Build through artifactapi and get the internal CA into buildkit

The buildkit_config setting does not exist in the plugin-docker-buildx build
we run: the binary has no PLUGIN_BUILDKIT_CONFIG, so the block was dead YAML
and `docker buildx create` ran without --config. The plugin only writes a
buildkit.toml (pointing at /etc/docker/certs.d/<registry>/ca.crt) when
`registry` is set, which is why the tag build pushed fine and the PR build
had no CA. Set registry on every step and drop the dead block.

The matrix also overrode BASE_IMAGE with the Docker Hub path, so CI never
used the artifactapi remote that distro.env selects. Point it at artifactapi
and have ci/check-distros.sh fail when a matrix value restating a distro.env
key drifts from it.

.woodpecker/build.yaml

@@ -4,23 +4,25 @@ when:
 matrix:
   include:
     # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
+    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
     - DISTRO: alma9
       IMAGE: almalinux9
-      BASE_IMAGE: "docker.io/almalinux:9"
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
 
 steps:
   - name: build
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
     settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
+      registry: artifactapi.k8s.syd1.au.unkin.net
       repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
       target: image
       dry_run: true
       build_args:
         BASE_IMAGE: "${BASE_IMAGE}"
         DISTRO: "${DISTRO}"
-      buildkit_config: |
-        [registry."artifactapi.k8s.syd1.au.unkin.net"]
-          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
     backend_options:
       kubernetes:
         serviceAccountName: default

.woodpecker/docker.yaml

@@ -5,23 +5,24 @@ when:
 matrix:
   include:
     # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
+    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
     - DISTRO: alma9
       IMAGE: almalinux9
-      BASE_IMAGE: "docker.io/almalinux:9"
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
 
 steps:
   - name: docker
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
     settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
       registry: artifactapi.k8s.syd1.au.unkin.net
       repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
       target: image
       build_args:
         BASE_IMAGE: "${BASE_IMAGE}"
         DISTRO: "${DISTRO}"
-      buildkit_config: |
-        [registry."artifactapi.k8s.syd1.au.unkin.net"]
-          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
       tags:
         - "${CI_COMMIT_TAG##v}"
         - latest

ci/check-distros.sh

@@ -14,6 +14,25 @@ for d in distros/*/; do
   done
   for wf in "${WORKFLOWS[@]}"; do
     grep -q "DISTRO: ${n}\$" "$wf" || { echo "${wf}: distro ${n} missing from matrix"; fail=1; }
+
+    # A matrix entry that restates a distro.env key must not drift from it — a stale
+    # BASE_IMAGE here silently overrides distro.env for every CI build.
+    while IFS='=' read -r k v; do
+      [ -n "$k" ] || continue
+      grep -q "^${k}=" "${d}distro.env" || continue
+      ev=$(sed -n "s/^${k}=//p" "${d}distro.env" | head -1 | sed 's/^"//;s/"$//')
+      [ "$v" = "$ev" ] || { echo "${wf}: matrix ${k}=\"${v}\" for ${n} disagrees with ${d}distro.env (\"${ev}\")"; fail=1; }
+    done <<EOF
+$(awk -v d="$n" '
+  $0 ~ "^[[:space:]]*-[[:space:]]+DISTRO:[[:space:]]*"d"[[:space:]]*$" { inb=1; next }
+  inb && /^[[:space:]]*-/ { inb=0 }
+  inb && match($0, /^[[:space:]]+[A-Z_]+:/) {
+    k=$1; sub(/:$/,"",k)
+    v=$0; sub(/^[[:space:]]*[A-Z_]+:[[:space:]]*/,"",v); gsub(/^"|"$/,"",v)
+    print k "=" v
+  }
+' "$wf")
+EOF
   done
 done