apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: git-clone-checkout
  namespace: tekton-pipelines
spec:
  workspaces:
    - name: output
    - name: ssh-directory
      optional: true
    - name: basic-auth
      optional: true
    - name: ssl-ca-directory
      optional: true
  params:
    - name: repo-url
      type: string
    - name: revision
      type: string
      default: ""
    - name: verbose
      type: string
      default: "true"
    - name: gitInitImage
      type: string
      default: "alpine/git:latest"
    - name: userHome
      type: string
      default: "/home/git"
  results:
    - name: commit
    - name: url
    - name: committer-date
  steps:

    - name: clone-checkout
      image: "$(params.gitInitImage)"
      env:
        - name: HOME
          value: "$(params.userHome)"
        - name: PARAM_URL
          value: $(params.repo-url)
        - name: PARAM_REVISION
          value: $(params.revision)
        - name: PARAM_VERBOSE
          value: $(params.verbose)
        - name: PARAM_USER_HOME
          value: $(params.userHome)
        - name: WORKSPACE_OUTPUT_PATH
          value: $(workspaces.output.path)
        - name: WORKSPACE_SSH_DIRECTORY_BOUND
          value: $(workspaces.ssh-directory.bound)
        - name: WORKSPACE_SSH_DIRECTORY_PATH
          value: $(workspaces.ssh-directory.path)
        - name: WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND
          value: $(workspaces.basic-auth.bound)
        - name: WORKSPACE_BASIC_AUTH_DIRECTORY_PATH
          value: $(workspaces.basic-auth.path)
        - name: WORKSPACE_SSL_CA_DIRECTORY_BOUND
          value: $(workspaces.ssl-ca-directory.bound)
        - name: WORKSPACE_SSL_CA_DIRECTORY_PATH
          value: $(workspaces.ssl-ca-directory.path)
      script: |
        #!/usr/bin/env sh
        set -eu

        if [ "${PARAM_VERBOSE}" = "true" ]; then
          set -x
        fi

        if [ "${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}" = "true" ]; then
          cp "${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials" "${PARAM_USER_HOME}/.git-credentials"
          cp "${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig" "${PARAM_USER_HOME}/.gitconfig"
          chmod 400 "${PARAM_USER_HOME}/.git-credentials"
          chmod 400 "${PARAM_USER_HOME}/.gitconfig"
        fi

        if [ "${WORKSPACE_SSH_DIRECTORY_BOUND}" = "true" ]; then
          cp -R "${WORKSPACE_SSH_DIRECTORY_PATH}" "${PARAM_USER_HOME}/.ssh"
          chmod 700 "${PARAM_USER_HOME}/.ssh"
          chmod -R 400 "${PARAM_USER_HOME}/.ssh"/*
        fi

        if [ "${WORKSPACE_SSL_CA_DIRECTORY_BOUND}" = "true" ]; then
          export GIT_SSL_CAPATH="${WORKSPACE_SSL_CA_DIRECTORY_PATH}"
        fi

        git config --global --add safe.directory "${WORKSPACE_OUTPUT_PATH}"
        cd "${WORKSPACE_OUTPUT_PATH}"

        git clone "${PARAM_URL}" .
        git checkout "${PARAM_REVISION}"

        RESULT_SHA="$(git rev-parse HEAD)"
        RESULT_COMMITTER_DATE="$(git log -1 --pretty=%ct)"

        printf "%s" "${RESULT_COMMITTER_DATE}" > "$(results.committer-date.path)"
        printf "%s" "${RESULT_SHA}" > "$(results.commit.path)"
        printf "%s" "${PARAM_URL}" > "$(results.url.path)"