From 95f449a87576699980bb8c913275693977f751de Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 3 Oct 2026 15:34:47 +1000
Subject: [PATCH] Gate the build context on every matrix entry via an
 aggregator workflow

---
 .woodpecker/build-matrix.yaml | 44 +++++++++++++++++++++++++++++++++++
 .woodpecker/build.yaml        | 40 +++++++------------------------
 README.md                     |  2 +-
 ci/check-distros.sh           |  2 +-
 4 files changed, 55 insertions(+), 33 deletions(-)
 create mode 100644 .woodpecker/build-matrix.yaml

diff --git a/.woodpecker/build-matrix.yaml b/.woodpecker/build-matrix.yaml
new file mode 100644
index 0000000..69fbc9e
--- /dev/null
+++ b/.woodpecker/build-matrix.yaml
@@ -0,0 +1,44 @@
+when:
+  - event: pull_request
+
+matrix:
+  include:
+    # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
+    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
+    - DISTRO: alma9
+      IMAGE: almalinux9
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
+    - DISTRO: fedora42
+      IMAGE: fedora42
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
+    - DISTRO: fedora43
+      IMAGE: fedora43
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
+    - DISTRO: fedora44
+      IMAGE: fedora44
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"
+
+steps:
+  - name: build
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
+    settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
+      target: image
+      dry_run: true
+      build_args:
+        BASE_IMAGE: "${BASE_IMAGE}"
+        DISTRO: "${DISTRO}"
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2
diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
index 69fbc9e..f027c7b 100644
--- a/.woodpecker/build.yaml
+++ b/.woodpecker/build.yaml
@@ -1,44 +1,22 @@
+# Branch protection requires ci/woodpecker/pr/build; matrix entries report build-matrix/<n>.
 when:
   - event: pull_request
 
-matrix:
-  include:
-    # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
-    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
-    - DISTRO: alma9
-      IMAGE: almalinux9
-      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
-    - DISTRO: fedora42
-      IMAGE: fedora42
-      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
-    - DISTRO: fedora43
-      IMAGE: fedora43
-      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
-    - DISTRO: fedora44
-      IMAGE: fedora44
-      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"
+depends_on:
+  - build-matrix
 
 steps:
   - name: build
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
-    settings:
-      # registry is what gets the internal CA into the buildkit container: the plugin
-      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
-      # when it is set. The plugin has no buildkit_config setting.
-      registry: artifactapi.k8s.syd1.au.unkin.net
-      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
-      target: image
-      dry_run: true
-      build_args:
-        BASE_IMAGE: "${BASE_IMAGE}"
-        DISTRO: "${DISTRO}"
+    commands:
+      - echo "all build-matrix entries passed"
     backend_options:
       kubernetes:
         serviceAccountName: default
         resources:
           requests:
-            memory: 1Gi
-            cpu: 1
+            memory: 64Mi
+            cpu: 100m
           limits:
-            memory: 4Gi
-            cpu: 2
+            memory: 128Mi
+            cpu: 250m
diff --git a/README.md b/README.md
index 87408d8..a7fc05e 100644
--- a/README.md
+++ b/README.md
@@ -18,7 +18,7 @@ configuration pointed at artifactapi, and installs the base package set.
 
 1. `distros/<name>/distro.env` — `BASE_IMAGE`, `IMAGE`, `CA_RPM_URL`, `CA_RPM_SHA256`, `PACKAGES`.
 2. `distros/<name>/yum.repos.d/*.repo` — repository configuration for that distro.
-3. One `include` entry in each of `.woodpecker/{build,docker}.yaml`.
+3. One `include` entry in each of `.woodpecker/{build-matrix,docker}.yaml`.
 
 The `check-distros` pre-commit hook fails if step 1 or 3 is incomplete.
 
diff --git a/ci/check-distros.sh b/ci/check-distros.sh
index 838475b..4af7078 100755
--- a/ci/check-distros.sh
+++ b/ci/check-distros.sh
@@ -4,7 +4,7 @@
 set -uo pipefail
 
 KEYS="BASE_IMAGE IMAGE CA_RPM_URL CA_RPM_SHA256 ESTATE_REPO PACKAGES"
-WORKFLOWS=(.woodpecker/build.yaml .woodpecker/docker.yaml)
+WORKFLOWS=(.woodpecker/build-matrix.yaml .woodpecker/docker.yaml)
 
 fail=0
 for d in distros/*/; do