Fix bugs in assume role support

* Add support for assume role to ECR

* fix errors

* fix UTs

* fix format

.drone.yml

@@ -4,7 +4,7 @@ name: default
 
 steps:
 - name: build
-  image: golang:1.17.2
+  image: golang:1.18
   commands:
   - go test ./...
   - sh scripts/build.sh
@@ -60,6 +60,56 @@ steps:
       exclude:
       - pull_request
 
+- name: docker-kaniko-v1-8
+  image: plugins/docker
+  settings:
+    repo: plugins/kaniko
+    auto_tag: true
+    auto_tag_suffix: linux-amd64-kaniko1.8.1
+    daemon_off: false
+    dockerfile: docker/docker/Dockerfile.linux.amd64.kaniko1.8.1
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+  when:
+    event:
+      exclude:
+      - pull_request
+
+- name: gcr-kaniko-v1-8
+  image: plugins/docker
+  settings:
+    repo: plugins/kaniko-gcr
+    auto_tag: true
+    auto_tag_suffix: linux-amd64-kaniko1.8.1
+    daemon_off: false
+    dockerfile: docker/gcr/Dockerfile.linux.amd64.kaniko1.8.1
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+  when:
+    event:
+      exclude:
+      - pull_request
+
+- name: ecr-kaniko-v1-8
+  image: plugins/docker
+  settings:
+    repo: plugins/kaniko-ecr
+    auto_tag: true
+    auto_tag_suffix: linux-amd64-kaniko1.8.1
+    daemon_off: false
+    dockerfile: docker/ecr/Dockerfile.linux.amd64.kaniko1.8.1
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+  when:
+    event:
+      exclude:
+      - pull_request
 ---
 kind: pipeline
 type: docker
@@ -112,4 +162,58 @@ trigger:
   - "refs/tags/**"
 
 depends_on:
-- default
+- default
+
+---
+kind: pipeline
+type: docker
+name: notifications-docker-kaniko1-8
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+- name: manifest-docker
+  pull: always
+  image: plugins/manifest
+  settings:
+    auto_tag: false
+    ignore_missing: true
+    password:
+      from_secret: docker_password
+    spec: docker/docker/manifest-kaniko1.8.1.tmpl
+    username:
+      from_secret: docker_username
+
+- name: manifest-gcr
+  pull: always
+  image: plugins/manifest
+  settings:
+    auto_tag: false
+    ignore_missing: true
+    password:
+      from_secret: docker_password
+    spec: docker/gcr/manifest-kaniko1.8.1.tmpl
+    username:
+      from_secret: docker_username
+
+- name: manifest-ecr
+  pull: always
+  image: plugins/manifest
+  settings:
+    auto_tag: false
+    ignore_missing: true
+    password:
+      from_secret: docker_password
+    spec: docker/ecr/manifest-kaniko1.8.1.tmpl
+    username:
+      from_secret: docker_username
+
+trigger:
+  ref:
+  - refs/heads/main
+  - "refs/tags/**"
+
+depends_on:
+- default

README.md

@@ -39,6 +39,7 @@ docker build \
 ```
 
 ## Usage
+### Manual Tagging
 
 ```console
 docker run --rm \
@@ -52,14 +53,14 @@ docker run --rm \
     plugins/kaniko:linux-amd64
 ```
 
-### Automatic Tagging
+With expanded tagging enabled, semantic versions can be passed to PLUGIN_TAGS directly for expansion.
 
-With auto tagging enabled, semantic versions can be passed to PLUGIN_TAGS directly for expansion:
+**Note**: this feature only works for build labels. Artifact labels are not supported.
 
 ```console
 docker run --rm \
     -e PLUGIN_TAGS=v1.2.3,latest \
-    -e PLUGIN_AUTO_TAG=true \
+    -e PLUGIN_EXPAND_TAG=true \
     -v $(pwd):/drone \
     -w /drone \
     plugins/kaniko:linux-amd64
@@ -72,14 +73,58 @@ PLUGIN_TAGS=1,1.2,1.2.3,latest
 
 This allows for passing `$DRONE_TAG` directly as a tag for repos that use [semver](https://semver.org) tags.
 
-To avoid confusion between repo tags and image tags, `PLUGIN_AUTO_TAG` also recognizes a semantic version
+To avoid confusion between repo tags and image tags, `PLUGIN_EXPAND_TAG` also recognizes a semantic version
 without the `v` prefix.  As such, the following is also equivalent to the above:
 
 ```console
 docker run --rm \
     -e PLUGIN_TAGS=1.2.3,latest \
+    -e PLUGIN_EXPAND_TAG=true \
+    -v $(pwd):/drone \
+    -w /drone \
+    plugins/kaniko:linux-amd64
+```
+
+### Auto Tagging
+The [auto tag feature](https://plugins.drone.io/drone-plugins/drone-docker) of docker plugin is also supported.
+
+When auto tagging is enabled, if any of the case is matched below, a docker build will be pushed with auto generated tags. Otherwise the docker build will be skipped.
+
+**Note**: this feature only works for build labels. Artifact labels are not supported.
+
+#### Git Tag Push:
+
+```console
+docker run --rm \
+    -e DRONE_COMMIT_REF=refs/tags/v1.2.3 \
+    -e PLUGIN_REPO=foo/bar \
+    -e PLUGIN_USERNAME=foo \
+    -e PLUGIN_PASSWORD=bar \
     -e PLUGIN_AUTO_TAG=true \
     -v $(pwd):/drone \
     -w /drone \
     plugins/kaniko:linux-amd64
 ```
+
+Tags to push:
+- 1.2.3
+- 1.2
+- 1
+
+#### Git Commit Push in default branch:
+
+```console
+docker run --rm \
+    -e DRONE_COMMIT_REF=refs/heads/master \
+    -e DRONE_REPO_BRANCH=main \
+    -e PLUGIN_REPO=foo/bar \
+    -e PLUGIN_USERNAME=foo \
+    -e PLUGIN_PASSWORD=bar \
+    -e PLUGIN_AUTO_TAG=true \
+    -v $(pwd):/drone \
+    -w /drone \
+    plugins/kaniko:linux-amd64
+```
+
+Tags to push:
+- latest

cmd/kaniko-docker/main.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
+	"strings"
 
 	"github.com/joho/godotenv"
 	"github.com/pkg/errors"
@@ -57,6 +58,16 @@ func main() {
 			Value:  ".",
 			EnvVar: "PLUGIN_CONTEXT",
 		},
+		cli.StringFlag{
+			Name:   "drone-commit-ref",
+			Usage:  "git commit ref passed by Drone",
+			EnvVar: "DRONE_COMMIT_REF",
+		},
+		cli.StringFlag{
+			Name:   "drone-repo-branch",
+			Usage:  "git repository default branch passed by Drone",
+			EnvVar: "DRONE_REPO_BRANCH",
+		},
 		cli.StringSliceFlag{
 			Name:     "tags",
 			Usage:    "build tags",
@@ -65,10 +76,25 @@ func main() {
 			FilePath: ".tags",
 		},
 		cli.BoolFlag{
-			Name:   "auto_tag",
+			Name:   "expand-repo",
+			Usage:  "Prepends the registry url to the repo if registry url is not specified in repo name",
+			EnvVar: "PLUGIN_EXPAND_REPO",
+		},
+		cli.BoolFlag{
+			Name:   "expand-tag",
 			Usage:  "enable for semver tagging",
+			EnvVar: "PLUGIN_EXPAND_TAG",
+		},
+		cli.BoolFlag{
+			Name:   "auto-tag",
+			Usage:  "enable auto generation of build tags",
 			EnvVar: "PLUGIN_AUTO_TAG",
 		},
+		cli.StringFlag{
+			Name:   "auto-tag-suffix",
+			Usage:  "the suffix of auto build tags",
+			EnvVar: "PLUGIN_AUTO_TAG_SUFFIX",
+		},
 		cli.StringSliceFlag{
 			Name:   "args",
 			Usage:  "build args",
@@ -95,6 +121,11 @@ func main() {
 			Value:  v1RegistryURL,
 			EnvVar: "PLUGIN_REGISTRY",
 		},
+		cli.StringSliceFlag{
+			Name:   "registry-mirrors",
+			Usage:  "docker registry mirrors",
+			EnvVar: "PLUGIN_REGISTRY_MIRRORS",
+		},
 		cli.StringFlag{
 			Name:   "username",
 			Usage:  "docker username",
@@ -145,6 +176,16 @@ func main() {
 			Usage:  "Set this flag with value as oneof <panic|fatal|error|warn|info|debug|trace> to set the logging level for kaniko. Defaults to info.",
 			EnvVar: "PLUGIN_VERBOSITY",
 		},
+		cli.StringFlag{
+			Name:   "platform",
+			Usage:  "Allows to build with another default platform than the host, similarly to docker build --platform",
+			EnvVar: "PLUGIN_PLATFORM",
+		},
+		cli.BoolFlag{
+			Name:   "skip-unused-stages",
+			Usage:  "build only used stages",
+			EnvVar: "PLUGIN_SKIP_UNUSED_STAGES",
+		},
 	}
 
 	if err := app.Run(os.Args); err != nil {
@@ -165,26 +206,33 @@ func run(c *cli.Context) error {
 
 	plugin := kaniko.Plugin{
 		Build: kaniko.Build{
-			Dockerfile:    c.String("dockerfile"),
+			DroneCommitRef:   c.String("drone-commit-ref"),
-			Context:       c.String("context"),
+			DroneRepoBranch:  c.String("drone-repo-branch"),
-			Tags:          c.StringSlice("tags"),
+			Dockerfile:       c.String("dockerfile"),
-			AutoTag:       c.Bool("auto_tag"),
+			Context:          c.String("context"),
-			Args:          c.StringSlice("args"),
+			Tags:             c.StringSlice("tags"),
-			Target:        c.String("target"),
+			AutoTag:          c.Bool("auto-tag"),
-			Repo:          c.String("repo"),
+			AutoTagSuffix:    c.String("auto-tag-suffix"),
-			Labels:        c.StringSlice("custom-labels"),
+			ExpandTag:        c.Bool("expand-tag"),
-			SkipTlsVerify: c.Bool("skip-tls-verify"),
+			Args:             c.StringSlice("args"),
-			SnapshotMode:  c.String("snapshot-mode"),
+			Target:           c.String("target"),
-			EnableCache:   c.Bool("enable-cache"),
+			Repo:             buildRepo(c.String("registry"), c.String("repo"), c.Bool("expand-repo")),
-			CacheRepo:     c.String("cache-repo"),
+			Mirrors:          c.StringSlice("registry-mirrors"),
-			CacheTTL:      c.Int("cache-ttl"),
+			Labels:           c.StringSlice("custom-labels"),
-			DigestFile:    defaultDigestFile,
+			SkipTlsVerify:    c.Bool("skip-tls-verify"),
-			NoPush:        noPush,
+			SnapshotMode:     c.String("snapshot-mode"),
-			Verbosity:     c.String("verbosity"),
+			EnableCache:      c.Bool("enable-cache"),
+			CacheRepo:        buildRepo(c.String("registry"), c.String("cache-repo"), c.Bool("expand-repo")),
+			CacheTTL:         c.Int("cache-ttl"),
+			DigestFile:       defaultDigestFile,
+			NoPush:           noPush,
+			Verbosity:        c.String("verbosity"),
+			Platform:         c.String("platform"),
+			SkipUnusedStages: c.Bool("skip-unused-stages"),
 		},
 		Artifact: kaniko.Artifact{
 			Tags:         c.StringSlice("tags"),
-			Repo:         c.String("repo"),
+			Repo:         buildRepo(c.String("registry"), c.String("repo"), c.Bool("expand-repo")),
 			Registry:     c.String("registry"),
 			ArtifactFile: c.String("artifact-file"),
 			RegistryType: artifact.Docker,
@@ -225,3 +273,19 @@ func createDockerCfgFile(username, password, registry string) error {
 	}
 	return nil
 }
+
+func buildRepo(registry, repo string, expandRepo bool) string {
+	if !expandRepo || registry == "" || registry == v1RegistryURL {
+		// No custom registry, just return the repo name
+		return repo
+	}
+	// Trim off trailing slash to prevent double slash when combining with repo
+	registry = strings.TrimSuffix(registry, "/")
+	if strings.HasPrefix(repo, registry+"/") {
+		// Repo already includes the registry prefix
+		// For backward compatibility, we won't add the prefix again.
+		return repo
+	}
+	// Prefix the repo with the registry
+	return registry + "/" + repo
+}

cmd/kaniko-docker/main_test.go

@@ -0,0 +1,37 @@
+package main
+
+import "testing"
+
+func Test_buildRepo(t *testing.T) {
+	tests := []struct {
+		name     string
+		registry string
+		repo     string
+		want     string
+	}{
+		{
+			name: "dockerhub",
+			repo: "golang",
+			want: "golang",
+		},
+		{
+			name:     "internal",
+			registry: "artifactory.example.com",
+			repo:     "service",
+			want:     "artifactory.example.com/service",
+		},
+		{
+			name:     "backward_compatibility",
+			registry: "artifactory.example.com",
+			repo:     "artifactory.example.com/service",
+			want:     "artifactory.example.com/service",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := buildRepo(tt.registry, tt.repo, true); got != tt.want {
+				t.Errorf("buildRepo(%q, %q) = %v, want %v", tt.registry, tt.repo, got, tt.want)
+			}
+		})
+	}
+}

cmd/kaniko-ecr/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -12,14 +13,19 @@ import (
 	"github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/service/ecr"
 	"github.com/aws/aws-sdk-go-v2/service/ecrpublic"
+	awsv1 "github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
+	"github.com/aws/aws-sdk-go/aws/session"
+	ecrv1 "github.com/aws/aws-sdk-go/service/ecr"
 	"github.com/aws/smithy-go"
-	kaniko "github.com/drone/drone-kaniko"
-	"github.com/drone/drone-kaniko/pkg/artifact"
-	"github.com/drone/drone-kaniko/pkg/docker"
 	"github.com/joho/godotenv"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
+
+	kaniko "github.com/drone/drone-kaniko"
+	"github.com/drone/drone-kaniko/pkg/artifact"
+	"github.com/drone/drone-kaniko/pkg/docker"
 )
 
 const (
@@ -71,6 +77,16 @@ func main() {
 			Value:  ".",
 			EnvVar: "PLUGIN_CONTEXT",
 		},
+		cli.StringFlag{
+			Name:   "drone-commit-ref",
+			Usage:  "git commit ref passed by Drone",
+			EnvVar: "DRONE_COMMIT_REF",
+		},
+		cli.StringFlag{
+			Name:   "drone-repo-branch",
+			Usage:  "git repository default branch passed by Drone",
+			EnvVar: "DRONE_REPO_BRANCH",
+		},
 		cli.StringSliceFlag{
 			Name:     "tags",
 			Usage:    "build tags",
@@ -79,10 +95,20 @@ func main() {
 			FilePath: ".tags",
 		},
 		cli.BoolFlag{
-			Name:   "auto_tag",
+			Name:   "expand-tag",
 			Usage:  "enable for semver tagging",
+			EnvVar: "PLUGIN_EXPAND_TAG",
+		},
+		cli.BoolFlag{
+			Name:   "auto-tag",
+			Usage:  "enable auto generation of build tags",
 			EnvVar: "PLUGIN_AUTO_TAG",
 		},
+		cli.StringFlag{
+			Name:   "auto-tag-suffix",
+			Usage:  "the suffix of auto build tags",
+			EnvVar: "PLUGIN_AUTO_TAG_SUFFIX",
+		},
 		cli.StringSliceFlag{
 			Name:   "args",
 			Usage:  "build args",
@@ -119,6 +145,11 @@ func main() {
 			Usage:  "ECR registry",
 			EnvVar: "PLUGIN_REGISTRY",
 		},
+		cli.StringSliceFlag{
+			Name:   "registry-mirrors",
+			Usage:  "docker registry mirrors",
+			EnvVar: "PLUGIN_REGISTRY_MIRRORS",
+		},
 		cli.StringFlag{
 			Name:   "access-key",
 			Usage:  "ECR access key",
@@ -129,6 +160,16 @@ func main() {
 			Usage:  "ECR secret key",
 			EnvVar: "PLUGIN_SECRET_KEY",
 		},
+		cli.StringFlag{
+			Name:   "assume-role",
+			Usage:  "Assume a role",
+			EnvVar: "PLUGIN_ASSUME_ROLE",
+		},
+		cli.StringFlag{
+			Name:   "external-id",
+			Usage:  "Used along with assume role to assume a role",
+			EnvVar: "PLUGIN_EXTERNAL_ID",
+		},
 		cli.StringFlag{
 			Name:   "snapshot-mode",
 			Usage:  "Specify one of full, redo or time as snapshot mode",
@@ -174,6 +215,16 @@ func main() {
 			Usage:  "Set this flag with value as oneof <panic|fatal|error|warn|info|debug|trace> to set the logging level for kaniko. Defaults to info.",
 			EnvVar: "PLUGIN_VERBOSITY",
 		},
+		cli.StringFlag{
+			Name:   "platform",
+			Usage:  "Allows to build with another default platform than the host, similarly to docker build --platform",
+			EnvVar: "PLUGIN_PLATFORM",
+		},
+		cli.BoolFlag{
+			Name:   "skip-unused-stages",
+			Usage:  "build only used stages",
+			EnvVar: "PLUGIN_SKIP_UNUSED_STAGES",
+		},
 	}
 
 	if err := app.Run(os.Args); err != nil {
@@ -193,6 +244,9 @@ func run(c *cli.Context) error {
 		c.String("access-key"),
 		c.String("secret-key"),
 		registry,
+		c.String("assume-role"),
+		c.String("external-id"),
+		region,
 		noPush,
 	)
 	if err != nil {
@@ -237,21 +291,28 @@ func run(c *cli.Context) error {
 
 	plugin := kaniko.Plugin{
 		Build: kaniko.Build{
-			Dockerfile:   c.String("dockerfile"),
+			DroneCommitRef:   c.String("drone-commit-ref"),
-			Context:      c.String("context"),
+			DroneRepoBranch:  c.String("drone-repo-branch"),
-			Tags:         c.StringSlice("tags"),
+			Dockerfile:       c.String("dockerfile"),
-			AutoTag:      c.Bool("auto_tag"),
+			Context:          c.String("context"),
-			Args:         c.StringSlice("args"),
+			Tags:             c.StringSlice("tags"),
-			Target:       c.String("target"),
+			AutoTag:          c.Bool("auto-tag"),
-			Repo:         fmt.Sprintf("%s/%s", c.String("registry"), c.String("repo")),
+			AutoTagSuffix:    c.String("auto-tag-suffix"),
-			Labels:       c.StringSlice("custom-labels"),
+			ExpandTag:        c.Bool("expand-tag"),
-			SnapshotMode: c.String("snapshot-mode"),
+			Args:             c.StringSlice("args"),
-			EnableCache:  c.Bool("enable-cache"),
+			Target:           c.String("target"),
-			CacheRepo:    fmt.Sprintf("%s/%s", c.String("registry"), c.String("cache-repo")),
+			Repo:             fmt.Sprintf("%s/%s", c.String("registry"), c.String("repo")),
-			CacheTTL:     c.Int("cache-ttl"),
+			Mirrors:          c.StringSlice("registry-mirrors"),
-			DigestFile:   defaultDigestFile,
+			Labels:           c.StringSlice("custom-labels"),
-			NoPush:       noPush,
+			SnapshotMode:     c.String("snapshot-mode"),
-			Verbosity:    c.String("verbosity"),
+			EnableCache:      c.Bool("enable-cache"),
+			CacheRepo:        fmt.Sprintf("%s/%s", c.String("registry"), c.String("cache-repo")),
+			CacheTTL:         c.Int("cache-ttl"),
+			DigestFile:       defaultDigestFile,
+			NoPush:           noPush,
+			Verbosity:        c.String("verbosity"),
+			Platform:         c.String("platform"),
+			SkipUnusedStages: c.Bool("skip-unused-stages"),
 		},
 		Artifact: kaniko.Artifact{
 			Tags:         c.StringSlice("tags"),
@@ -264,15 +325,23 @@ func run(c *cli.Context) error {
 	return plugin.Exec()
 }
 
-func createDockerConfig(dockerUsername, dockerPassword, accessKey, secretKey, registry string, noPush bool) (*docker.Config, error) {
+func createDockerConfig(dockerUsername, dockerPassword, accessKey, secretKey,
+	registry, assumeRole, externalId, region string, noPush bool) (*docker.Config, error) {
 	dockerConfig := docker.NewConfig()
 
 	if dockerUsername != "" {
 		dockerConfig.SetAuth(docker.RegistryV1, dockerUsername, dockerPassword)
 	}
 
-	// only setup auth when pushing or credentials are defined
+	if assumeRole != "" {
-	if !noPush || accessKey != "" {
+		var err error
+		username, password, registry, err := getAssumeRoleCreds(region, assumeRole, externalId, "")
+		if err != nil {
+			return nil, err
+		}
+		dockerConfig.SetAuth(registry, username, password)
+	} else if !noPush || accessKey != "" {
+		// only setup auth when pushing or credentials are defined
 		if registry == "" {
 			return nil, fmt.Errorf("registry must be specified")
 		}
@@ -377,6 +446,50 @@ func uploadRepositoryPolicy(region, repo, registry, repositoryPolicy string) (er
 	return err
 }
 
+func getAssumeRoleCreds(region, roleArn, externalId, roleSessionName string) (string, string, string, error) {
+	sess, err := session.NewSession(&awsv1.Config{Region: &region})
+	if err != nil {
+		return "", "", "", errors.Wrap(err, "failed to create aws session")
+	}
+
+	svc := ecrv1.New(sess, &awsv1.Config{
+		Credentials: stscreds.NewCredentials(sess, roleArn, func(p *stscreds.AssumeRoleProvider) {
+			if externalId != "" {
+				p.ExternalID = &externalId
+			}
+		}),
+	})
+
+	username, password, registry, err := getAuthInfo(svc)
+	if err != nil {
+		return "", "", "", errors.Wrap(err, "failed to get ECR auth")
+	}
+	return username, password, registry, nil
+}
+
+func getAuthInfo(svc *ecrv1.ECR) (username, password, registry string, err error) {
+	var result *ecrv1.GetAuthorizationTokenOutput
+	var decoded []byte
+
+	result, err = svc.GetAuthorizationToken(&ecrv1.GetAuthorizationTokenInput{})
+	if err != nil {
+		return
+	}
+
+	auth := result.AuthorizationData[0]
+	token := *auth.AuthorizationToken
+	decoded, err = base64.StdEncoding.DecodeString(token)
+	if err != nil {
+		return
+	}
+
+	registry = strings.TrimPrefix(*auth.ProxyEndpoint, "https://")
+	creds := strings.Split(string(decoded), ":")
+	username = creds[0]
+	password = creds[1]
+	return
+}
+
 func isRegistryPublic(registry string) bool {
 	return strings.HasPrefix(registry, ecrPublicDomain)
 }

cmd/kaniko-ecr/main_test.go

@@ -14,6 +14,9 @@ func TestCreateDockerConfig(t *testing.T) {
 		"access-key",
 		"secret-key",
 		"ecr-registry",
+		"",
+		"",
+		"",
 		false,
 	)
 	if err != nil {

cmd/kaniko-gcr/main.go

@@ -52,6 +52,16 @@ func main() {
 			Value:  ".",
 			EnvVar: "PLUGIN_CONTEXT",
 		},
+		cli.StringFlag{
+			Name:   "drone-commit-ref",
+			Usage:  "git commit ref passed by Drone",
+			EnvVar: "DRONE_COMMIT_REF",
+		},
+		cli.StringFlag{
+			Name:   "drone-repo-branch",
+			Usage:  "git repository default branch passed by Drone",
+			EnvVar: "DRONE_REPO_BRANCH",
+		},
 		cli.StringSliceFlag{
 			Name:     "tags",
 			Usage:    "build tags",
@@ -60,10 +70,20 @@ func main() {
 			FilePath: ".tags",
 		},
 		cli.BoolFlag{
-			Name:   "auto_tag",
+			Name:   "expand-tag",
 			Usage:  "enable for semver tagging",
+			EnvVar: "PLUGIN_EXPAND_TAG",
+		},
+		cli.BoolFlag{
+			Name:   "auto-tag",
+			Usage:  "enable auto generation of build tags",
 			EnvVar: "PLUGIN_AUTO_TAG",
 		},
+		cli.StringFlag{
+			Name:   "auto-tag-suffix",
+			Usage:  "the suffix of auto build tags",
+			EnvVar: "PLUGIN_AUTO_TAG_SUFFIX",
+		},
 		cli.StringSliceFlag{
 			Name:   "args",
 			Usage:  "build args",
@@ -90,6 +110,11 @@ func main() {
 			Value:  "gcr.io",
 			EnvVar: "PLUGIN_REGISTRY",
 		},
+		cli.StringSliceFlag{
+			Name:   "registry-mirrors",
+			Usage:  "docker registry mirrors",
+			EnvVar: "PLUGIN_REGISTRY_MIRRORS",
+		},
 		cli.StringFlag{
 			Name:   "json-key",
 			Usage:  "docker username",
@@ -130,6 +155,16 @@ func main() {
 			Usage:  "Set this flag as --verbosity=<panic|fatal|error|warn|info|debug|trace> to set the logging level for kaniko. Defaults to info.",
 			EnvVar: "PLUGIN_VERBOSITY",
 		},
+		cli.StringFlag{
+			Name:   "platform",
+			Usage:  "Allows to build with another default platform than the host, similarly to docker build --platform",
+			EnvVar: "PLUGIN_PLATFORM",
+		},
+		cli.BoolFlag{
+			Name:   "skip-unused-stages",
+			Usage:  "build only used stages",
+			EnvVar: "PLUGIN_SKIP_UNUSED_STAGES",
+		},
 	}
 
 	if err := app.Run(os.Args); err != nil {
@@ -152,21 +187,28 @@ func run(c *cli.Context) error {
 
 	plugin := kaniko.Plugin{
 		Build: kaniko.Build{
-			Dockerfile:   c.String("dockerfile"),
+			DroneCommitRef:   c.String("drone-commit-ref"),
-			Context:      c.String("context"),
+			DroneRepoBranch:  c.String("drone-repo-branch"),
-			Tags:         c.StringSlice("tags"),
+			Dockerfile:       c.String("dockerfile"),
-			AutoTag:      c.Bool("auto_tag"),
+			Context:          c.String("context"),
-			Args:         c.StringSlice("args"),
+			Tags:             c.StringSlice("tags"),
-			Target:       c.String("target"),
+			AutoTag:          c.Bool("auto-tag"),
-			Repo:         fmt.Sprintf("%s/%s", c.String("registry"), c.String("repo")),
+			AutoTagSuffix:    c.String("auto-tag-suffix"),
-			Labels:       c.StringSlice("custom-labels"),
+			ExpandTag:        c.Bool("expand-tag"),
-			SnapshotMode: c.String("snapshot-mode"),
+			Args:             c.StringSlice("args"),
-			EnableCache:  c.Bool("enable-cache"),
+			Target:           c.String("target"),
-			CacheRepo:    fmt.Sprintf("%s/%s", c.String("registry"), c.String("cache-repo")),
+			Repo:             fmt.Sprintf("%s/%s", c.String("registry"), c.String("repo")),
-			CacheTTL:     c.Int("cache-ttl"),
+			Mirrors:          c.StringSlice("registry-mirrors"),
-			DigestFile:   defaultDigestFile,
+			Labels:           c.StringSlice("custom-labels"),
-			NoPush:       noPush,
+			SnapshotMode:     c.String("snapshot-mode"),
-			Verbosity:    c.String("verbosity"),
+			EnableCache:      c.Bool("enable-cache"),
+			CacheRepo:        fmt.Sprintf("%s/%s", c.String("registry"), c.String("cache-repo")),
+			CacheTTL:         c.Int("cache-ttl"),
+			DigestFile:       defaultDigestFile,
+			NoPush:           noPush,
+			Verbosity:        c.String("verbosity"),
+			Platform:         c.String("platform"),
+			SkipUnusedStages: c.Bool("skip-unused-stages"),
 		},
 		Artifact: kaniko.Artifact{
 			Tags:         c.StringSlice("tags"),

docker/docker/Dockerfile.linux.amd64.kaniko1.8.1

@@ -0,0 +1,4 @@
+FROM gcr.io/kaniko-project/executor:v1.8.1
+
+ADD release/linux/amd64/kaniko-docker /kaniko/
+ENTRYPOINT ["/kaniko/kaniko-docker"]

docker/docker/manifest-kaniko1.8.1.tmpl

@@ -0,0 +1,13 @@
+image: plugins/kaniko:{{#if build.tag}}{{trimPrefix "v" build.tag}}-kaniko1.8.1{{else}}latest-kaniko1.8.1{{/if}}
+{{#if build.tags}}
+tags:
+{{#each build.tags}}
+  - {{this}}
+{{/each}}
+{{/if}}
+manifests:
+  -
+    image: plugins/kaniko:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-amd64-kaniko1.8.1
+    platform:
+      architecture: amd64
+      os: linux

docker/ecr/Dockerfile.linux.amd64.kaniko1.8.1

@@ -0,0 +1,4 @@
+FROM gcr.io/kaniko-project/executor:v1.8.1
+
+ADD release/linux/amd64/kaniko-ecr /kaniko/
+ENTRYPOINT ["/kaniko/kaniko-ecr"]

docker/ecr/manifest-kaniko1.8.1.tmpl

@@ -0,0 +1,13 @@
+image: plugins/kaniko-ecr:{{#if build.tag}}{{trimPrefix "v" build.tag}}-kaniko1.8.1{{else}}latest-kaniko1.8.1{{/if}}
+{{#if build.tags}}
+tags:
+{{#each build.tags}}
+  - {{this}}
+{{/each}}
+{{/if}}
+manifests:
+  -
+    image: plugins/kaniko-ecr:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-amd64-kaniko1.8.1
+    platform:
+      architecture: amd64
+      os: linux

docker/gcr/Dockerfile.linux.amd64.kaniko1.8.1

@@ -0,0 +1,4 @@
+FROM gcr.io/kaniko-project/executor:v1.8.1
+
+ADD release/linux/amd64/kaniko-gcr /kaniko/
+ENTRYPOINT ["/kaniko/kaniko-gcr"]

docker/gcr/manifest-kaniko1.8.1.tmpl

@@ -0,0 +1,13 @@
+image: plugins/kaniko-gcr:{{#if build.tag}}{{trimPrefix "v" build.tag}}-kaniko1.8.1{{else}}latest-kaniko1.8.1{{/if}}
+{{#if build.tags}}
+tags:
+{{#each build.tags}}
+  - {{this}}
+{{/each}}
+{{/if}}
+manifests:
+  -
+    image: plugins/kaniko-gcr:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-amd64-kaniko1.8.1
+    platform:
+      architecture: amd64
+      os: linux

go.mod

@@ -1,17 +1,19 @@
 module github.com/drone/drone-kaniko
 
 require (
+	github.com/aws/aws-sdk-go v1.44.51
 	github.com/aws/aws-sdk-go-v2 v1.8.1
 	github.com/aws/aws-sdk-go-v2/config v1.6.1
 	github.com/aws/aws-sdk-go-v2/service/ecr v1.4.3
 	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.4.3
 	github.com/aws/smithy-go v1.7.0
+	github.com/coreos/go-semver v0.3.0
 	github.com/google/go-cmp v0.5.6
 	github.com/joho/godotenv v1.3.0
 	github.com/pkg/errors v0.9.1
 	github.com/sirupsen/logrus v1.3.0
 	github.com/urfave/cli v1.22.2
-	golang.org/x/mod v0.4.2
+	golang.org/x/mod v0.5.1
 )
 
 require (
@@ -27,7 +29,7 @@ require (
 	github.com/russross/blackfriday/v2 v2.0.1 // indirect
 	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
 	golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 // indirect
-	golang.org/x/sys v0.0.0-20190412213103-97732733099d // indirect
+	golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e // indirect
 )
 
-go 1.17
+go 1.18

go.sum

@@ -1,4 +1,6 @@
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/aws/aws-sdk-go v1.44.51 h1:jO9hoLynZOrMM4dj0KjeKIK+c6PA+HQbKoHOkAEye2Y=
+github.com/aws/aws-sdk-go v1.44.51/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go-v2 v1.8.1 h1:GcFgQl7MsBygmeeqXyV1ivrTEmsVz/rdFJaTcltG9ag=
 github.com/aws/aws-sdk-go-v2 v1.8.1/go.mod h1:xEFuWz+3TYdlPRuo+CqATbeDWIWyaT5uAPwPaWtgse0=
 github.com/aws/aws-sdk-go-v2/config v1.6.1 h1:qrZINaORyr78syO1zfD4l7r4tZjy0Z1l0sy4jiysyOM=
@@ -21,6 +23,8 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.6.2 h1:l504GWCoQi1Pk68vSUFGLmDIEMzRf
 github.com/aws/aws-sdk-go-v2/service/sts v1.6.2/go.mod h1:RBhoMJB8yFToaCnbe0jNq5Dcdy0jp6LhHqg55rjClkM=
 github.com/aws/smithy-go v1.7.0 h1:+cLHMRrDZvQ4wk+KuQ9yH6eEg6KZEJ9RI2IkDqnygCg=
 github.com/aws/smithy-go v1.7.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
+github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
+github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -57,19 +61,20 @@ golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnf
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/mod v0.4.2 h1:Gz96sIWK3OalVv/I/qNygP42zyoKp3xptRVCWRFEBvo=
+golang.org/x/mod v0.5.1 h1:OJxoQ/rynoF0dcCdI7cLPktw/hR2cueqYfjm43oqK38=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e h1:fLOSk5Q00efkSvAm+4xcoXD+RRmLmmulPn5I3Y9F2EM=
+golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

kaniko.go

@@ -8,28 +8,36 @@ import (
 	"strings"
 
 	"github.com/drone/drone-kaniko/pkg/artifact"
+	"github.com/drone/drone-kaniko/pkg/tagger"
 	"golang.org/x/mod/semver"
 )
 
 type (
 	// Build defines Docker build parameters.
 	Build struct {
-		Dockerfile    string   // Docker build Dockerfile
+		DroneCommitRef   string   // Drone git commit reference
-		Context       string   // Docker build context
+		DroneRepoBranch  string   // Drone repo branch
-		Tags          []string // Docker build tags
+		Dockerfile       string   // Docker build Dockerfile
-		AutoTag       bool     // Set this to create semver-tagged labels
+		Context          string   // Docker build context
-		Args          []string // Docker build args
+		Tags             []string // Docker build tags
-		Target        string   // Docker build target
+		AutoTag          bool     // Set this to auto detect tags from git commits and semver-tagged labels
-		Repo          string   // Docker build repository
+		AutoTagSuffix    string   // Suffix to append to the auto detect tags
-		Labels        []string // Label map
+		ExpandTag        bool     // Set this to expand the `Tags` into semver-tagged labels
-		SkipTlsVerify bool     // Docker skip tls certificate verify for registry
+		Args             []string // Docker build args
-		SnapshotMode  string   // Kaniko snapshot mode
+		Target           string   // Docker build target
-		EnableCache   bool     // Whether to enable kaniko cache
+		Repo             string   // Docker build repository
-		CacheRepo     string   // Remote repository that will be used to store cached layers
+		Mirrors          []string // Docker repository mirrors
-		CacheTTL      int      // Cache timeout in hours
+		Labels           []string // Label map
-		DigestFile    string   // Digest file location
+		SkipTlsVerify    bool     // Docker skip tls certificate verify for registry
-		NoPush        bool     // Set this flag if you only want to build the image, without pushing to a registry
+		SnapshotMode     string   // Kaniko snapshot mode
-		Verbosity     string   // Log level
+		EnableCache      bool     // Whether to enable kaniko cache
+		CacheRepo        string   // Remote repository that will be used to store cached layers
+		CacheTTL         int      // Cache timeout in hours
+		DigestFile       string   // Digest file location
+		NoPush           bool     // Set this flag if you only want to build the image, without pushing to a registry
+		Verbosity        string   // Log level
+		Platform         string   // Allows to build with another default platform than the host, similarly to docker build --platform
+		SkipUnusedStages bool     // Build only used stages
 	}
 
 	// Artifact defines content of artifact file
@@ -48,7 +56,7 @@ type (
 	}
 )
 
-// labelsForTag returns the labels to use for the given tag, subject to the value of AutoTag.
+// labelsForTag returns the labels to use for the given tag, subject to the value of ExpandTag.
 //
 // Build information (e.g. +linux_amd64) is carried through to all labels.
 // Pre-release information (e.g. -rc1) suppresses major and major+minor auto-labels.
@@ -65,8 +73,8 @@ func (b Build) labelsForTag(tag string) (labels []string) {
 		semverTag = withV
 	}
 
-	// Pass through tags if auto-tag is not set, or if the tag is not a semantic version
+	// Pass through tags if expand-tag is not set, or if the tag is not a semantic version
-	if !b.AutoTag || !semver.IsValid(semverTag) {
+	if !b.ExpandTag || !semver.IsValid(semverTag) {
 		return []string{tag}
 	}
 	tag = semverTag
@@ -89,6 +97,30 @@ func (b Build) labelsForTag(tag string) (labels []string) {
 	}
 }
 
+// Returns the auto detected tags. See the AutoTag section of
+// https://plugins.drone.io/drone-plugins/drone-docker/ for more info.
+func (b Build) AutoTags() (tags []string, err error) {
+	if len(b.Tags) > 1 || len(b.Tags) == 1 && b.Tags[0] != "latest" {
+		err = fmt.Errorf("The auto-tag flag does not work with user provided tags %s", b.Tags)
+		return
+	}
+	// We have tried the best to prevent enabling auto-tag and passing in
+	// user specified at the same time. Starts to auto detect tags.
+	// Note: passing in a "latest" tag with auto-tag enabled won't trigger the
+	// early returns above, because we cannot tell if the tag is provided by
+	// the default value or by the users.
+	commitRef := b.DroneCommitRef
+	if !tagger.UseAutoTag(commitRef, b.DroneRepoBranch) {
+		err = fmt.Errorf("Could not auto detect the tag. Skipping automated docker build for commit %s", commitRef)
+		return
+	}
+	tags, err = tagger.AutoTagsSuffix(commitRef, b.AutoTagSuffix)
+	if err != nil {
+		err = fmt.Errorf("Invalid semantic version when auto detecting the tag. Skipping automated docker build for %s.", commitRef)
+	}
+	return
+}
+
 // Exec executes the plugin step
 func (p Plugin) Exec() error {
 	if !p.Build.NoPush && p.Build.Repo == "" {
@@ -99,6 +131,18 @@ func (p Plugin) Exec() error {
 		return fmt.Errorf("dockerfile does not exist at path: %s", p.Build.Dockerfile)
 	}
 
+	var tags = p.Build.Tags
+	if p.Build.AutoTag && p.Build.ExpandTag {
+		return fmt.Errorf("The auto-tag flag conflicts with the expand-tag flag")
+	}
+	if p.Build.AutoTag {
+		var err error
+		tags, err = p.Build.AutoTags()
+		if err != nil {
+			return err
+		}
+	}
+
 	cmdArgs := []string{
 		fmt.Sprintf("--dockerfile=%s", p.Build.Dockerfile),
 		fmt.Sprintf("--context=dir://%s", p.Build.Context),
@@ -106,7 +150,7 @@ func (p Plugin) Exec() error {
 
 	// Set the destination repository
 	if !p.Build.NoPush {
-		for _, tag := range p.Build.Tags {
+		for _, tag := range tags {
 			for _, label := range p.Build.labelsForTag(tag) {
 				cmdArgs = append(cmdArgs, fmt.Sprintf("--destination=%s:%s", p.Build.Repo, label))
 			}
@@ -120,7 +164,10 @@ func (p Plugin) Exec() error {
 	for _, label := range p.Build.Labels {
 		cmdArgs = append(cmdArgs, fmt.Sprintf("--label=%s", label))
 	}
-
+	// Set repository mirrors
+	for _, mirror := range p.Build.Mirrors {
+		cmdArgs = append(cmdArgs, fmt.Sprintf("--registry-mirror=%s", mirror))
+	}
 	if p.Build.Target != "" {
 		cmdArgs = append(cmdArgs, fmt.Sprintf("--target=%s", p.Build.Target))
 	}
@@ -142,7 +189,7 @@ func (p Plugin) Exec() error {
 	}
 
 	if p.Build.CacheTTL != 0 {
-		cmdArgs = append(cmdArgs, fmt.Sprintf("--cache-ttl=%d", p.Build.CacheTTL))
+		cmdArgs = append(cmdArgs, fmt.Sprintf("--cache-ttl=%dh", p.Build.CacheTTL))
 	}
 
 	if p.Build.DigestFile != "" {
@@ -157,6 +204,14 @@ func (p Plugin) Exec() error {
 		cmdArgs = append(cmdArgs, fmt.Sprintf("--verbosity=%s", p.Build.Verbosity))
 	}
 
+	if p.Build.Platform != "" {
+		cmdArgs = append(cmdArgs, fmt.Sprintf("--customPlatform=%s", p.Build.Platform))
+	}
+
+	if p.Build.SkipUnusedStages {
+		cmdArgs = append(cmdArgs, "--skip-unused-stages")
+	}
+
 	cmd := exec.Command("/kaniko/executor", cmdArgs...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr

kaniko_test.go

@@ -8,67 +8,134 @@ import (
 
 func TestBuild_labelsForTag(t *testing.T) {
 	tests := []struct {
-		name     string
+		name       string
-		tag      string
+		tag        string
-		autoTags []string
+		expandTags []string
 	}{
 		{
-			name:     "semver",
+			name:       "semver",
-			tag:      "v1.2.3",
+			tag:        "v1.2.3",
-			autoTags: []string{"1", "1.2", "1.2.3"},
+			expandTags: []string{"1", "1.2", "1.2.3"},
 		},
 		{
-			name:     "no_patch",
+			name:       "no_patch",
-			tag:      "v1.2",
+			tag:        "v1.2",
-			autoTags: []string{"1", "1.2", "1.2.0"},
+			expandTags: []string{"1", "1.2", "1.2.0"},
 		},
 		{
-			name:     "only_major",
+			name:       "only_major",
-			tag:      "v1",
+			tag:        "v1",
-			autoTags: []string{"1", "1.0", "1.0.0"},
+			expandTags: []string{"1", "1.0", "1.0.0"},
 		},
 		{
-			name:     "full_with_build",
+			name:       "full_with_build",
-			tag:      "v1.2.3+build-info",
+			tag:        "v1.2.3+build-info",
-			autoTags: []string{"1+build-info", "1.2+build-info", "1.2.3+build-info"},
+			expandTags: []string{"1+build-info", "1.2+build-info", "1.2.3+build-info"},
 		},
 		{
-			name:     "build_with_underscores",
+			name:       "build_with_underscores",
-			tag:      "v1.2.3+linux_amd64",
+			tag:        "v1.2.3+linux_amd64",
-			autoTags: []string{"1+linux-amd64", "1.2+linux-amd64", "1.2.3+linux-amd64"},
+			expandTags: []string{"1+linux-amd64", "1.2+linux-amd64", "1.2.3+linux-amd64"},
 		},
 		{
-			name:     "prerelease",
+			name:       "prerelease",
-			tag:      "v1.2.3-rc1",
+			tag:        "v1.2.3-rc1",
-			autoTags: []string{"1.2.3-rc1"},
+			expandTags: []string{"1.2.3-rc1"},
 		},
 		{
-			name:     "prerelease_with_build",
+			name:       "prerelease_with_build",
-			tag:      "v1.2.3-rc1+bld",
+			tag:        "v1.2.3-rc1+bld",
-			autoTags: []string{"1.2.3-rc1+bld"},
+			expandTags: []string{"1.2.3-rc1+bld"},
 		},
 		{
-			name:     "invalid_build",
+			name:       "invalid_build",
-			tag:      "v1+bld", // can only include build detail with all three elements
+			tag:        "v1+bld", // can only include build detail with all three elements
-			autoTags: []string{"v1+bld"},
+			expandTags: []string{"v1+bld"},
 		},
 		{
-			name:     "accidental_non_semver",
+			name:       "accidental_non_semver",
-			tag:      "1.2.3",
+			tag:        "1.2.3",
-			autoTags: []string{"1", "1.2", "1.2.3"},
+			expandTags: []string{"1", "1.2", "1.2.3"},
 		},
 		{
-			name:     "non_semver",
+			name:       "non_semver",
-			tag:      "latest",
+			tag:        "latest",
-			autoTags: []string{"latest"},
+			expandTags: []string{"latest"},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			tags := Build{AutoTag: true}.labelsForTag(tt.tag)
+			tags := Build{ExpandTag: true}.labelsForTag(tt.tag)
-			if got, want := tags, tt.autoTags; !cmp.Equal(got, want) {
+			if got, want := tags, tt.expandTags; !cmp.Equal(got, want) {
 				t.Errorf("tagsFor(%q) = %q, want %q", tt.tag, got, want)
 			}
 		})
 	}
 }
+
+func TestBuild_AutoTags(t *testing.T) {
+	tests := []struct {
+		name          string
+		repoBranch    string
+		commitRef     string
+		autoTagSuffix string
+		expectedTags  []string
+	}{
+		{
+			name:          "commit push",
+			repoBranch:    "master",
+			commitRef:     "refs/heads/master",
+			autoTagSuffix: "",
+			expectedTags:  []string{"latest"},
+		},
+		{
+			name:          "tag push",
+			repoBranch:    "master",
+			commitRef:     "refs/tags/v1.0.0",
+			autoTagSuffix: "",
+			expectedTags: []string{
+				"1",
+				"1.0",
+				"1.0.0",
+			},
+		},
+		{
+			name:          "tag push",
+			repoBranch:    "master",
+			commitRef:     "refs/tags/v1.0.0",
+			autoTagSuffix: "linux-amd64",
+			expectedTags: []string{
+				"1-linux-amd64",
+				"1.0-linux-amd64",
+				"1.0.0-linux-amd64",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := Build{DroneCommitRef: tt.commitRef, DroneRepoBranch: tt.repoBranch, AutoTag: true}
+			if tt.autoTagSuffix != "" {
+				b.AutoTagSuffix = tt.autoTagSuffix
+			}
+			tags, err := b.AutoTags()
+			if err != nil {
+				t.Errorf("Unexpected err %q", err)
+			}
+			if got, want := tags, tt.expectedTags; !cmp.Equal(got, want) {
+				t.Errorf("auto detected tags = %q, wanted = %q", got, want)
+			}
+		})
+	}
+	t.Run("auto-tag cannot be enabled with user provided tags", func(t *testing.T) {
+		b := Build{
+			DroneCommitRef:  "refs/tags/v1.0.0",
+			DroneRepoBranch: "master",
+			AutoTag:         true,
+			Tags:            []string{"v1"},
+		}
+		_, err := b.AutoTags()
+		if err == nil {
+			t.Errorf("Expect error for invalid flags")
+		}
+	})
+}

pkg/tagger/tagger.go

@@ -0,0 +1,95 @@
+// A fork of https://github.com/drone-plugins/drone-docker/blob/master/tags.go
+
+package tagger
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/coreos/go-semver/semver"
+)
+
+// AutoTagsSuffix returns a set of default suggested tags
+// based on the commit ref with an attached suffix.
+func AutoTagsSuffix(ref, suffix string) ([]string, error) {
+	tags, err := AutoTags(ref)
+	if err != nil {
+		return nil, err
+	}
+	if len(suffix) == 0 {
+		return tags, nil
+	}
+	for i, tag := range tags {
+		if tag == "latest" {
+			tags[i] = suffix
+		} else {
+			tags[i] = fmt.Sprintf("%s-%s", tag, suffix)
+		}
+	}
+	return tags, nil
+}
+
+func splitOff(input string, delim string) string {
+	parts := strings.SplitN(input, delim, 2)
+
+	if len(parts) == 2 {
+		return parts[0]
+	}
+
+	return input
+}
+
+// AutoTags returns a set of default suggested tags based on
+// the commit ref.
+func AutoTags(ref string) ([]string, error) {
+	if !strings.HasPrefix(ref, "refs/tags/") {
+		return []string{"latest"}, nil
+	}
+	v := stripTagPrefix(ref)
+	version, err := semver.NewVersion(v)
+	if err != nil {
+		return []string{"latest"}, err
+	}
+	if version.PreRelease != "" || version.Metadata != "" {
+		return []string{
+			version.String(),
+		}, nil
+	}
+
+	v = stripTagPrefix(ref)
+	v = splitOff(splitOff(v, "+"), "-")
+	dotParts := strings.SplitN(v, ".", 3)
+
+	if version.Major == 0 {
+		return []string{
+			fmt.Sprintf("%0*d.%0*d", len(dotParts[0]), version.Major, len(dotParts[1]), version.Minor),
+			fmt.Sprintf("%0*d.%0*d.%0*d", len(dotParts[0]), version.Major, len(dotParts[1]), version.Minor, len(dotParts[2]), version.Patch),
+		}, nil
+	}
+	return []string{
+		fmt.Sprintf("%0*d", len(dotParts[0]), version.Major),
+		fmt.Sprintf("%0*d.%0*d", len(dotParts[0]), version.Major, len(dotParts[1]), version.Minor),
+		fmt.Sprintf("%0*d.%0*d.%0*d", len(dotParts[0]), version.Major, len(dotParts[1]), version.Minor, len(dotParts[2]), version.Patch),
+	}, nil
+}
+
+// UseAutoTag for keep only default branch for latest tag.
+func UseAutoTag(ref, defaultBranch string) bool {
+	if strings.HasPrefix(ref, "refs/tags/") {
+		return true
+	}
+	if stripHeadPrefix(ref) == defaultBranch {
+		return true
+	}
+	return false
+}
+
+func stripHeadPrefix(ref string) string {
+	return strings.TrimPrefix(ref, "refs/heads/")
+}
+
+func stripTagPrefix(ref string) string {
+	ref = strings.TrimPrefix(ref, "refs/tags/")
+	ref = strings.TrimPrefix(ref, "v")
+	return ref
+}

pkg/tagger/tagger_test.go

@@ -0,0 +1,199 @@
+// A fork of https://github.com/drone-plugins/drone-docker/blob/master/tags_test.go
+
+package tagger
+
+import (
+	"reflect"
+	"testing"
+)
+
+func Test_stripTagPrefix(t *testing.T) {
+	var tests = []struct {
+		Before string
+		After  string
+	}{
+		{"refs/tags/1.0.0", "1.0.0"},
+		{"refs/tags/v1.0.0", "1.0.0"},
+		{"v1.0.0", "1.0.0"},
+	}
+
+	for _, test := range tests {
+		got, want := stripTagPrefix(test.Before), test.After
+		if got != want {
+			t.Errorf("Got tag %s, want %s", got, want)
+		}
+	}
+}
+
+func TestAutoTags(t *testing.T) {
+	var tests = []struct {
+		Before string
+		After  []string
+	}{
+		{"", []string{"latest"}},
+		{"refs/heads/master", []string{"latest"}},
+		{"refs/tags/0.9.0", []string{"0.9", "0.9.0"}},
+		{"refs/tags/1.0.0", []string{"1", "1.0", "1.0.0"}},
+		{"refs/tags/v1.0.0", []string{"1", "1.0", "1.0.0"}},
+		{"refs/tags/v1.0.0-alpha.1", []string{"1.0.0-alpha.1"}},
+	}
+
+	for _, test := range tests {
+		tags, err := AutoTags(test.Before)
+		if err != nil {
+			t.Error(err)
+			continue
+		}
+		got, want := tags, test.After
+		if !reflect.DeepEqual(got, want) {
+			t.Errorf("Got tag %v, want %v", got, want)
+		}
+	}
+}
+
+func TestAutoTagsError(t *testing.T) {
+	var tests = []string{
+		"refs/tags/x1.0.0",
+		"refs/tags/20190203",
+	}
+
+	for _, test := range tests {
+		_, err := AutoTags(test)
+		if err == nil {
+			t.Errorf("Expect tag error for %s", test)
+		}
+	}
+}
+
+func TestAutoTagsSuffix(t *testing.T) {
+	var tests = []struct {
+		Before string
+		Suffix string
+		After  []string
+	}{
+		// without suffix
+		{
+			After: []string{"latest"},
+		},
+		{
+			Before: "refs/tags/v1.0.0",
+			After: []string{
+				"1",
+				"1.0",
+				"1.0.0",
+			},
+		},
+		// with suffix
+		{
+			Suffix: "linux-amd64",
+			After:  []string{"linux-amd64"},
+		},
+		{
+			Before: "refs/tags/v1.0.0",
+			Suffix: "linux-amd64",
+			After: []string{
+				"1-linux-amd64",
+				"1.0-linux-amd64",
+				"1.0.0-linux-amd64",
+			},
+		},
+		{
+			Suffix: "nanoserver",
+			After:  []string{"nanoserver"},
+		},
+		{
+			Before: "refs/tags/v1.9.2",
+			Suffix: "nanoserver",
+			After: []string{
+				"1-nanoserver",
+				"1.9-nanoserver",
+				"1.9.2-nanoserver",
+			},
+		},
+		{
+			Before: "refs/tags/v18.06.0",
+			Suffix: "nanoserver",
+			After: []string{
+				"18-nanoserver",
+				"18.06-nanoserver",
+				"18.06.0-nanoserver",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		tag, err := AutoTagsSuffix(test.Before, test.Suffix)
+		if err != nil {
+			t.Error(err)
+			continue
+		}
+		got, want := tag, test.After
+		if !reflect.DeepEqual(got, want) {
+			t.Errorf("Got tag %v, want %v", got, want)
+		}
+	}
+}
+
+func Test_stripHeadPrefix(t *testing.T) {
+	type args struct {
+		ref string
+	}
+	tests := []struct {
+		args args
+		want string
+	}{
+		{
+			args: args{
+				ref: "refs/heads/master",
+			},
+			want: "master",
+		},
+	}
+	for _, tt := range tests {
+		if got := stripHeadPrefix(tt.args.ref); got != tt.want {
+			t.Errorf("stripHeadPrefix() = %v, want %v", got, tt.want)
+		}
+	}
+}
+
+func TestUseAutoTag(t *testing.T) {
+	type args struct {
+		ref           string
+		defaultBranch string
+	}
+	tests := []struct {
+		name string
+		args args
+		want bool
+	}{
+		{
+			name: "latest tag for default branch",
+			args: args{
+				ref:           "refs/heads/master",
+				defaultBranch: "master",
+			},
+			want: true,
+		},
+		{
+			name: "build from tags",
+			args: args{
+				ref:           "refs/tags/v1.0.0",
+				defaultBranch: "master",
+			},
+			want: true,
+		},
+		{
+			name: "skip build for not default branch",
+			args: args{
+				ref:           "refs/heads/develop",
+				defaultBranch: "master",
+			},
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		if got := UseAutoTag(tt.args.ref, tt.args.defaultBranch); got != tt.want {
+			t.Errorf("%q. UseAutoTag() = %v, want %v", tt.name, got, tt.want)
+		}
+	}
+}