Point the release docker step at the custom
artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx
image, which bakes artifactapi's internal Vault CA into
/etc/docker/certs.d/<registry>/ca.crt.
- Swap the docker step image from upstream woodpeckerci/plugin-docker-buildx
to the CA-baked custom image.
- Drop the separate ca-trust step (and its almalinux9-base dependency) that
staged the CA into the workspace.
- Repoint buildkit_config ca= at the in-image baked CA path so the buildx
docker-container builder still hands the CA to buildkitd for the push.
unkin-agent