Merge pull request 'ci: add buildkit_config CA trust for artifactapi push' (#3 ) from benvin/buildx-ca-config into main

Reviewed-on: #3
ci: add buildkit_config CA trust for artifactapi push
2026-08-15 18:47:01 +10:00 · 2026-08-15 18:30:20 +10:00 · 2026-08-15 18:20:51 +10:00 · 2026-08-15 18:03:47 +10:00
2 changed files with 7 additions and 2 deletions
@@ -3,7 +3,7 @@ when:

 steps:
  - name: docker-build
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
    settings:
      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/autobackup-operator
      dockerfile: Dockerfile.operator
@@ -6,11 +6,16 @@ steps:
  # No push credentials: the in-cluster runner has push access to the artifactapi
  # docker-internal registry (same credential-less pattern as jellyfin-ha).
  - name: docker
-    image: woodpeckerci/plugin-docker-buildx
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
    settings:
      registry: artifactapi.k8s.syd1.au.unkin.net
      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/autobackup-operator
      dockerfile: Dockerfile.operator
+      # buildkitd runs in its own container and performs the push; point it at the
+      # artifactapi CA baked into the plugin image so it trusts the registry.
+      buildkit_config: |
+        [registry."artifactapi.k8s.syd1.au.unkin.net"]
+          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
      tags:
        - ${CI_COMMIT_TAG}
        - latest
Author	SHA1	Message	Date
benvin	44a927e81c	Merge pull request 'ci: add buildkit_config CA trust for artifactapi push' (#3 ) from benvin/buildx-ca-config into main ci/woodpecker/push/test Pipeline was successful Details Reviewed-on: #3	2026-08-15 18:47:01 +10:00
unkin-agent	762cfca7a4	ci: add buildkit_config CA trust for artifactapi push ci/woodpecker/pr/build Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/test Pipeline was successful Details ci/woodpecker/push/test Pipeline was successful Details	2026-08-15 18:30:20 +10:00
benvin	7c27bd914b	Merge pull request 'ci: use CA-baked plugin-docker-buildx image for artifactapi push' (#2 ) from benvin/buildx-ca-plugin-image into main ci/woodpecker/push/test Pipeline was successful Details Reviewed-on: #2	2026-08-15 18:20:51 +10:00
unkin-agent	9e65bf7c9a	ci: use CA-baked plugin-docker-buildx image for artifactapi push ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details ci/woodpecker/push/test Pipeline was successful Details ci/woodpecker/pr/test Pipeline was successful Details Buildkit in the upstream woodpeckerci/plugin-docker-buildx image does not trust the artifactapi internal Vault CA, so pushes to docker-internal fail on TLS. - Switch the docker.yaml push step to the CA-baked custom plugin image - Switch the build.yaml PR dry-run step to the same custom image	2026-08-15 18:03:47 +10:00