# The remote executor's image, built and published here.
#
# buck2's remote execution names a container image by URL, and the worker pulls
# it; nothing about this pipeline runs the build itself. So this fires only when
# the image's own definition changes, and the tag it publishes is what
# platforms/BUCK names.
#
# The registry has to be readable without credentials, because the thing pulling
# is BuildBuddy's executor and not this project's CI: Settings → General →
# Visibility → Container registry, set to Everyone.
stages: [image]

rbe-image:
  stage: image
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  rules:
    # Only on the default branch, and only when the image's definition moves.
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      changes: [ci/rbe.Dockerfile, .gitlab-ci.yml]
  script:
    # kaniko rather than docker-in-docker: no privileged runner, and the layer
    # cache is the registry's own.
    - /kaniko/executor
      --context "$CI_PROJECT_DIR"
      --dockerfile "$CI_PROJECT_DIR/ci/rbe.Dockerfile"
      --destination "$CI_REGISTRY_IMAGE/rbe:$CI_COMMIT_SHORT_SHA"
      --destination "$CI_REGISTRY_IMAGE/rbe:latest"
      --digest-file /tmp/digest
    # The digest, because a tag is a moving target and an execution platform
    # should name bytes. Paste it into platforms/BUCK.
    - echo "$CI_REGISTRY_IMAGE/rbe@$(cat /tmp/digest)"