Gate the build context on every matrix entry via an aggregator workflow

.woodpecker/build-matrix.yaml

@@ -0,0 +1,44 @@
+when:
+  - event: pull_request
+
+matrix:
+  include:
+    # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
+    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
+    - DISTRO: alma9
+      IMAGE: almalinux9
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
+    - DISTRO: fedora42
+      IMAGE: fedora42
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
+    - DISTRO: fedora43
+      IMAGE: fedora43
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
+    - DISTRO: fedora44
+      IMAGE: fedora44
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"
+
+steps:
+  - name: build
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
+    settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
+      target: image
+      dry_run: true
+      build_args:
+        BASE_IMAGE: "${BASE_IMAGE}"
+        DISTRO: "${DISTRO}"
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2

.woodpecker/build.yaml

@@ -1,44 +1,22 @@
+# Branch protection requires ci/woodpecker/pr/build; matrix entries report build-matrix/<n>.
 when:
   - event: pull_request
 
-matrix:
-  include:
-    # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
-    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
-    - DISTRO: alma9
-      IMAGE: almalinux9
-      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
-    - DISTRO: fedora42
-      IMAGE: fedora42
-      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
-    - DISTRO: fedora43
-      IMAGE: fedora43
-      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
-    - DISTRO: fedora44
-      IMAGE: fedora44
-      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"
+depends_on:
+  - build-matrix
 
 steps:
   - name: build
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
-    settings:
-      # registry is what gets the internal CA into the buildkit container: the plugin
-      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
-      # when it is set. The plugin has no buildkit_config setting.
-      registry: artifactapi.k8s.syd1.au.unkin.net
-      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
-      target: image
-      dry_run: true
-      build_args:
-        BASE_IMAGE: "${BASE_IMAGE}"
-        DISTRO: "${DISTRO}"
+    commands:
+      - echo "all build-matrix entries passed"
     backend_options:
       kubernetes:
         serviceAccountName: default
         resources:
           requests:
-            memory: 1Gi
-            cpu: 1
+            memory: 64Mi
+            cpu: 100m
           limits:
-            memory: 4Gi
-            cpu: 2
+            memory: 128Mi
+            cpu: 250m

README.md

@@ -18,7 +18,7 @@ configuration pointed at artifactapi, and installs the base package set.
 
 1. `distros/<name>/distro.env` — `BASE_IMAGE`, `IMAGE`, `CA_RPM_URL`, `CA_RPM_SHA256`, `PACKAGES`.
 2. `distros/<name>/yum.repos.d/*.repo` — repository configuration for that distro.
-3. One `include` entry in each of `.woodpecker/{build,docker}.yaml`.
+3. One `include` entry in each of `.woodpecker/{build-matrix,docker}.yaml`.
 
 The `check-distros` pre-commit hook fails if step 1 or 3 is incomplete.
 

ci/check-distros.sh

@@ -4,7 +4,7 @@
 set -uo pipefail
 
 KEYS="BASE_IMAGE IMAGE CA_RPM_URL CA_RPM_SHA256 ESTATE_REPO PACKAGES"
-WORKFLOWS=(.woodpecker/build.yaml .woodpecker/docker.yaml)
+WORKFLOWS=(.woodpecker/build-matrix.yaml .woodpecker/docker.yaml)
 
 fail=0
 for d in distros/*/; do