nfs-volume-release.yml

---
#  This pipeline is set automatically, any non-committed changes will be lost.
#
# To set the pipeline, run:
#    fly -t cryo-runway set-pipeline -p nfs-volume-release -c nfs-volume-release.yml
#
#! ************************************
#! Secrets we need to run this pipeline
#! ************************************
cerberus_secrets:
- &gcr_viewer_key  ((gcr.viewer_key))
#! gcr_viewer_key was needed on 2024-03-24 for getting concourse container images from our GCR instance. Generated by using personal creds to log into the mapbu-cryogenics google cloud project.

- &aws_nfsvolume_uploader_role_arn ((aws/nfsvolume-uploader.role_arn))
#! aws_nfsvolume_uploader_role_arn was needed on 2023-10-05 for defining the AWS role assumed when accessing the
#! S3 bucket that (1) stores the version file used to keep track of the next version; (2) serves as BOSH blobstore for
#! this release. The token was given to us by the Volume Services team. It lives in Runway's Vault under the path:
#    'runway_concourse/cryogenics'.

- &aws_nfsvolume_uploader_role_id ((aws/nfsvolume-uploader.role_id))
#! aws_nfsvolume_uploader_role_id was needed on 2023-10-05 for defining the AWS Access Key for accessing the S3 bucket
#! that (1) stores the version file used to keep track of the next version; (2) serves as BOSH blobstore for this
#! release. The token was given to us by the Volume Services team. It lives in Runway's Vault under the path:
#!   'runway_concourse/cryogenics'.

- &aws_nfsvolume_uploader_role_secret ((aws/nfsvolume-uploader.role_secret))
#! aws_nfsvolume_uploader_role_secret was needed on 2023-10-05 for defining the AWS Access Secret for accessing the
#! S3 bucket that (1) stores the version file used to keep track of the next version; (2) serves as BOSH blobstore
#! for this release. The token was given to us by the Volume Services team. It lives in Runway's Vault under the
#! path: 'runway_concourse/cryogenics'.

- &github_access_token ((github.access_token))
#! github_access_token was needed on 2023-10-05 for accessing the GitHub API in order to consume PRs, create and
#! download releases. Generated using GitHub account and lives in Lastpass.

- &github_email ((github.email))
#! github_email was needed on 2023-10-05 for Git commits when creating a new release. It lives in Runway's Vault.

- &github_ssh_key ((github.ssh_key))
#! github_ssh_key was needed on 2023-10-05 by the git-resource to access various Git repos via SSH. Generated using
#! GitHub account and lives in Runway's Vault.

- &github_user ((github.user))
#! github_user was needed on 2023-10-05 for Git commits when creating a new release. It lives in Runway's Vault as
#! well as in Lastpass.

- &gchat_webhook ((gchat-webhook.url))
#! as of 23/04/2024 gchat webhook is used to send us ci status messages. It was created in gchat space settings after logging in with personal creds

- &shepherd_account_key ((shepherd.sa_key))
#! shepherd_account_key was needed on 2023-09-28 to claim shepherd environments. It was created using
#! `shepherd create service-account` after logging in with WS1.


#! **************
#! End of secrets
#! **************

pipeline_config:
- &number_of_retries 2
- &number_of_claim_env_retries 5


groups:
- name: test
  jobs:
  - nfs-volume-release-job-tests
  - mapfs-release-job-tests
  - claim-ldap-env
  - deploy-cf-with-ldap
  - pats-nfs-ldap
  - unclaim-ldap-env
  - claim-env
  - deploy-cf
  - pats
  - cats-nfs
  - drats
  - unclaim-env
  - merge-pr
  - check-for-cves
- name: bump
  jobs:
  - bump-nfs-utils
  - bump-sqlite
  - bump-libevent
  - bump-rpcsvc-proto
  - bump-libtirpc
  - bump-rpcbind
  - bump-tcl
  - bump-util-linux
  - bump-golang
  - bump-openldap
  - bump-openssl
  - update-go-directive-for-nfsv3driver
  - update-go-directive-for-nfsbroker
  - update-go-directive-for-volumedriver
  - update-go-directive-for-volume-mount-options
  - update-go-directive-for-existingvolumebroker
  - update-go-directive-for-service-broker-store
- name: release
  jobs:
  - check-for-changes
  - shipit-nfs
  - manual-bump-nfs-major
  - manual-bump-nfs-patch
  - manual-bump-nfs-minor

resources:
- name: stemcell
  type: bosh-io-stemcell
  source:
    name: bosh-warden-boshlite-ubuntu-jammy-go_agent
- name: bosh-docker-cpi
  source:
    password: *gcr_viewer_key
    repository: us-west2-docker.pkg.dev/mapbu-cryogenics/dockerhub-proxy-cache/bosh/docker-cpi
    username: _json_key
  type: registry-image

- name: openssl
  type: github-release
  source:
    owner: openssl
    repository: openssl
    tag_filter: ^openssl-?([0-9]+\.[0-9]+\.[0-9]+)$
    access_token: *github_access_token

- name: git-concourse-cve-scan
  type: git
  source:
    uri: git@github.com:pivotal/concourse-cve-scan.git
    branch: feat/add-vex-consideration
    private_key: *github_ssh_key

- name: image-cryogenics-essentials
  type: registry-image
  source:
    repository: us-west2-docker.pkg.dev/mapbu-cryogenics/essentials/cryo-essentials
    username: _json_key
    password: *gcr_viewer_key

- name: git-tas-vex
  type: git
  source:
    uri: git@github.com:pivotal/tas-vex.git
    branch: main
    private_key: *github_ssh_key

- name: github-release-tas-cve
  type: github-release
  source:
    access_token: *github_access_token
    repository: tas-cve
    user: pivotal

- name: gchat-cryo-notification
  type: google-chat-notify-resource
  source:
    url: *gchat_webhook

- name: every-week
  type: time
  source:
    interval: 168h  # 24h*7days

- name: python-394
  type: registry-image
  icon: docker
  source:
    repository: us-west2-docker.pkg.dev/mapbu-cryogenics/dockerhub-proxy-cache/python
    username: _json_key
    password: *gcr_viewer_key
    tag: 3.9.4

- name: cryogenics-concourse-tasks
  type: git
  icon: github
  source:
    uri: git@github.com:pivotal/cryogenics-concourse-tasks.git
    branch: main
    private_key: *github_ssh_key

- name: openldap-version
  type: uscan
  source:
    watchfile: |
      version=4
      https://www.openldap.org/software/download/OpenLDAP/openldap-release/ openldap-(2.[\d\.]+)\.tgz

- name: nfs-utils-version
  type: uscan
  source:
    watchfile: |
      version=4
      https://www.kernel.org/pub/linux/utils/nfs-utils/([\d\.]+)/nfs-utils-([\d\.]+).tar.xz

- name: libtirpc-version
  type: uscan
  source:
    watchfile: |
      version=4
      https://sf.net/libtirpc/ libtirpc-(.+)\.tar\.bz2

- name: rpcbind-version
  type: uscan
  source:
    watchfile: |
      version=4
      https://sf.net/rpcbind/ rpcbind-(.+)\.tar\.bz2

- name: tcl-version
  type: uscan
  source:
    watchfile: |
      version=4
      https://sf.net/tcl/ tcl([1-9]\d*\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*))-src\.tar\.gz

- name: sqlite-release
  type: git
  source:
    uri: git@github.com:sqlite/sqlite.git
    tag_filter: version-*
    private_key: *github_ssh_key

- name: util-linux
  source:
    url: https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/*
    version_regex: util-linux-(?P<version>[0-9][0-9.]+[0-9]).tar.gz$
  type: http

- name: libevent-release
  type: github-release
  source:
    owner: libevent
    repository: libevent
    tag_filter: release-([\d\.]+\d+)-stable
    access_token: *github_access_token

- name: rpcsvc-proto-release
  type: github-release
  source:
    owner: thkukuk
    repository: rpcsvc-proto
    tag_filter: v([\d\.]+\d+)
    access_token: *github_access_token

- name: env-tas-jammy
  icon: pool
  type: shepherd
  source:
    url: https://v2.shepherd.run
    service-account-key: *shepherd_account_key
    compatibility-mode: environments-app
    lease:
      namespace: cryogenics
      pool:
        namespace: official
        name: tas-5_0

- name: env
  icon: pool
  type: shepherd
  source:
    url: https://v2.shepherd.run
    service-account-key: *shepherd_account_key
    compatibility-mode: environments-app
    lease:
      namespace: cryogenics
      pool:
        namespace: official
        name: cfd

- name: persi-ci
  type: git
  source:
    uri: https://github.com/cloudfoundry/persi-ci
    branch: master

- name: nfs-volume-release
  type: pull-request
  source:
    base_branch: master
    access_token: *github_access_token
    repository: cloudfoundry/nfs-volume-release
    disable_forks: true
    autosync_pr: true

- name: nfs-volume-release-write
  type: git
  icon: github
  source:
    private_key: *github_ssh_key
    uri: git@github.com:cloudfoundry/nfs-volume-release.git
    commit_filter:
      exclude:
      - ;resource comment; This resource is used exclusively for pushing new changes

# Resource used to track production changes in the release job so that we don't
# trigger a release with only changes (CI, tests, etc.) that are not relevant to
# customers.
- name: nfs-volume-release-production-files-only
  type: git
  source:
    branch: master
    private_key: *github_ssh_key
    uri: git@github.com:cloudfoundry/nfs-volume-release.git
    paths:
    - .final_builds
    - LICENSE
    - NOTICE
    - config
    - jobs
    - packages
    - releases
    - src

- name: nfs-volume-release-master
  type: git
  source:
    branch: master
    private_key: *github_ssh_key
    uri: git@github.com:cloudfoundry/nfs-volume-release.git

- name: nfsvolume-version
  type: semver
  source:
    access_key_id: *aws_nfsvolume_uploader_role_id
    bucket: nfsvolume-release-versions
    initial_version: 7.0.2
    key: current-version
    region_name: us-east-1
    secret_access_key: *aws_nfsvolume_uploader_role_secret
    assume_role_arn: *aws_nfsvolume_uploader_role_arn

- name: github-release-nfs
  type: github-release
  source:
    user: cloudfoundry
    repository: nfs-volume-release
    drafts: true
    access_token: *github_access_token

- name: mapfs-release
  type: git
  source:
    branch: master
    private_key: *github_ssh_key
    uri: git@github.com:cloudfoundry/mapfs-release.git
    ignore_paths:
    - scripts

- name: mapfs-release-concourse-tasks
  type: git
  source:
    branch: master
    private_key: *github_ssh_key
    uri: git@github.com:cloudfoundry/mapfs-release.git

- name: cf-deployment
  type: git
  source:
    branch: release-candidate
    uri: https://github.com/cloudfoundry/cf-deployment.git

- name: cf-deployment-concourse-tasks
  type: git
  source:
    branch: main
    uri: https://github.com/cloudfoundry/cf-deployment-concourse-tasks.git

- name: cf-volume-services-acceptance-tests
  type: git
  source:
    uri: https://github.com/cloudfoundry/cf-volume-services-acceptance-tests.git
    branch: main

- name: cf-acceptance-tests
  type: git
  source:
    branch: release-candidate
    uri: https://github.com/cloudfoundry/cf-acceptance-tests.git

- name: bbr-binary-release
  type: github-release
  source:
    owner: cloudfoundry-incubator
    repository: bosh-backup-and-restore
    access_token: *github_access_token

- name: disaster-recovery-acceptance-tests
  type: git
  source:
    uri: https://github.com/cloudfoundry-incubator/disaster-recovery-acceptance-tests.git
    branch: main

- name: golang-release
  type: git
  icon: tag
  source:
    uri: https://github.com/bosh-packages/golang-release.git
    tag_filter: v*

- name: nfsv3driver
  type: git
  source:
    uri: git@github.com:cloudfoundry/nfsv3driver.git
    branch: master
    private_key: *github_ssh_key

- name: nfsv3driver-write
  type: git
  source:
    uri: git@github.com:cloudfoundry/nfsv3driver.git
    private_key: *github_ssh_key
    commit_filter:
      exclude:
      - ;resource comment; This resource is used exclusively for pushing new changes

- name: nfsbroker
  type: git
  source:
    uri: git@github.com:cloudfoundry/nfsbroker.git
    branch: master
    private_key: *github_ssh_key

- name: nfsbroker-write
  type: git
  source:
    uri: git@github.com:cloudfoundry/nfsbroker.git
    private_key: *github_ssh_key
    commit_filter:
      exclude:
      - ;resource comment; This resource is used exclusively for pushing new changes

- name: service-broker-store
  type: git
  source:
    uri: git@github.com:cloudfoundry/service-broker-store.git
    branch: master
    private_key: *github_ssh_key

- name: service-broker-store-write
  type: git
  source:
    uri: git@github.com:cloudfoundry/service-broker-store.git
    private_key: *github_ssh_key
    commit_filter:
      exclude:
      - ;resource comment; This resource is used exclusively for pushing new changes


- name: existingvolumebroker
  type: git
  source:
    uri: git@github.com:cloudfoundry/existingvolumebroker.git
    branch: master
    private_key: *github_ssh_key

- name: existingvolumebroker-write
  type: git
  source:
    uri: git@github.com:cloudfoundry/existingvolumebroker.git
    private_key: *github_ssh_key
    commit_filter:
      exclude:
      - ;resource comment; This resource is used exclusively for pushing new changes

- name: volume-mount-options
  type: git
  source:
    uri: git@github.com:cloudfoundry/volume-mount-options.git
    branch: master
    private_key: *github_ssh_key

- name: volume-mount-options-write
  type: git
  source:
    uri: git@github.com:cloudfoundry/volume-mount-options.git
    private_key: *github_ssh_key
    commit_filter:
      exclude:
      - ;resource comment; This resource is used exclusively for pushing new changes

- name: volumedriver
  type: git
  source:
    uri: git@github.com:cloudfoundry/volumedriver.git
    branch: master
    private_key: *github_ssh_key

- name: volumedriver-write
  type: git
  source:
    uri: git@github.com:cloudfoundry/volumedriver.git
    private_key: *github_ssh_key
    commit_filter:
      exclude:
      - ;resource comment; This resource is used exclusively for pushing new changes


resource_types:
- name: git
  type: registry-image
  source:
    repository: us-west2-docker.pkg.dev/mapbu-cryogenics/dockerhub-proxy-cache/concourse/git-resource
    tag: ubuntu
    username: _json_key
    password: *gcr_viewer_key

- name: http
  source:
    repository: us-west2-docker.pkg.dev/mapbu-cryogenics/concourse-resources/concourse-ftp-resource
    username: _json_key
    password: *gcr_viewer_key
  type: registry-image

- name: semver
  type: registry-image
  source:
    repository: us-west2-docker.pkg.dev/mapbu-cryogenics/dockerhub-proxy-cache/concourse/semver-resource
    username: _json_key
    password: *gcr_viewer_key

- name: google-chat-notify-resource
  type: registry-image
  source:
    repository:  us-west2-docker.pkg.dev/mapbu-cryogenics/dockerhub-proxy-cache/springio/google-chat-notify-resource
    username: _json_key
    password: *gcr_viewer_key
    tag: 0.0.1-SNAPSHOT

- name: uscan
  source:
    repository: us-west2-docker.pkg.dev/mapbu-cryogenics/concourse-resources/concourse-uscan-resource
    username: _json_key
    password: *gcr_viewer_key
  type: registry-image

- name: shepherd
  source:
    tag: v1
    repository: us-west2-docker.pkg.dev/shepherd-268822/shepherd2/concourse-resource
    username: _json_key
    password: *gcr_viewer_key
  type: registry-image

- name: pull-request
  type: registry-image
  source:
    repository: us-west2-docker.pkg.dev/mapbu-cryogenics/dockerhub-proxy-cache/cryogenics/pr-queue-resource
    username: _json_key
    password: *gcr_viewer_key

jobs:
- name: check-for-cves
  plan:
  - in_parallel:
    - get: git-concourse-cve-scan
    - get: github-release-tas-cve
    - get: nfs-volume-release
      trigger: true
    - get: git-tas-vex
  - task: run-scan
    file: git-concourse-cve-scan/tasks/scan/scan.yml
    input_mapping:
      concourse-cve-scan: git-concourse-cve-scan
      tas-cve: github-release-tas-cve
      target-bosh-release: nfs-volume-release
      tas-vex: git-tas-vex
    params:
      DRY_RUN: true
      GRYPE_FAILURE_LEVEL: negligible  #! Can be any of: none | negligible | low | medium | high | critical
      RELEASE_NAME: nfs-volume
      RELEASE_VERSION: pre-release-cve-scan

- name: bump-nfs-utils
  serial: true
  plan:
  - in_parallel:
    - get: nfs-utils-version
      trigger: true
    - get: image-cryogenics-essentials
    - get: cryogenics-concourse-tasks
    - get: nfs-volume-release-master
  - load_var: nfs-utils
    file: nfs-utils-version/version
    format: json
  - task: download-nfs-utils
    image: image-cryogenics-essentials
    config:
      platform: linux
      params:
        NEW_VERSION: ((.:nfs-utils.version.ref))
      run:
        path: /bin/sh
        args:
        - -c
        - |
          set -e
          wget -O "nfs-debs-nfs-utils/nfs-utils-${NEW_VERSION}.tar.xz" "https://www.kernel.org/pub/linux/utils/nfs-utils/${NEW_VERSION}/nfs-utils-${NEW_VERSION}.tar.xz"
          echo ${NEW_VERSION} > nfs-debs-nfs-utils/version
      outputs:
      - name: nfs-debs-nfs-utils
  - task: bump-nfs-utils
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/deps-automation/bump-blob/task.yml
    input_mapping:
      distributed-package: nfs-debs-nfs-utils
      bosh-release: nfs-volume-release-master
    output_mapping:
      bosh-release-updated: nfs-volume-release-write
    params:
      AWS_ACCESS_KEY_ID: *aws_nfsvolume_uploader_role_id
      AWS_SECRET_ACCESS_KEY: *aws_nfsvolume_uploader_role_secret
      AWS_ROLE_ARN: *aws_nfsvolume_uploader_role_arn
      GIT_USERNAME: *github_user
      GIT_EMAIL: *github_email
      GIT_BRANCH: &nfs-utils-bump-branch bump-nfs-utils-to-v((.:nfs-utils.version.ref))
      BLOB_NAME: nfs-utils
      BLOB_EXTENSION: .tar.xz
      BLOB_DIRECTORY: nfs-debs/
  - put: nfs-volume-release-write
    params:
      repository: nfs-volume-release-write
      force: true
      branch: *nfs-utils-bump-branch
    on_success:
      task: create-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      input_mapping:
        source-repo: nfs-volume-release-write
      params:
        GITHUB_TOKEN: *github_access_token
        BASE: master
        BRANCH: *nfs-utils-bump-branch
        TITLE: "Bump NFS-Utils to v((.:nfs-utils.version.ref))"
        LABELS: dependencies

- name: bump-sqlite
  serial: true
  plan:
  - in_parallel:
    - get: sqlite-release
      trigger: true
    - get: image-cryogenics-essentials
    - get: cryogenics-concourse-tasks
    - get: nfs-volume-release-master
  - load_var: sqlite-version
    file: sqlite-release/VERSION
    format: trim
  - task: download-tarball
    image: image-cryogenics-essentials
    config:
      platform: linux
      params:
        NEW_VERSION: ((.:sqlite-version))
      run:
        path: /bin/sh
        args:
        - -c
        - |
          set -e
          wget -O "nfs-debs-sqlite/sqlite-${NEW_VERSION}.tar.gz" "https://github.com/sqlite/sqlite/archive/refs/tags/version-${NEW_VERSION}.tar.gz"
          echo ${NEW_VERSION} > nfs-debs-sqlite/version
      outputs:
      - name: nfs-debs-sqlite
  - task: bump-sqlite
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/deps-automation/bump-blob/task.yml
    input_mapping:
      distributed-package: nfs-debs-sqlite
      bosh-release: nfs-volume-release-master
    output_mapping:
      bosh-release-updated: nfs-volume-release-write
    params:
      AWS_ACCESS_KEY_ID: *aws_nfsvolume_uploader_role_id
      AWS_SECRET_ACCESS_KEY: *aws_nfsvolume_uploader_role_secret
      AWS_ROLE_ARN: *aws_nfsvolume_uploader_role_arn
      GIT_USERNAME: *github_user
      GIT_EMAIL: *github_email
      GIT_BRANCH: &sqlite-bump-branch bump-sqlite-to-v((.:sqlite-version))
      BLOB_NAME: sqlite
      BLOB_EXTENSION: .tar.gz
      BLOB_DIRECTORY: nfs-debs/
  - put: nfs-volume-release-write
    params:
      repository: nfs-volume-release-write
      force: true
      branch: *sqlite-bump-branch
    on_success:
      task: create-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      input_mapping:
        source-repo: nfs-volume-release-write
      params:
        GITHUB_TOKEN: *github_access_token
        BASE: master
        BRANCH: *sqlite-bump-branch
        TITLE: "Bump SQLite to v((.:sqlite-version))"
        LABELS: dependencies

- name: bump-libevent
  serial: true
  plan:
  - in_parallel:
    - get: libevent-release
      trigger: true
    - get: cryogenics-concourse-tasks
    - get: nfs-volume-release-master
    - get: image-cryogenics-essentials
  - load_var: libevent-version
    file: libevent-release/version
  - task: bump
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/deps-automation/bump-blob/task.yml
    input_mapping:
      distributed-package: libevent-release
      bosh-release: nfs-volume-release-master
    output_mapping:
      bosh-release-updated: nfs-volume-release-write
    params:
      AWS_ACCESS_KEY_ID: *aws_nfsvolume_uploader_role_id
      AWS_SECRET_ACCESS_KEY: *aws_nfsvolume_uploader_role_secret
      AWS_ROLE_ARN: *aws_nfsvolume_uploader_role_arn
      GIT_USERNAME: *github_user
      GIT_EMAIL: *github_email
      GIT_BRANCH: &libevent-bump-branch bump-libevent-to-v((.:libevent-version))
      BLOB_NAME: libevent
      BLOB_EXTENSION: -stable.tar.gz
      BLOB_DIRECTORY: nfs-debs/
  - put: nfs-volume-release-write
    params:
      repository: nfs-volume-release-write
      force: true
      branch: *libevent-bump-branch
    on_success:
      task: create-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      input_mapping:
        source-repo: nfs-volume-release-write
      params:
        GITHUB_TOKEN: *github_access_token
        BASE: master
        BRANCH: *libevent-bump-branch
        TITLE: "Bump Libevent to v((.:libevent-version))"
        LABELS: dependencies

- name: bump-rpcsvc-proto
  serial: true
  plan:
  - in_parallel:
    - get: rpcsvc-proto-release
      trigger: true
    - get: cryogenics-concourse-tasks
    - get: nfs-volume-release-master
    - get: image-cryogenics-essentials
  - load_var: rpcsvc-proto-version
    file: rpcsvc-proto-release/version
  - task: bump
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/deps-automation/bump-blob/task.yml
    input_mapping:
      distributed-package: rpcsvc-proto-release
      bosh-release: nfs-volume-release-master
    output_mapping:
      bosh-release-updated: nfs-volume-release-write
    params:
      AWS_ACCESS_KEY_ID: *aws_nfsvolume_uploader_role_id
      AWS_SECRET_ACCESS_KEY: *aws_nfsvolume_uploader_role_secret
      AWS_ROLE_ARN: *aws_nfsvolume_uploader_role_arn
      GIT_USERNAME: *github_user
      GIT_EMAIL: *github_email
      GIT_BRANCH: &rpcsvc-proto-bump-branch bump-rpcsvc-proto-to-v((.:rpcsvc-proto-version))
      BLOB_NAME: rpcsvc-proto
      BLOB_EXTENSION: .tar.xz
      BLOB_DIRECTORY: nfs-debs/
  - put: nfs-volume-release-write
    params:
      repository: nfs-volume-release-write
      force: true
      branch: *rpcsvc-proto-bump-branch
    on_success:
      task: create-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      input_mapping:
        source-repo: nfs-volume-release-write
      params:
        GITHUB_TOKEN: *github_access_token
        BASE: master
        BRANCH: *rpcsvc-proto-bump-branch
        TITLE: "Bump rpcsvc-proto to v((.:rpcsvc-proto-version))"
        LABELS: dependencies

- name: bump-libtirpc
  serial: true
  plan:
  - in_parallel:
    - get: libtirpc-version
      trigger: true
    - get: image-cryogenics-essentials
    - get: cryogenics-concourse-tasks
    - get: nfs-volume-release-master
  - load_var: libtirpc
    file: libtirpc-version/version
    format: json
  - task: download-libtirpc
    image: image-cryogenics-essentials
    config:
      platform: linux
      params:
        NEW_VERSION: ((.:libtirpc.version.ref))
      run:
        path: /bin/sh
        args:
        - -c
        - |
          set -e
          wget -O "nfs-debs-libtirpc/libtirpc-${NEW_VERSION}.tar.bz2" "https://sourceforge.net/projects/libtirpc/files/libtirpc/${NEW_VERSION}/libtirpc-${NEW_VERSION}.tar.bz2/download"
          echo ${NEW_VERSION} > nfs-debs-libtirpc/version
      outputs:
      - name: nfs-debs-libtirpc
  - task: bump-libtirpc
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/deps-automation/bump-blob/task.yml
    input_mapping:
      distributed-package: nfs-debs-libtirpc
      bosh-release: nfs-volume-release-master
    output_mapping:
      bosh-release-updated: nfs-volume-release-write
    params:
      AWS_ACCESS_KEY_ID: *aws_nfsvolume_uploader_role_id
      AWS_SECRET_ACCESS_KEY: *aws_nfsvolume_uploader_role_secret
      AWS_ROLE_ARN: *aws_nfsvolume_uploader_role_arn
      GIT_USERNAME: *github_user
      GIT_EMAIL: *github_email
      GIT_BRANCH: &libtirpc-bump-branch bump-libtirpc-to-v((.:libtirpc.version.ref))
      BLOB_NAME: libtirpc
      BLOB_EXTENSION: .tar.bz2
      BLOB_DIRECTORY: nfs-debs/
  - put: nfs-volume-release-write
    params:
      repository: nfs-volume-release-write
      force: true
      branch: *libtirpc-bump-branch
    on_success:
      task: create-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      input_mapping:
        source-repo: nfs-volume-release-write
      params:
        GITHUB_TOKEN: *github_access_token
        BASE: master
        BRANCH: *libtirpc-bump-branch
        TITLE: "Bump Libtirpc to v((.:libtirpc.version.ref))"
        LABELS: dependencies

- name: bump-rpcbind
  serial: true
  plan:
  - in_parallel:
    - get: rpcbind-version
      trigger: true
    - get: image-cryogenics-essentials
    - get: cryogenics-concourse-tasks
    - get: nfs-volume-release-master
  - load_var: rpcbind
    file: rpcbind-version/version
    format: json
  - task: download-rpcbind
    image: image-cryogenics-essentials
    config:
      platform: linux
      params:
        NEW_VERSION: ((.:rpcbind.version.ref))
      run:
        path: /bin/sh
        args:
        - -c
        - |
          set -e
          wget -O "nfs-debs-rpcbind/rpcbind-${NEW_VERSION}.tar.bz2" "https://sourceforge.net/projects/rpcbind/files/rpcbind/${NEW_VERSION}/rpcbind-${NEW_VERSION}.tar.bz2/download"
          echo ${NEW_VERSION} > nfs-debs-rpcbind/version
      outputs:
      - name: nfs-debs-rpcbind
  - task: bump-rpcbind
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/deps-automation/bump-blob/task.yml
    input_mapping:
      distributed-package: nfs-debs-rpcbind
      bosh-release: nfs-volume-release-master
    output_mapping:
      bosh-release-updated: nfs-volume-release-write
    params:
      AWS_ACCESS_KEY_ID: *aws_nfsvolume_uploader_role_id
      AWS_SECRET_ACCESS_KEY: *aws_nfsvolume_uploader_role_secret
      AWS_ROLE_ARN: *aws_nfsvolume_uploader_role_arn
      GIT_USERNAME: *github_user
      GIT_EMAIL: *github_email
      GIT_BRANCH: &rpcbind-bump-branch bump-rpcbind-to-v((.:rpcbind.version.ref))
      BLOB_NAME: rpcbind
      BLOB_EXTENSION: .tar.bz2
      BLOB_DIRECTORY: nfs-debs/
  - put: nfs-volume-release-write
    params:
      repository: nfs-volume-release-write
      force: true
      branch: *rpcbind-bump-branch
    on_success:
      task: create-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      input_mapping:
        source-repo: nfs-volume-release-write
      params:
        GITHUB_TOKEN: *github_access_token
        BASE: master
        BRANCH: *rpcbind-bump-branch
        TITLE: "Bump RPCBind to v((.:rpcbind.version.ref))"
        LABELS: dependencies

- name: bump-tcl
  serial: true
  plan:
  - in_parallel:
    - get: tcl-version
      trigger: true
    - get: image-cryogenics-essentials
    - get: cryogenics-concourse-tasks
    - get: nfs-volume-release-master
  - load_var: tcl
    file: tcl-version/version
    format: json
  - task: download-tcl
    image: image-cryogenics-essentials
    config:
      platform: linux
      params:
        NEW_VERSION: ((.:tcl.version.ref))
      run:
        path: /bin/sh
        args:
        - -c
        - |
          set -e
          wget -O "nfs-debs-tcl/tcl${NEW_VERSION}-src.tar.gz" "https://sourceforge.net/projects/tcl/files/Tcl/${NEW_VERSION}/tcl${NEW_VERSION}-src.tar.gz/download"
          echo ${NEW_VERSION} > nfs-debs-tcl/version
      outputs:
      - name: nfs-debs-tcl
  - task: bump-tcl
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/deps-automation/bump-blob/task.yml
    input_mapping:
      distributed-package: nfs-debs-tcl
      bosh-release: nfs-volume-release-master
    output_mapping:
      bosh-release-updated: nfs-volume-release-write
    params:
      AWS_ACCESS_KEY_ID: *aws_nfsvolume_uploader_role_id
      AWS_SECRET_ACCESS_KEY: *aws_nfsvolume_uploader_role_secret
      AWS_ROLE_ARN: *aws_nfsvolume_uploader_role_arn
      GIT_USERNAME: *github_user
      GIT_EMAIL: *github_email
      GIT_BRANCH: &tcl-bump-branch bump-tcl-to-v((.:tcl.version.ref))
      BLOB_NAME: tcl
      BLOB_EXTENSION: -src.tar.gz
      BLOB_DIRECTORY: nfs-debs/
  - put: nfs-volume-release-write
    params:
      repository: nfs-volume-release-write
      force: true
      branch: *tcl-bump-branch
    on_success:
      task: create-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      input_mapping:
        source-repo: nfs-volume-release-write
      params:
        GITHUB_TOKEN: *github_access_token
        BASE: master
        BRANCH: *tcl-bump-branch
        TITLE: "Bump Tcl to v((.:tcl.version.ref))"
        LABELS: dependencies

- name: bump-util-linux
  serial: true
  plan:
  - in_parallel:
    - get: util-linux
      trigger: true
    - get: image-cryogenics-essentials
    - get: cryogenics-concourse-tasks
    - get: nfs-volume-release-master
  - load_var: util-linux-version
    file: util-linux/version
    format: raw
  - task: bump-util-linux
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/deps-automation/bump-blob/task.yml
    input_mapping:
      distributed-package: util-linux
      bosh-release: nfs-volume-release-master
    output_mapping:
      bosh-release-updated: nfs-volume-release-write
    params:
      AWS_ACCESS_KEY_ID: *aws_nfsvolume_uploader_role_id
      AWS_SECRET_ACCESS_KEY: *aws_nfsvolume_uploader_role_secret
      AWS_ROLE_ARN: *aws_nfsvolume_uploader_role_arn
      GIT_USERNAME: *github_user
      GIT_EMAIL: *github_email
      GIT_BRANCH: &util-linux-bump-branch bump-util-linux-to-v((.:util-linux-version))
      BLOB_NAME: util-linux
      BLOB_EXTENSION: .tar.gz
      BLOB_DIRECTORY: nfs-debs/
  - put: nfs-volume-release-write
    params:
      repository: nfs-volume-release-write
      force: true
      branch: *util-linux-bump-branch
    on_success:
      task: create-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      input_mapping:
        source-repo: nfs-volume-release-write
      params:
        GITHUB_TOKEN: *github_access_token
        BASE: master
        BRANCH: *util-linux-bump-branch
        TITLE: "Bump util-linux to v((.:util-linux-version))"
        LABELS: dependencies

- name: bump-golang
  serial: true
  plan:
  - in_parallel:
    - get: golang-release
      trigger: true
    - get: cryogenics-concourse-tasks
    - get: nfs-volume-release-master
    - get: image-cryogenics-essentials
  - load_var: golang-release-version
    file: golang-release/.git/describe_ref
  - task: bump-golang
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/deps-automation/bump-golang/task.yml
    input_mapping:
      release: nfs-volume-release-master
      vendored-package-release: golang-release
    params:
      VENDORED_PACKAGE_NAME: golang-1-linux
      VENDOR_UPDATES_BRANCH: &golang-vendor-branch bump-golang-vendor-((.:golang-release-version))
      COMMIT_USERNAME: bump-golang CI job
      COMMIT_USEREMAIL: *github_email
      AWS_ACCESS_KEY_ID: *aws_nfsvolume_uploader_role_id
      AWS_SECRET_ACCESS_KEY: *aws_nfsvolume_uploader_role_secret
      AWS_ASSUME_ROLE_ARN: *aws_nfsvolume_uploader_role_arn
  - put: nfs-volume-release-write
    params:
      repository: release-with-updated-vendored-package
      branch: *golang-vendor-branch
  - try:
      # We've seen cases where there are 2 or more new releases of
      # golang-release which causes this job to trigger 2x or more. A PR will
      # be created on the 1st build. On the following ones, it is possible
      # that this task will fail as there exist already a PR (which is
      # probably flowing through the pipeline). To prevent this scenario
      # we're making this step best-effort.
      # This also makes the job idempotent. If we retrigger the job but if
      # there are no new version of golang-release, this step will fail
      # saying "Your branch is up-to-date with
      # 'origin/golang-vendor-update'."
      task: create-golang-vendor-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      params: &golang-bump-pr-params
        BASE: master
        BRANCH: *golang-vendor-branch
        LABELS: dependencies
        TITLE: Update vendored package golang-1-linux
        MESSAGE: "This is an automatically generated Pull Request from the Cryogenics CI Bot.\
          \nI have detected a new version of [golang-release](https://github.com/bosh-packages/golang-release) and \
          automatically bumped\nthis package to benefit from the latest changes.\
          \nIf this does not look right, please reach out to the \
          mapbu-cryogenics team.\n"
      input_mapping:
        source-repo: nfs-volume-release-write

- name: update-go-directive-for-nfsv3driver
  serial: true
  plan:
  - in_parallel:
    - get: golang-release
      trigger: true
      passed:
      - bump-golang
    - get: cryogenics-concourse-tasks
      passed:
      - bump-golang
    - get: nfsv3driver
    - get: image-cryogenics-essentials
  - load_var: golang-release-version
    file: golang-release/.git/describe_ref
  - task: update-go-directive
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/tasks/bosh/update-go-directive/task.yml
    input_mapping:
      bosh-release-repo-with-vendored-golang: golang-release
      golang-project-repo: nfsv3driver
    output_mapping:
      golang-project-repo: nfsv3driver
  - put: nfsv3driver-write
    params:
      repository: nfsv3driver
      branch: *golang-vendor-branch
      force: true
  - try:
      # We've seen cases where there are 2 or more new releases of
      # golang-release which causes this job to trigger 2x or more. A PR will
      # be created on the 1st build. On the following ones, it is possible
      # that this task will fail as there exist already a PR (which is
      # probably flowing through the pipeline). To prevent this scenario
      # we're making this step best-effort.
      # This also makes the job idempotent. If we re-trigger the job but if
      # there are no new version of golang-release, this step will fail
      # saying "Your branch is up-to-date with
      # 'origin/golang-vendor-update'."
      task: create-gomod-directive-update-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      params:
        <<: *golang-bump-pr-params
      input_mapping:
        source-repo: nfsv3driver-write

- name: update-go-directive-for-nfsbroker
  serial: true
  plan:
  - in_parallel:
    - get: golang-release
      trigger: true
      passed:
      - bump-golang
    - get: cryogenics-concourse-tasks
      passed:
      - bump-golang
    - get: nfsbroker
    - get: image-cryogenics-essentials
  - load_var: golang-release-version
    file: golang-release/.git/describe_ref
  - task: update-go-directive
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/tasks/bosh/update-go-directive/task.yml
    input_mapping:
      bosh-release-repo-with-vendored-golang: golang-release
      golang-project-repo: nfsbroker
    output_mapping:
      golang-project-repo: nfsbroker
  - put: nfsbroker-write
    params:
      force: true
      repository: nfsbroker
      branch: *golang-vendor-branch
  - task: create-gomod-directive-update-pull-request
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
    params:
      <<: *golang-bump-pr-params
    input_mapping:
      source-repo: nfsbroker-write

- name: update-go-directive-for-volumedriver
  serial: true
  plan:
  - in_parallel:
    - get: golang-release
      trigger: true
      passed:
      - bump-golang
    - get: cryogenics-concourse-tasks
      passed:
      - bump-golang
    - get: volumedriver
    - get: image-cryogenics-essentials
  - load_var: golang-release-version
    file: golang-release/.git/describe_ref
  - task: update-go-directive
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/tasks/bosh/update-go-directive/task.yml
    input_mapping:
      bosh-release-repo-with-vendored-golang: golang-release
      golang-project-repo: volumedriver
    output_mapping:
      golang-project-repo: volumedriver
  - put: volumedriver-write
    params:
      force: true
      repository: volumedriver
      branch: *golang-vendor-branch
  - try:
      # We've seen cases where there are 2 or more new releases of
      # golang-release which causes this job to trigger 2x or more. A PR will
      # be created on the 1st build. On the following ones, it is possible
      # that this task will fail as there exist already a PR (which is
      # probably flowing through the pipeline). To prevent this scenario
      # we're making this step best-effort.
      # This also makes the job idempotent. If we re-trigger the job but if
      # there are no new version of golang-release, this step will fail
      # saying "Your branch is up-to-date with
      # 'origin/golang-vendor-update'."
      task: create-gomod-directive-update-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      params:
        <<: *golang-bump-pr-params
      input_mapping:
        source-repo: volumedriver-write

- name: update-go-directive-for-volume-mount-options
  serial: true
  plan:
  - in_parallel:
    - get: golang-release
      trigger: true
      passed:
      - bump-golang
    - get: cryogenics-concourse-tasks
      passed:
      - bump-golang
    - get: volume-mount-options
    - get: image-cryogenics-essentials
  - load_var: golang-release-version
    file: golang-release/.git/describe_ref
  - task: update-go-directive
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/tasks/bosh/update-go-directive/task.yml
    input_mapping:
      bosh-release-repo-with-vendored-golang: golang-release
      golang-project-repo: volume-mount-options
    output_mapping:
      golang-project-repo: volume-mount-options
  - put: volume-mount-options-write
    params:
      force: true
      repository: volume-mount-options
      branch: *golang-vendor-branch
  - try:
      # We've seen cases where there are 2 or more new releases of
      # golang-release which causes this job to trigger 2x or more. A PR will
      # be created on the 1st build. On the following ones, it is possible
      # that this task will fail as there exist already a PR (which is
      # probably flowing through the pipeline). To prevent this scenario
      # we're making this step best-effort.
      # This also makes the job idempotent. If we re-trigger the job but if
      # there are no new version of golang-release, this step will fail
      # saying "Your branch is up-to-date with
      # 'origin/golang-vendor-update'."
      task: create-gomod-directive-update-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      params:
        <<: *golang-bump-pr-params
      input_mapping:
        source-repo: volume-mount-options-write

- name: update-go-directive-for-existingvolumebroker
  serial: true
  plan:
  - in_parallel:
    - get: golang-release
      trigger: true
      passed:
      - bump-golang
    - get: cryogenics-concourse-tasks
      passed:
      - bump-golang
    - get: existingvolumebroker
    - get: image-cryogenics-essentials
  - load_var: golang-release-version
    file: golang-release/.git/describe_ref
  - task: update-go-directive
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/tasks/bosh/update-go-directive/task.yml
    input_mapping:
      bosh-release-repo-with-vendored-golang: golang-release
      golang-project-repo: existingvolumebroker
    output_mapping:
      golang-project-repo: existingvolumebroker
  - put: existingvolumebroker-write
    params:
      force: true
      repository: existingvolumebroker
      branch: *golang-vendor-branch
  - try:
      # We've seen cases where there are 2 or more new releases of
      # golang-release which causes this job to trigger 2x or more. A PR will
      # be created on the 1st build. On the following ones, it is possible
      # that this task will fail as there exist already a PR (which is
      # probably flowing through the pipeline). To prevent this scenario
      # we're making this step best-effort.
      # This also makes the job idempotent. If we re-trigger the job but if
      # there are no new version of golang-release, this step will fail
      # saying "Your branch is up-to-date with
      # 'origin/golang-vendor-update'."
      task: create-gomod-directive-update-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      params:
        <<: *golang-bump-pr-params
      input_mapping:
        source-repo: existingvolumebroker-write

- name: update-go-directive-for-service-broker-store
  serial: true
  plan:
  - in_parallel:
    - get: golang-release
      trigger: true
      passed:
      - bump-golang
    - get: cryogenics-concourse-tasks
      passed:
      - bump-golang
    - get: service-broker-store
    - get: image-cryogenics-essentials
  - load_var: golang-release-version
    file: golang-release/.git/describe_ref
  - task: update-go-directive
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/tasks/bosh/update-go-directive/task.yml
    input_mapping:
      bosh-release-repo-with-vendored-golang: golang-release
      golang-project-repo: service-broker-store
    output_mapping:
      golang-project-repo: service-broker-store
  - put: service-broker-store-write
    params:
      repository: service-broker-store
      branch: *golang-vendor-branch
      force: true
  - try:
      # We've seen cases where there are 2 or more new releases of
      # golang-release which causes this job to trigger 2x or more. A PR will
      # be created on the 1st build. On the following ones, it is possible
      # that this task will fail as there exist already a PR (which is
      # probably flowing through the pipeline). To prevent this scenario
      # we're making this step best-effort.
      # This also makes the job idempotent. If we re-trigger the job but if
      # there are no new version of golang-release, this step will fail
      # saying "Your branch is up-to-date with
      # 'origin/golang-vendor-update'."
      task: create-gomod-directive-update-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      params:
        <<: *golang-bump-pr-params
      input_mapping:
        source-repo: service-broker-store-write

- name: bump-openssl
  serial: true
  plan:
  - in_parallel:
    - get: openssl
      trigger: true
    - get: nfs-volume-release-master
    - get: cryogenics-concourse-tasks
    - get: image-cryogenics-essentials
  - load_var: new-version
    file: openssl/version
  - task: bump-openssl
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/deps-automation/bump-blob/task.yml
    input_mapping:
      distributed-package: openssl
      bosh-release: nfs-volume-release-master
    output_mapping:
      bosh-release-updated: nfs-volume-release-write
    params:
      AWS_ACCESS_KEY_ID: *aws_nfsvolume_uploader_role_id
      AWS_SECRET_ACCESS_KEY: *aws_nfsvolume_uploader_role_secret
      AWS_ROLE_ARN: *aws_nfsvolume_uploader_role_arn
      GIT_USERNAME: *github_user
      GIT_EMAIL: *github_email
      GIT_BRANCH: &openssl-bump-branch bump-openssl-to-v((.:new-version))
      BLOB_NAME: openssl-
      BLOB_EXTENSION: .tar.gz
      BLOB_DIRECTORY: test-dependencies/
  - put: nfs-volume-release-write
    params:
      repository: nfs-volume-release-write
      force: true
      branch: *openssl-bump-branch
    on_success:
      task: create-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      input_mapping:
        source-repo: nfs-volume-release-write
      params:
        GITHUB_TOKEN: *github_access_token
        BASE: master
        BRANCH: *openssl-bump-branch
        TITLE: "Bump OpenSSL to v((.:new-version))"
        LABELS: dependencies

- name: bump-openldap
  serial: true
  plan:
  - in_parallel:
    - get: openldap-version
      trigger: true
    - get: nfs-volume-release-master
    - get: cryogenics-concourse-tasks
    - get: image-cryogenics-essentials
  - load_var: openldap
    file: openldap-version/version
    format: json
  - task: get-openldap-source
    image: image-cryogenics-essentials
    config:
      platform: linux
      params:
        NEW_VERSION: ((.:openldap.version.ref))
      run:
        path: /bin/sh
        args:
        - -c
        - |
          set -e
          wget -O "openldap-tarball/openldap-${NEW_VERSION}.tgz" "https://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap-${NEW_VERSION}.tgz"
          echo ${NEW_VERSION} > openldap-tarball/version
      outputs:
      - name: openldap-tarball
  - task: bump-openldap
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/deps-automation/bump-blob/task.yml
    input_mapping:
      distributed-package: openldap-tarball
      bosh-release: nfs-volume-release-master
    output_mapping:
      bosh-release-updated: nfs-volume-release-write
    params:
      AWS_ACCESS_KEY_ID: *aws_nfsvolume_uploader_role_id
      AWS_SECRET_ACCESS_KEY: *aws_nfsvolume_uploader_role_secret
      AWS_ROLE_ARN: *aws_nfsvolume_uploader_role_arn
      GIT_USERNAME: *github_user
      GIT_EMAIL: *github_email
      GIT_BRANCH: &openldap-bump-branch bump-openldap-to-v((.:openldap.version.ref))
      BLOB_NAME: openldap-
      BLOB_EXTENSION: .tgz
      BLOB_DIRECTORY: openldap/
  - put: nfs-volume-release-write
    params:
      repository: nfs-volume-release-write
      force: true
      branch: *openldap-bump-branch
    on_success:
      task: create-pull-request
      image: image-cryogenics-essentials
      file: cryogenics-concourse-tasks/github-automation/create-pr/task.yml
      input_mapping:
        source-repo: nfs-volume-release-write
      params:
        GITHUB_TOKEN: *github_access_token
        BASE: master
        BRANCH: *openldap-bump-branch
        TITLE: "Bump Openldap to v((.:openldap.version.ref))"
        LABELS: dependencies

- name: nfs-volume-release-job-tests
  plan:
  - in_parallel:
      fail_fast: true
      steps:
      - get: persi-ci
      - get: cryogenics-concourse-tasks
      - get: mapfs-release
      - get: nfs-volume-release
        trigger: true
      - get: image-cryogenics-essentials
      - put: env-tas-jammy
        attempts: *number_of_claim_env_retries
        params:
          action: create
          duration: 6h
          resource: env
        timeout: 6h
  - task: rspec
    image: image-cryogenics-essentials
    file: persi-ci/scripts/ci/run-rspec.build.yml
    input_mapping:
      test-repo: nfs-volume-release
  - task: bosh-release-test
    image: image-cryogenics-essentials
    attempts: *number_of_retries
    file: cryogenics-concourse-tasks/vol-service/run-bosh-release-tests-in-shepherd/task.yml
    params:
      TEST_REPO: nfs-volume-release
    input_mapping:
      shepherd-env: env-tas-jammy
    ensure:
      do:
      - put: env-tas-jammy
        params:
          action: release
          resource: env-tas-jammy


- name: mapfs-release-job-tests
  plan:
  - in_parallel:
      fail_fast: true
      steps:
      - get: mapfs-release
        trigger: true
      - get: mapfs-release-concourse-tasks
      - get: cryogenics-concourse-tasks
      - get: bosh-docker-cpi
      - get: stemcell
      - get: image-cryogenics-essentials
        params:
          format: oci
  - task: bosh-release-test
    image: bosh-docker-cpi
    file: cryogenics-concourse-tasks/vol-service/run-bosh-release-tests/task.yml
    params:
      RELEASE: "MAPFS"
    input_mapping:
      image: image-cryogenics-essentials
      vol-services-bosh-release: mapfs-release
    privileged: true
    timeout: 1h
    params:
      REGISTRY: us-west2-docker.pkg.dev/mapbu-cryogenics/dockerhub-proxy-cache/

- name: claim-env
  plan:
  - in_parallel:
      fail_fast: true
      steps:
      - get: persi-ci
      - get: nfs-volume-release
        trigger: true
        passed:
        - nfs-volume-release-job-tests
      - get: mapfs-release
        trigger: true
        passed:
        - mapfs-release-job-tests
      - get: image-cryogenics-essentials
  - put: env
    attempts: *number_of_retries
    timeout: 6h
    params:
      action: create
      duration: 24h
      resource: env
      timeout: 6h
  - task: output-env-details
    image: image-cryogenics-essentials
    file: persi-ci/scripts/ci/claim-pooled-env.build.yml
    input_mapping:
      pooled-env: env

- name: claim-ldap-env
  plan:
  - in_parallel:
      fail_fast: true
      steps:
      - get: persi-ci
      - get: nfs-volume-release
        trigger: true
        passed:
        - nfs-volume-release-job-tests
      - get: mapfs-release
        trigger: true
        passed:
        - mapfs-release-job-tests
      - get: image-cryogenics-essentials
  - put: env
    attempts: *number_of_retries
    timeout: 6h
    params:
      action: create
      duration: 24h
      resource: env
      timeout: 6h
  - task: output-env-details
    image: image-cryogenics-essentials
    file: persi-ci/scripts/ci/claim-pooled-env.build.yml
    input_mapping:
      pooled-env: env

- name: deploy-cf
  public: true
  build_logs_to_retain: 100
  plan:
  - in_parallel:
      fail_fast: true
      steps:
      - get: env
        passed: [ claim-env ]
        trigger: true
      - get: cf-deployment-concourse-tasks
      - get: image-cryogenics-essentials
      - get: cf-deployment
      - get: persi-ci
      - get: nfs-volume-release
        passed: [ claim-env ]
      - get: mapfs-release
        passed: [ claim-env ]
  - task: pin-cf-deployment-version
    image: image-cryogenics-essentials
    file: persi-ci/scripts/ci/pin_cf_deployment_version.build.yml
    input_mapping:
      toolsmiths-env: env
  - task: collect-persi-ci-ops-files
    image: image-cryogenics-essentials
    file: cf-deployment-concourse-tasks/collect-ops-files/task.yml
    input_mapping:
      base-ops-files: cf-deployment
      new-ops-files: persi-ci
    params:
      BASE_OPS_FILE_DIR: "operations"
  - task: generate-variables
    image: image-cryogenics-essentials
    file: persi-ci/scripts/ci/generate_variables.build.yml
    params:
      GENERATE_NFS_VARS: true
      GENERATE_SMB_VARS: false
  - task: bosh-deploy-cf
    image: image-cryogenics-essentials
    attempts: *number_of_retries
    file: persi-ci/scripts/ci/deploy-cf-with-multiple-releases.build.yml
    input_mapping:
      cf-deployment: cf-deployment
      toolsmiths-env: env
      ops-files: collected-ops-files
      vars-files: generated-vars
    params:
      VARS_FILES: "nfs-vars.yml"
      OPS_FILES: "operations/use-compiled-releases.yml
                  operations/scale-to-one-az.yml
                  operations/enable-nfs-volume-service.yml
                  updated-nfs-releases.yml
                  operations/test/enable-nfs-test-server.yml
                  operations/backup-and-restore/enable-backup-restore.yml
                  operations/backup-and-restore/enable-restore-nfs-broker.yml
                  operations/experimental/fast-deploy-with-downtime-and-danger.yml"
  - task: run-smoke-tests
    image: image-cryogenics-essentials
    file: cf-deployment-concourse-tasks/run-errand/task.yml
    input_mapping:
      toolsmiths-env: env
    params:
      ERRAND_NAME: smoke_tests
  - task: run-nfs-broker-errand
    image: image-cryogenics-essentials
    attempts: *number_of_retries
    file: cf-deployment-concourse-tasks/run-errand/task.yml
    input_mapping:
      toolsmiths-env: env
    params:
      ERRAND_NAME: nfsbrokerpush
      INSTANCE: nfs-broker-push

- name: pats
  plan:
  - in_parallel:
      steps:
      - get: cf-volume-services-acceptance-tests
      - get: persi-ci
      - get: env
        passed: [ deploy-cf ]
        trigger: true
      - get: nfs-volume-release
        passed: [ deploy-cf ]
      - get: mapfs-release
        passed: [ deploy-cf ]
      - get: image-cryogenics-essentials
  - task: generate-pats-config-nfs
    image: image-cryogenics-essentials
    file: persi-ci/scripts/ci/generate_pats_config.build.yml
    input_mapping:
      smith-env: env
    params:
      VAR_RESOLVER_SCRIPT: persi-ci/scripts/ci/cf_deployment_helpers.sh
      CF_USERNAME: admin
      BIND_BOGUS_CONFIG: '{\"uid\":\"1000\",\"gid\":\"1000\"}'
      BIND_CONFIG: '["{\"uid\":\"1000\",\"gid\":\"1000\"}", "{\"uid\":\"1000\",\"gid\":\"1000\",\"mount\": \"/var/vcap/data/foo\"}", "{\"uid\":\"1000\",\"gid\":\"1000\", \"version\": \"3\"}", "{\"uid\":\"1000\",\"gid\":\"1000\", \"version\": \"4.0\"}", "{\"uid\":\"1000\",\"gid\":\"1000\", \"version\": \"4.1\"}", "{\"uid\":\"1000\",\"gid\":\"1000\", \"version\": \"4.2\"}"]'  # yamllint disable-line rule:line-length
      CREATE_BOGUS_CONFIG: '{\"share\":\"nfstestserver.service.cf.internal/export/nonexistensevol\"}'
      CREATE_CONFIG: '{\"share\":\"nfstestserver.service.cf.internal/export/users\"}'
      PLAN_NAME: Existing
      SERVICE_NAME: nfs
    output_mapping:
      pats-config: nfs-pats-config
  - task: run-pats-nfs
    image: image-cryogenics-essentials
    input_mapping:
      pats-config: nfs-pats-config
    file: persi-ci/scripts/ci/run-pats.build.yml
    attempts: *number_of_retries
    params:
      PARALLEL_NODES: 5
      TEST_MOUNT_FAIL_LOGGING: true
      TEST_MOUNT_OPTIONS: true
      TEST_MULTI_CELL: true
      TEST_READ_ONLY: true

- name: cats-nfs
  plan:
  - in_parallel:
      fail_fast: true
      steps:
      - get: nfs-volume-release
        passed: [ pats ]
        trigger: true
      - get: env
        passed: [ pats ]
        trigger: true
      - get: persi-ci
      - get: cf-acceptance-tests
      - get: cf-deployment-concourse-tasks
      - get: image-cryogenics-essentials
      - get: cryogenics-concourse-tasks
  - task: alias-env
    image: image-cryogenics-essentials
    file: cryogenics-concourse-tasks/tasks/toolsmiths/bosh-envify/task.yml
    input_mapping:
      toolsmiths-env: env
      cryogenics-tasks: cryogenics-concourse-tasks
  - task: generate-cats-config
    image: image-cryogenics-essentials
    file: persi-ci/scripts/ci/generate_cats_config.build.yml
    input_mapping:
      smith-env: env
    params:
      VAR_RESOLVER_SCRIPT: persi-ci/scripts/ci/cf_deployment_helpers.sh
      CF_USERNAME: admin
      SERVICE_NAME: nfs
      PLAN_NAME: Existing
  - task: run-cats
    image: image-cryogenics-essentials
    file: cf-deployment-concourse-tasks/run-cats/task.yml
    input_mapping:
      integration-config: cats-config
    params:
      CONFIG_FILE_PATH: cats.json

- name: drats
  plan:
  - in_parallel:
      fail_fast: true
      steps:
      - get: nfs-volume-release
        passed: [ cats-nfs ]
        trigger: true
      - get: bbr-binary-release
      - get: disaster-recovery-acceptance-tests
      - get: persi-ci
      - get: env
        passed: [ cats-nfs ]
        trigger: true
      - get: image-cryogenics-essentials
  - task: generate-integration-config
    image: image-cryogenics-essentials
    file: persi-ci/scripts/ci/generate-drats-integration-config.build.yml
    params:
      INTEGRATION_CONFIG_FILE_PATH: config/drats-nfs.json
    input_mapping:
      smith-env: env
      integration-configs: persi-ci
  - task: drats-with-integration-config
    image: image-cryogenics-essentials
    file: disaster-recovery-acceptance-tests/ci/tasks/drats-with-integration-config/task.yml
    privileged: true
    input_mapping:
      drats-integration-config: updated-integration-configs
    params:
      CONFIG_FILE_PATH: config/drats-nfs.json

- name: deploy-cf-with-ldap
  public: true
  build_logs_to_retain: 100
  plan:
  - in_parallel:
      fail_fast: true
      steps:
      - get: env
        passed:
        - claim-ldap-env
        trigger: true
      - get: cf-deployment-concourse-tasks
      - get: image-cryogenics-essentials
      - get: cf-deployment
      - get: persi-ci
      - get: nfs-volume-release
        passed:
        - claim-ldap-env
      - get: mapfs-release
        passed:
        - claim-ldap-env
  - task: pin-cf-deployment-version
    image: image-cryogenics-essentials
    file: persi-ci/scripts/ci/pin_cf_deployment_version.build.yml
    input_mapping:
      toolsmiths-env: env
  - task: collect-persi-ci-ops-files
    image: image-cryogenics-essentials
    file: cf-deployment-concourse-tasks/collect-ops-files/task.yml
    input_mapping:
      base-ops-files: cf-deployment
      new-ops-files: persi-ci
    params:
      BASE_OPS_FILE_DIR: "operations"
  - task: generate-variables
    image: image-cryogenics-essentials
    file: persi-ci/scripts/ci/generate_variables.build.yml
    params:
      GENERATE_NFS_VARS: true
      GENERATE_SMB_VARS: false
      LDAP_HOST: "nfstestldapserver.service.cf.internal"
      LDAP_SVC_USER: "cn=admin,dc=domain,dc=com"
      LDAP_SVC_PASS: "secret"
      LDAP_PORT: 636
      LDAP_PROTO: tcp
      LDAP_USER_FQDN: "ou=Users,dc=domain,dc=com"
  - task: bosh-deploy-cf
    image: image-cryogenics-essentials
    file: persi-ci/scripts/ci/deploy-cf-with-multiple-releases.build.yml
    input_mapping:
      toolsmiths-env: env
      cf-deployment: cf-deployment
      ops-files: collected-ops-files
      vars-files: generated-vars
    params:
      VARS_FILES: "nfs-vars.yml"
      OPS_FILES: "operations/use-compiled-releases.yml
                  operations/scale-to-one-az.yml
                  operations/enable-nfs-volume-service.yml
                  updated-nfs-releases.yml
                  operations/enable-nfs-ldap.yml
                  operations/test/enable-nfs-test-server.yml
                  operations/test/enable-nfs-test-ldapserver.yml
                  operations/experimental/fast-deploy-with-downtime-and-danger.yml"
  - task: run-smoke-tests
    image: image-cryogenics-essentials
    file: cf-deployment-concourse-tasks/run-errand/task.yml
    input_mapping:
      toolsmiths-env: env
    params:
      ERRAND_NAME: smoke_tests
  - task: run-nfs-broker-errand
    image: image-cryogenics-essentials
    attempts: *number_of_retries
    file: cf-deployment-concourse-tasks/run-errand/task.yml
    input_mapping:
      toolsmiths-env: env
    params:
      ERRAND_NAME: nfsbrokerpush
      INSTANCE: nfs-broker-push

- name: pats-nfs-ldap
  plan:
  - in_parallel:
      fail_fast: true
      steps:
      - get: env
        passed:
        - deploy-cf-with-ldap
        trigger: true
      - get: cf-volume-services-acceptance-tests
      - get: persi-ci
      - get: nfs-volume-release
        passed:
        - deploy-cf-with-ldap
      - get: mapfs-release
        passed:
        - deploy-cf-with-ldap
      - get: image-cryogenics-essentials
  - in_parallel:
    - do:
      - task: generate-pats-config
        image: image-cryogenics-essentials
        file: persi-ci/scripts/ci/generate_pats_config.build.yml
        input_mapping:
          smith-env: env
        params:
          VAR_RESOLVER_SCRIPT: persi-ci/scripts/ci/cf_deployment_helpers.sh
          BIND_CONFIG: '["{\"username\":\"user1000\",\"password\":\"secret\"}"]'
          CREATE_CONFIG: '{\"share\":\"nfstestserver.service.cf.internal/export/users\"}'
          DISALLOWED_LDAP_BIND_CONFIG: '{\"uid\":\"1000\",\"gid\":\"1000\"}'
          PLAN_NAME: Existing
          SERVICE_NAME: nfs
        output_mapping:
          pats-config: nfs-pats-config
      - task: run-pats
        image: image-cryogenics-essentials
        input_mapping:
          pats-config: nfs-pats-config
        file: persi-ci/scripts/ci/run-pats.build.yml
        params:
          TEST_DOCKER_PORA: true
    - do:
      - task: generate-legacy-pats-config
        image: image-cryogenics-essentials
        file: persi-ci/scripts/ci/generate_pats_config.build.yml
        input_mapping:
          smith-env: env
        params:
          VAR_RESOLVER_SCRIPT: persi-ci/scripts/ci/cf_deployment_helpers.sh
          BIND_CONFIG: '["{\"username\":\"user1000\",\"password\":\"secret\"}"]'
          CREATE_CONFIG: '{\"share\":\"nfstestserver.service.cf.internal/export/users\"}'
          DISALLOWED_LDAP_BIND_CONFIG: '{\"uid\":\"1000\",\"gid\":\"1000\"}'
          PLAN_NAME: Existing
          SERVICE_NAME: nfs-legacy
        output_mapping:
          pats-config: nfs-legacy-pats-config
      - task: run-legacy-pats
        image: image-cryogenics-essentials
        input_mapping:
          pats-config: nfs-legacy-pats-config
        file: persi-ci/scripts/ci/run-pats.build.yml
        params:
          TEST_DOCKER_PORA: true

- name: unclaim-env
  plan:
  - get: env
    passed:
    - drats
    trigger: true
  - put: env
    params:
      action: release
      resource: env

- name: unclaim-ldap-env
  plan:
  - get: env
    passed:
    - pats-nfs-ldap
    trigger: true
  - put: env
    params:
      action: release
      resource: env

- name: merge-pr
  plan:
  - get: nfs-volume-release
    trigger: true
    passed:
    - pats-nfs-ldap
    - drats
  - put: nfs-volume-release
    params:
      merge: true
      repository: nfs-volume-release

- name: check-for-changes
  plan:
  - in_parallel:
    - get: every-week
      trigger: true
    - get: nfs-volume-release-master
    - get: nfs-volume-release-production-files-only

- name: shipit-nfs
  serial_groups:
  - nfs-version
  ensure:
    do:
    - put: nfsvolume-version
      params:
        file: nfsvolume-version/number
  plan:
  - in_parallel:
      steps:
      - get: persi-ci
      - get: cryogenics-concourse-tasks
      - get: nfs-volume-release-production-files-only
        trigger: true
        passed:
        - check-for-changes
      - get: release
        resource: nfs-volume-release-master
        passed:
        - check-for-changes
      - get: nfsvolume-version
        params:
          bump: patch
      - get: image-cryogenics-essentials
      - get: python-394
  - in_parallel:
    - do:
      - task: create-final-release
        image: image-cryogenics-essentials
        file: cryogenics-concourse-tasks/bosh-tasks/create-release/task.yml
        input_mapping:
          release-repo: release
          version: nfsvolume-version
        output_mapping:
          updated-release-repo: nfs-final-release
          updated-release-tarball: nfs-final-release-tarball
        params:
          AWS_ACCESS_KEY_ID: *aws_nfsvolume_uploader_role_id
          AWS_SECRET_ACCESS_KEY: *aws_nfsvolume_uploader_role_secret
          AWS_ROLE_ARN: *aws_nfsvolume_uploader_role_arn
          GIT_USERNAME: *github_user
          GIT_EMAIL: *github_email
          FINAL: true
          RELEASE_NAME: nfs-volume
      - put: nfs-volume-release-master
        params:
          repository: nfs-final-release
          tag: nfsvolume-version/number
          tag_prefix: v
    - do:
      - task: create-release-notes
        image: python-394
        file: cryogenics-concourse-tasks/release-automation/release-notes/task.yml
        input_mapping:
          git-repo: release
        params:
          USE_LATEST_PUBLISHED_TAG: true
      - task: format-release-notes
        image: image-cryogenics-essentials
        file: cryogenics-concourse-tasks/release-automation/format-release-notes/task.yml
        input_mapping:
          template-folder: cryogenics-concourse-tasks
        params:
          TEMPLATE_PATH: release-automation/release-notes-templates/release-notes-auto.md.erb
  - put: github-release-nfs
    params:
      name: nfsvolume-version/number
      tag: nfsvolume-version/number
      body: release-notes/release-notes.md
      tag_prefix: v
      globs:
      - nfs-final-release-tarball/nfs-volume-*.tgz
  - in_parallel:
    - load_var: github-release-url
      file: github-release-nfs/url
    - load_var: version-number
      file: nfsvolume-version/number
  - put: gchat-cryo-notification
    params:
      text: |
        *nfs-volume*: version `((.:version-number))` has been published :rocket:
        Next steps <users/all>:
          1. Review the release notes and undraft the release <((.:github-release-url))|here>.

- name: manual-bump-nfs-patch
  serial_groups:
  - nfs-version
  plan:
  - get: nfs-volume-version
    resource: nfsvolume-version
    params:
      bump: final
  - put: nfsvolume-version
    params:
      bump: patch

- name: manual-bump-nfs-minor
  serial_groups:
  - nfs-version
  plan:
  - get: nfs-volume-version
    resource: nfsvolume-version
    params:
      bump: final
  - put: nfsvolume-version
    params:
      bump: minor

- name: manual-bump-nfs-major
  serial_groups:
  - nfs-version
  plan:
  - get: nfs-volume-version
    resource: nfsvolume-version
    params:
      bump: final
  - put: nfsvolume-version
    params:
      bump: major