModes:
-            - ReadWriteOnce
-          resources:
-            requests:
-              storage: 10Gi
-      subPath: git-source
-    - name: git-source-explorer
-      volumeClaimTemplate:
-        spec:
-          storageClassName: "nfs-client"
-          accessModes:
-            - ReadWriteOnce
-          resources:
-            requests:
-              storage: 10Gi
-      subPath: git-source
-    - name: git-source-organic
-      volumeClaimTemplate:
-        spec:
-          storageClassName: "nfs-client"
-          accessModes:
-            - ReadWriteOnce
-          resources:
-            requests:
-              storage: 10Gi
-      subPath: git-source
     - name: docker-credentials
       secret:
         secretName: harbor-plain
@@ -452,4 +255,4 @@ spec:
     - name: path-to-image-context
       value: .
     - name: path-to-dockerfile
-      value: docker/server/Dockerfile
+      value: docker/server

docker/server/Dockerfile

@@ -49,8 +49,8 @@ RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/re
 FROM alpine:$ALPINE_VERSION AS natter
 COPY --link --from=natter-build /target/release-lto/natter /usr/bin/
 COPY --link . /source
-COPY --link --from=private /homepage_private/static/* /source/static/
+COPY --link --from=private /homepage_private/static /source/static/
-COPY --link --from=explorer-build /organic_ast_explorer/dist/* /source/static/organic/ast_explorer/
+COPY --link --from=explorer-build /organic_ast_explorer/dist /source/static/organic/ast_explorer/
 RUN --network=none --mount=type=tmpfs,target=/tmp natter build --config /source/natter.toml