stack-bootstrap-pipeline.yaml

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: stack-bootstrap
  labels:
    app.kubernetes.io/part-of: tekton-job-standardization
    app.kubernetes.io/version: "1.0.0"
spec:
  description: >
    One-time bootstrap: clone, resolve, build all stack apps, deploy full stack.
    Run this so the cluster has every app running (Services by app name). Then run
    stack-pr-test with a changed-app to add intercepts and run E2E.
  params:
    - name: git-url
      description: "Platform repo URL (has stacks/; app repos come from stack)"
    - name: git-revision
      description: "Branch, tag, or SHA"
    - name: stack-file
      description: "Path to stack YAML relative to repo root"
      default: "stacks/stack-one.yaml"
    - name: image-registry
      description: "Container registry base (e.g. localhost:5000)"
    - name: image-tag
      description: "Tag for base images (e.g. base-1)"
      default: "base-1"
    - name: compile-image-npm
      description: "Image for npm compile step"
      default: ""
    - name: compile-image-maven
      description: "Image for Maven compile step"
      default: ""
    - name: compile-image-gradle
      description: "Image for Gradle compile step"
      default: ""
    - name: compile-image-pip
      description: "Image for pip compile step"
      default: ""
    - name: compile-image-php
      description: "Image for Composer/PHP compile step"
      default: ""
    - name: cache-repo
      description: "Kaniko cache repo. Empty disables cache."
      default: ""
    - name: max-parallel-builds
      description: "Max concurrent Kaniko pods for containerize. 0 = unlimited."
      default: "0"
    - name: pre-build-task
      description: "Optional Tekton Task to run after clone, before compile. Empty = skip."
      default: ""
    - name: post-build-task
      description: "Optional Tekton Task to run after containerize, before deploy. Empty = skip."
      default: ""
  workspaces:
    - name: shared-workspace
    - name: ssh-key
      description: "Volume with SSH key (id_ed25519 or id_rsa) for cloning app repos; required for SSH pull"
    - name: build-cache
      optional: true
      description: "Persistent dependency cache (.m2, .npm, etc.). Create once, reuse across runs."
  tasks:
    - name: fetch-source
      taskRef:
        name: git-clone
      params:
        - name: url
          value: $(params.git-url)
        - name: revision
          value: $(params.git-revision)
        - name: deleteExisting
          value: "true"
      workspaces:
        - name: output
          workspace: shared-workspace

    - name: resolve-stack
      taskRef:
        name: resolve-stack
      params:
        - name: stack-file
          value: $(params.stack-file)
        - name: version-overrides
          value: "{}"
      workspaces:
        - name: source
          workspace: shared-workspace
      runAfter:
        - fetch-source

    - name: clone-app-repos
      taskRef:
        name: clone-app-repos
      params:
        - name: stack-json
          value: $(tasks.resolve-stack.results.stack-json)
        - name: build-apps
          value: $(tasks.resolve-stack.results.build-apps)
        - name: git-revision
          value: $(params.git-revision)
      workspaces:
        - name: source
          workspace: shared-workspace
        - name: ssh-key
          workspace: ssh-key
      runAfter:
        - resolve-stack

    - name: build-select-tool-apps
      taskRef:
        name: build-select-tool-apps
      params:
        - name: stack-json
          value: $(tasks.resolve-stack.results.stack-json)
        - name: build-apps
          value: $(tasks.resolve-stack.results.build-apps)
      workspaces:
        - name: source
          workspace: shared-workspace
      runAfter:
        - clone-app-repos

    # Hook: pre-build (after clone, before compile). Skipped when param is empty.
    - name: hook-pre-build
      when:
        - input: $(params.pre-build-task)
          operator: notin
          values: [""]
      taskRef:
        name: $(params.pre-build-task)
      params:
        - name: stack-json
          value: $(tasks.resolve-stack.results.stack-json)
        - name: build-apps
          value: $(tasks.resolve-stack.results.build-apps)
        - name: image-registry
          value: $(params.image-registry)
      workspaces:
        - name: source
          workspace: shared-workspace
      runAfter:
        - build-select-tool-apps

    - name: build-compile-npm
      when:
        - input: $(tasks.resolve-stack.results.run-compile-npm)
          operator: in
          values: ["true"]
      taskRef:
        name: build-compile-npm
      params:
        - name: stack-json
          value: $(tasks.resolve-stack.results.stack-json)
        - name: compile-image-npm
          value: $(params.compile-image-npm)
      workspaces:
        - name: source
          workspace: shared-workspace
        - name: build-cache
          workspace: build-cache
      runAfter:
        - build-select-tool-apps

    - name: build-compile-maven
      when:
        - input: $(tasks.resolve-stack.results.run-compile-maven)
          operator: in
          values: ["true"]
      taskRef:
        name: build-compile-maven
      params:
        - name: stack-json
          value: $(tasks.resolve-stack.results.stack-json)
        - name: compile-image-maven
          value: $(params.compile-image-maven)
      workspaces:
        - name: source
          workspace: shared-workspace
        - name: build-cache
          workspace: build-cache
      runAfter:
        - build-select-tool-apps

    - name: build-compile-gradle
      when:
        - input: $(tasks.resolve-stack.results.run-compile-gradle)
          operator: in
          values: ["true"]
      taskRef:
        name: build-compile-gradle
      params:
        - name: stack-json
          value: $(tasks.resolve-stack.results.stack-json)
        - name: compile-image-gradle
          value: $(params.compile-image-gradle)
      workspaces:
        - name: source
          workspace: shared-workspace
        - name: build-cache
          workspace: build-cache
      runAfter:
        - build-select-tool-apps

    - name: build-compile-pip
      when:
        - input: $(tasks.resolve-stack.results.run-compile-pip)
          operator: in
          values: ["true"]
      taskRef:
        name: build-compile-pip
      params:
        - name: stack-json
          value: $(tasks.resolve-stack.results.stack-json)
        - name: compile-image-pip
          value: $(params.compile-image-pip)
      workspaces:
        - name: source
          workspace: shared-workspace
        - name: build-cache
          workspace: build-cache
      runAfter:
        - build-select-tool-apps

    - name: build-compile-composer
      when:
        - input: $(tasks.resolve-stack.results.run-compile-composer)
          operator: in
          values: ["true"]
      taskRef:
        name: build-compile-composer
      params:
        - name: stack-json
          value: $(tasks.resolve-stack.results.stack-json)
        - name: compile-image-php
          value: $(params.compile-image-php)
      workspaces:
        - name: source
          workspace: shared-workspace
        - name: build-cache
          workspace: build-cache
      runAfter:
        - build-select-tool-apps

    - name: build-containerize
      taskRef:
        name: build-containerize
      params:
        - name: stack-json
          value: $(tasks.resolve-stack.results.stack-json)
        - name: build-apps
          value: $(tasks.resolve-stack.results.build-apps)
        - name: image-registry
          value: $(params.image-registry)
        - name: image-tag
          value: $(params.image-tag)
        - name: tag-prefix
          value: ""
        - name: cache-repo
          value: $(params.cache-repo)
        - name: max-parallel-builds
          value: $(params.max-parallel-builds)
      workspaces:
        - name: source
          workspace: shared-workspace
      runAfter:
        - build-compile-npm
        - build-compile-maven
        - build-compile-gradle
        - build-compile-pip
        - build-compile-composer

    # Hook: post-build (after containerize, before deploy). Skipped when param is empty.
    - name: hook-post-build
      when:
        - input: $(params.post-build-task)
          operator: notin
          values: [""]
      taskRef:
        name: $(params.post-build-task)
      params:
        - name: stack-json
          value: $(tasks.resolve-stack.results.stack-json)
        - name: build-apps
          value: $(tasks.resolve-stack.results.build-apps)
        - name: built-images
          value: $(tasks.build-containerize.results.built-images)
        - name: image-registry
          value: $(params.image-registry)
      workspaces:
        - name: source
          workspace: shared-workspace
      runAfter:
        - build-containerize

    - name: deploy-full-stack
      taskRef:
        name: deploy-full-stack
      params:
        - name: stack-json
          value: $(tasks.resolve-stack.results.stack-json)
        - name: built-images
          value: $(tasks.build-containerize.results.built-images)
        - name: default-namespace
          value: "staging"
      runAfter:
        - build-containerize