Merge pull request 'ci: add buildkit_config CA trust for artifactapi push' (#3) from benvin/buildx-ca-config into main

Reviewed-on: #3

.woodpecker/build.yaml

@@ -3,7 +3,7 @@ when:
 
 steps:
   - name: docker-build
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
     settings:
       repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/autobackup-operator
       dockerfile: Dockerfile.operator

.woodpecker/docker.yaml

@@ -6,11 +6,16 @@ steps:
   # No push credentials: the in-cluster runner has push access to the artifactapi
   # docker-internal registry (same credential-less pattern as jellyfin-ha).
   - name: docker
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
     settings:
       registry: artifactapi.k8s.syd1.au.unkin.net
       repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/autobackup-operator
       dockerfile: Dockerfile.operator
+      # buildkitd runs in its own container and performs the push; point it at the
+      # artifactapi CA baked into the plugin image so it trusts the registry.
+      buildkit_config: |
+        [registry."artifactapi.k8s.syd1.au.unkin.net"]
+          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
       tags:
         - ${CI_COMMIT_TAG}
         - latest