Argo Workflows CI Migration - Implementation Plan¶

# charts/tatara-argo-workflows/Chart.yaml
apiVersion: v2
name: tatara-argo-workflows
description: Argo Workflows CI/CD substrate for the tatara platform.
type: application
version: 0.1.0
appVersion: "0.1.0"
maintainers:
  - name: Szymon Richert
    email: szymon.rychu@gmail.com

# charts/tatara-argo-workflows/values.yaml
namespace: tatara

harbor:
  registry: harbor.szymonrichert.pl

github:
  apiBase: https://api.github.com

# Image pins for workflow step containers. Bump deliberately.
images:
  git: alpine/git:v2.45.2
  golangciLint: golangci/golangci-lint:v2.11.4
  go: golang:1.25
  goreleaser: goreleaser/goreleaser:v2.4.4
  buildkit: moby/buildkit:v0.17.0-rootless
  helm: alpine/helm:3.16.2
  helmfile: ghcr.io/helmfile/helmfile:v0.169.1
  alpine: alpine:3.20
EOF

# charts/tatara-argo-workflows/templates/_helpers.tpl
{{/*
Standard labels.
*/}}
{{- define "tatara-argo-workflows.labels" -}}
app.kubernetes.io/name: tatara-argo-workflows
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | quote }}
{{- end -}}

# helmfile.yaml.gotmpl
environments:
  default: {}

---

helmDefaults:
  wait: true
  syncArgs:
    - --force-conflicts
    - --rollback-on-failure

templates:
  default: &default
    missingFileHandler: Warn
    values:
      - values/{{`{{ .Release.Name }}`}}/common.yaml
      - values/{{`{{ .Release.Name }}`}}/{{`{{ .Environment.Name }}`}}.yaml
    secrets:
      - values/{{`{{ .Release.Name }}`}}/{{`{{ .Environment.Name }}`}}.secrets.yaml

releases:
  - name: tatara-argo-workflows
    namespace: tatara
    chart: ./charts/tatara-argo-workflows
    createNamespace: true
    <<: *default

# charts/tatara-argo-workflows/templates/cwt-github-status.yaml
apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
  name: tatara-github-status
  labels:
    {{- include "tatara-argo-workflows.labels" . | nindent 4 }}
spec:
  entrypoint: report
  arguments:
    parameters:
      - { name: repo,        value: "" }
      - { name: sha,         value: "" }
      - { name: state,       value: "pending" }
      - { name: context,     value: "tatara/unknown" }
      - { name: description, value: "" }
      - { name: targetUrl,   value: "" }
  templates:
    - name: report
      inputs:
        parameters:
          - name: repo
          - name: sha
          - name: state
          - name: context
          - name: description
          - name: targetUrl
      container:
        image: {{ .Values.images.alpine | quote }}
        command: [sh, -c]
        env:
          - name: GITHUB_TOKEN
            valueFrom:
              secretKeyRef:
                name: github-status-token
                key: GITHUB_TOKEN
        args:
          - |
            set -eu
            apk add --no-cache curl jq >/dev/null
            # Map argo workflow status string to github API state.
            case "{{`{{inputs.parameters.state}}`}}" in
              Succeeded) STATE=success ;;
              Failed)    STATE=failure ;;
              Error)     STATE=error   ;;
              pending|Running) STATE=pending ;;
              *) STATE="{{`{{inputs.parameters.state}}`}}" ;;
            esac
            BODY=$(jq -n \
              --arg state "$STATE" \
              --arg context "{{`{{inputs.parameters.context}}`}}" \
              --arg description "{{`{{inputs.parameters.description}}`}}" \
              --arg target_url "{{`{{inputs.parameters.targetUrl}}`}}" \
              '{state:$state, context:$context, description:$description, target_url:$target_url}')
            HTTP_CODE=$(curl -sS -o /tmp/resp.json -w '%{http_code}' \
              -X POST \
              -H "Authorization: token ${GITHUB_TOKEN}" \
              -H "Accept: application/vnd.github+json" \
              -d "$BODY" \
              "{{ .Values.github.apiBase }}/repos/{{`{{inputs.parameters.repo}}`}}/statuses/{{`{{inputs.parameters.sha}}`}}")
            if [ "$HTTP_CODE" != "201" ]; then
              echo "github status POST failed: HTTP $HTTP_CODE" >&2
              cat /tmp/resp.json >&2
              exit 1
            fi
            echo "github status posted: $STATE for {{`{{inputs.parameters.context}}`}}"

# charts/tatara-argo-workflows/templates/cwt-go-ci.yaml
apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
  name: tatara-go-ci
  labels:
    {{- include "tatara-argo-workflows.labels" . | nindent 4 }}
spec:
  entrypoint: main
  onExit: report-exit
  arguments:
    parameters:
      - { name: repo,      value: "" }
      - { name: ref,       value: "" }
      - { name: sha,       value: "" }
      - { name: prNumber,  value: "" }
  volumeClaimTemplates:
    - metadata:
        name: workspace
      spec:
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 2Gi
  templates:
    - name: main
      steps:
        - - name: report-pending
            templateRef:
              name: tatara-github-status
              template: report
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,        value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: sha,         value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: state,       value: "pending" }
                - { name: context,     value: "tatara/ci" }
                - { name: description, value: "lint + test running" }
                - { name: targetUrl,   value: "https://workflows.szymonrichert.pl/workflows/{{`{{workflow.namespace}}`}}/{{`{{workflow.name}}`}}" }
        - - name: clone
            template: clone
        - - name: lint
            template: lint
        - - name: test
            template: test

    - name: clone
      container:
        image: {{ .Values.images.git | quote }}
        workingDir: /workspace
        command: [sh, -c]
        args:
          - |
            set -eux
            git clone --depth=1 "https://github.com/{{`{{workflow.parameters.repo}}`}}" src
            cd src
            git fetch --depth=1 origin "{{`{{workflow.parameters.sha}}`}}" || true
            git checkout "{{`{{workflow.parameters.sha}}`}}"
        volumeMounts:
          - { name: workspace, mountPath: /workspace }

    - name: lint
      container:
        image: {{ .Values.images.golangciLint | quote }}
        workingDir: /workspace/src
        command: [sh, -c]
        args:
          - golangci-lint run ./...
        volumeMounts:
          - { name: workspace, mountPath: /workspace }

    - name: test
      container:
        image: {{ .Values.images.go | quote }}
        workingDir: /workspace/src
        command: [sh, -c]
        args:
          - |
            set -eux
            go test -race -count=1 ./...
        volumeMounts:
          - { name: workspace, mountPath: /workspace }

    - name: report-exit
      steps:
        - - name: post
            templateRef:
              name: tatara-github-status
              template: report
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,        value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: sha,         value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: state,       value: "{{`{{workflow.status}}`}}" }
                - { name: context,     value: "tatara/ci" }
                - { name: description, value: "{{`{{workflow.status}}`}}" }
                - { name: targetUrl,   value: "https://workflows.szymonrichert.pl/workflows/{{`{{workflow.namespace}}`}}/{{`{{workflow.name}}`}}" }

# charts/tatara-argo-workflows/templates/cwt-container-build.yaml
apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
  name: tatara-container-build
  labels:
    {{- include "tatara-argo-workflows.labels" . | nindent 4 }}
spec:
  entrypoint: main
  onExit: report-exit
  arguments:
    parameters:
      - { name: repo,      value: "" }
      - { name: ref,       value: "" }
      - { name: sha,       value: "" }
      - { name: tag,       value: "" }
      - { name: imageName, value: "" }
  volumeClaimTemplates:
    - metadata:
        name: workspace
      spec:
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 4Gi
  templates:
    - name: main
      steps:
        - - name: report-pending
            templateRef:
              name: tatara-github-status
              template: report
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,        value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: sha,         value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: state,       value: "pending" }
                - { name: context,     value: "tatara/container" }
                - { name: description, value: "building amd64 image" }
                - { name: targetUrl,   value: "https://workflows.szymonrichert.pl/workflows/{{`{{workflow.namespace}}`}}/{{`{{workflow.name}}`}}" }
        - - name: clone
            template: clone
        - - name: build-push
            template: build-push

    - name: clone
      container:
        image: {{ .Values.images.git | quote }}
        workingDir: /workspace
        command: [sh, -c]
        args:
          - |
            set -eux
            git clone --depth=1 "https://github.com/{{`{{workflow.parameters.repo}}`}}" src
            cd src
            git fetch --depth=1 origin "{{`{{workflow.parameters.sha}}`}}" || true
            git checkout "{{`{{workflow.parameters.sha}}`}}"
        volumeMounts:
          - { name: workspace, mountPath: /workspace }

    - name: build-push
      container:
        image: {{ .Values.images.buildkit | quote }}
        workingDir: /workspace/src
        command: [sh, -c]
        env:
          - name: HARBOR_USERNAME
            valueFrom:
              secretKeyRef:
                name: harbor-robot
                key: username
          - name: HARBOR_PASSWORD
            valueFrom:
              secretKeyRef:
                name: harbor-robot
                key: password
        args:
          - |
            set -eux
            mkdir -p ~/.docker
            B64=$(printf '%s:%s' "$HARBOR_USERNAME" "$HARBOR_PASSWORD" | base64 -w0)
            cat > ~/.docker/config.json <<JSON
            {"auths":{"{{ .Values.harbor.registry }}":{"auth":"${B64}"}}}
            JSON
            TAG_V="{{`{{workflow.parameters.tag}}`}}"
            TAG_PLAIN="${TAG_V#v}"
            IMG="{{ .Values.harbor.registry }}/{{`{{workflow.parameters.imageName}}`}}"
            buildctl-daemonless.sh build \
              --frontend dockerfile.v0 \
              --local context=. \
              --local dockerfile=. \
              --opt platform=linux/amd64 \
              --output type=image,\"name=${IMG}:${TAG_V},${IMG}:${TAG_PLAIN}\",push=true
        securityContext:
          seccompProfile:
            type: Unconfined
          # Buildkit rootless still wants user namespaces; if the host kernel does
          # not allow unprivileged user_namespaces, switch type to RuntimeDefault
          # and set runAsUser/runAsGroup to 1000.
        volumeMounts:
          - { name: workspace, mountPath: /workspace }

    - name: report-exit
      steps:
        - - name: post
            templateRef:
              name: tatara-github-status
              template: report
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,        value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: sha,         value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: state,       value: "{{`{{workflow.status}}`}}" }
                - { name: context,     value: "tatara/container" }
                - { name: description, value: "{{`{{workflow.status}}`}}" }
                - { name: targetUrl,   value: "https://workflows.szymonrichert.pl/workflows/{{`{{workflow.namespace}}`}}/{{`{{workflow.name}}`}}" }

# charts/tatara-argo-workflows/templates/cwt-go-release.yaml
apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
  name: tatara-go-release
  labels:
    {{- include "tatara-argo-workflows.labels" . | nindent 4 }}
spec:
  entrypoint: main
  onExit: report-exit
  arguments:
    parameters:
      - { name: repo, value: "" }
      - { name: ref,  value: "" }
      - { name: sha,  value: "" }
      - { name: tag,  value: "" }
  volumeClaimTemplates:
    - metadata:
        name: workspace
      spec:
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 4Gi
  templates:
    - name: main
      steps:
        - - name: report-pending
            templateRef:
              name: tatara-github-status
              template: report
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,        value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: sha,         value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: state,       value: "pending" }
                - { name: context,     value: "tatara/release" }
                - { name: description, value: "running goreleaser" }
                - { name: targetUrl,   value: "https://workflows.szymonrichert.pl/workflows/{{`{{workflow.namespace}}`}}/{{`{{workflow.name}}`}}" }
        - - name: clone
            template: clone-full
        - - name: goreleaser
            template: goreleaser

    - name: clone-full
      container:
        image: {{ .Values.images.git | quote }}
        workingDir: /workspace
        command: [sh, -c]
        args:
          - |
            set -eux
            git clone "https://github.com/{{`{{workflow.parameters.repo}}`}}" src
            cd src
            git fetch --tags
            git checkout "{{`{{workflow.parameters.sha}}`}}"
        volumeMounts:
          - { name: workspace, mountPath: /workspace }

    - name: goreleaser
      container:
        image: {{ .Values.images.goreleaser | quote }}
        workingDir: /workspace/src
        command: [sh, -c]
        env:
          - name: GITHUB_TOKEN
            valueFrom:
              secretKeyRef:
                name: github-status-token
                key: GITHUB_TOKEN
          - name: HARBOR_USERNAME
            valueFrom:
              secretKeyRef:
                name: harbor-robot
                key: username
          - name: HARBOR_PASSWORD
            valueFrom:
              secretKeyRef:
                name: harbor-robot
                key: password
        args:
          - |
            set -eux
            mkdir -p ~/.docker
            B64=$(printf '%s:%s' "$HARBOR_USERNAME" "$HARBOR_PASSWORD" | base64 -w0)
            cat > ~/.docker/config.json <<JSON
            {"auths":{"{{ .Values.harbor.registry }}":{"auth":"${B64}"}}}
            JSON
            goreleaser release --clean
        volumeMounts:
          - { name: workspace, mountPath: /workspace }

    - name: report-exit
      steps:
        - - name: post
            templateRef:
              name: tatara-github-status
              template: report
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,        value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: sha,         value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: state,       value: "{{`{{workflow.status}}`}}" }
                - { name: context,     value: "tatara/release" }
                - { name: description, value: "{{`{{workflow.status}}`}}" }
                - { name: targetUrl,   value: "https://workflows.szymonrichert.pl/workflows/{{`{{workflow.namespace}}`}}/{{`{{workflow.name}}`}}" }

# charts/tatara-argo-workflows/templates/cwt-helm-publish.yaml
apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
  name: tatara-helm-publish
  labels:
    {{- include "tatara-argo-workflows.labels" . | nindent 4 }}
spec:
  entrypoint: main
  onExit: report-exit
  arguments:
    parameters:
      - { name: repo,       value: "" }
      - { name: ref,        value: "" }
      - { name: sha,        value: "" }
      - { name: tag,        value: "" }
      - { name: chartDir,   value: "" }
      - { name: chartName,  value: "" }
  volumeClaimTemplates:
    - metadata:
        name: workspace
      spec:
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 2Gi
  templates:
    - name: main
      steps:
        - - name: report-pending
            templateRef:
              name: tatara-github-status
              template: report
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,        value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: sha,         value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: state,       value: "pending" }
                - { name: context,     value: "tatara/chart" }
                - { name: description, value: "packaging chart" }
                - { name: targetUrl,   value: "https://workflows.szymonrichert.pl/workflows/{{`{{workflow.namespace}}`}}/{{`{{workflow.name}}`}}" }
        - - name: clone
            template: clone
        - - name: package-push
            template: package-push

    - name: clone
      container:
        image: {{ .Values.images.git | quote }}
        workingDir: /workspace
        command: [sh, -c]
        args:
          - |
            set -eux
            git clone --depth=1 "https://github.com/{{`{{workflow.parameters.repo}}`}}" src
            cd src
            git fetch --depth=1 origin "{{`{{workflow.parameters.sha}}`}}" || true
            git checkout "{{`{{workflow.parameters.sha}}`}}"
        volumeMounts:
          - { name: workspace, mountPath: /workspace }

    - name: package-push
      container:
        image: {{ .Values.images.helm | quote }}
        workingDir: /workspace/src
        command: [sh, -c]
        env:
          - name: HARBOR_USERNAME
            valueFrom:
              secretKeyRef:
                name: harbor-robot
                key: username
          - name: HARBOR_PASSWORD
            valueFrom:
              secretKeyRef:
                name: harbor-robot
                key: password
        args:
          - |
            set -eux
            apk add --no-cache sed >/dev/null
            CHART_DIR="{{`{{workflow.parameters.chartDir}}`}}"
            CHART_NAME="{{`{{workflow.parameters.chartName}}`}}"
            TAG_V="{{`{{workflow.parameters.tag}}`}}"
            VER="${TAG_V#v}"
            sed -i "s/^version:.*/version: ${VER}/"     "${CHART_DIR}/Chart.yaml"
            sed -i "s/^appVersion:.*/appVersion: \"${VER}\"/" "${CHART_DIR}/Chart.yaml"
            helm dependency update "${CHART_DIR}"
            helm package "${CHART_DIR}"
            echo "${HARBOR_PASSWORD}" | helm registry login -u "${HARBOR_USERNAME}" --password-stdin {{ .Values.harbor.registry }}
            helm push "${CHART_NAME}-${VER}.tgz" "oci://{{ .Values.harbor.registry }}/charts"
        volumeMounts:
          - { name: workspace, mountPath: /workspace }

    - name: report-exit
      steps:
        - - name: post
            templateRef:
              name: tatara-github-status
              template: report
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,        value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: sha,         value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: state,       value: "{{`{{workflow.status}}`}}" }
                - { name: context,     value: "tatara/chart" }
                - { name: description, value: "{{`{{workflow.status}}`}}" }
                - { name: targetUrl,   value: "https://workflows.szymonrichert.pl/workflows/{{`{{workflow.namespace}}`}}/{{`{{workflow.name}}`}}" }

# charts/tatara-argo-workflows/templates/cwt-helmfile-deploy.yaml
apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
  name: tatara-helmfile-deploy
  labels:
    {{- include "tatara-argo-workflows.labels" . | nindent 4 }}
spec:
  entrypoint: main
  onExit: report-exit
  arguments:
    parameters:
      - { name: repo,         value: "" }
      - { name: ref,          value: "" }
      - { name: sha,          value: "" }
      - { name: tag,          value: "" }
      - { name: helmfileDir,  value: "." }
  volumeClaimTemplates:
    - metadata:
        name: workspace
      spec:
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 2Gi
  templates:
    - name: main
      steps:
        - - name: report-pending
            templateRef:
              name: tatara-github-status
              template: report
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,        value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: sha,         value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: state,       value: "pending" }
                - { name: context,     value: "tatara/deploy" }
                - { name: description, value: "running helmfile sync" }
                - { name: targetUrl,   value: "https://workflows.szymonrichert.pl/workflows/{{`{{workflow.namespace}}`}}/{{`{{workflow.name}}`}}" }
        - - name: clone
            template: clone
        - - name: sync
            template: sync

    - name: clone
      container:
        image: {{ .Values.images.git | quote }}
        workingDir: /workspace
        command: [sh, -c]
        args:
          - |
            set -eux
            git clone --depth=1 "https://github.com/{{`{{workflow.parameters.repo}}`}}" src
            cd src
            git fetch --depth=1 origin "{{`{{workflow.parameters.sha}}`}}" || true
            git checkout "{{`{{workflow.parameters.sha}}`}}"
        volumeMounts:
          - { name: workspace, mountPath: /workspace }

    - name: sync
      container:
        image: {{ .Values.images.helmfile | quote }}
        workingDir: "/workspace/src"
        command: [sh, -c]
        env:
          - name: HARBOR_USERNAME
            valueFrom:
              secretKeyRef:
                name: harbor-robot
                key: username
          - name: HARBOR_PASSWORD
            valueFrom:
              secretKeyRef:
                name: harbor-robot
                key: password
        args:
          - |
            set -eux
            mkdir -p ~/.config/sops/age
            cat > ~/.config/sops/age/keys.txt <<KEY
            $(cat /var/run/secrets/age/keys.txt)
            KEY
            chmod 600 ~/.config/sops/age/keys.txt
            export SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt
            echo "${HARBOR_PASSWORD}" | helm registry login -u "${HARBOR_USERNAME}" --password-stdin {{ .Values.harbor.registry }}
            cd "{{`{{workflow.parameters.helmfileDir}}`}}"
            helmfile -e default sync --args "--force-conflicts"
        volumeMounts:
          - { name: workspace, mountPath: /workspace }
          - { name: age-key, mountPath: /var/run/secrets/age, readOnly: true }
      volumes:
        - name: age-key
          secret:
            secretName: age-key
            defaultMode: 0400

    - name: report-exit
      steps:
        - - name: post
            templateRef:
              name: tatara-github-status
              template: report
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,        value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: sha,         value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: state,       value: "{{`{{workflow.status}}`}}" }
                - { name: context,     value: "tatara/deploy" }
                - { name: description, value: "{{`{{workflow.status}}`}}" }
                - { name: targetUrl,   value: "https://workflows.szymonrichert.pl/workflows/{{`{{workflow.namespace}}`}}/{{`{{workflow.name}}`}}" }

# charts/tatara-argo-workflows/templates/cwt-tatara-memory-tag.yaml
apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
  name: tatara-memory-tag
  labels:
    {{- include "tatara-argo-workflows.labels" . | nindent 4 }}
spec:
  entrypoint: main
  onExit: report-exit
  arguments:
    parameters:
      - { name: repo, value: "" }
      - { name: ref,  value: "" }
      - { name: sha,  value: "" }
      - { name: tag,  value: "" }
  templates:
    - name: main
      dag:
        tasks:
          - name: container-build
            templateRef:
              name: tatara-container-build
              template: main
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,      value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: ref,       value: "{{`{{workflow.parameters.ref}}`}}" }
                - { name: sha,       value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: tag,       value: "{{`{{workflow.parameters.tag}}`}}" }
                - { name: imageName, value: "containers/tatara-memory" }
          - name: helm-publish
            templateRef:
              name: tatara-helm-publish
              template: main
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,      value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: ref,       value: "{{`{{workflow.parameters.ref}}`}}" }
                - { name: sha,       value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: tag,       value: "{{`{{workflow.parameters.tag}}`}}" }
                - { name: chartDir,  value: "charts/tatara-memory" }
                - { name: chartName, value: "tatara-memory" }
          - name: helmfile-deploy
            depends: "container-build && helm-publish"
            templateRef:
              name: tatara-helmfile-deploy
              template: main
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,        value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: ref,         value: "{{`{{workflow.parameters.ref}}`}}" }
                - { name: sha,         value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: tag,         value: "{{`{{workflow.parameters.tag}}`}}" }
                - { name: helmfileDir, value: "." }

    - name: report-exit
      steps:
        - - name: post
            templateRef:
              name: tatara-github-status
              template: report
              clusterScope: true
            arguments:
              parameters:
                - { name: repo,        value: "{{`{{workflow.parameters.repo}}`}}" }
                - { name: sha,         value: "{{`{{workflow.parameters.sha}}`}}" }
                - { name: state,       value: "{{`{{workflow.status}}`}}" }
                - { name: context,     value: "tatara/tag-pipeline" }
                - { name: description, value: "{{`{{workflow.status}}`}}" }
                - { name: targetUrl,   value: "https://workflows.szymonrichert.pl/workflows/{{`{{workflow.namespace}}`}}/{{`{{workflow.name}}`}}" }

# charts/tatara-argo-workflows/templates/secret-harbor-robot.yaml
{{- if .Values.harborRobot }}
apiVersion: v1
kind: Secret
metadata:
  name: harbor-robot
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "tatara-argo-workflows.labels" . | nindent 4 }}
type: Opaque
stringData:
  username: {{ required "harborRobot.username required (from sops values)" .Values.harborRobot.username | quote }}
  password: {{ required "harborRobot.password required (from sops values)" .Values.harborRobot.password | quote }}
{{- end }}