From 3c7251cc1e029c91cbdad92aedfba637c764a0ce Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 15 Aug 2026 18:04:23 +1000 Subject: [PATCH] ci: use CA-baked plugin-docker-buildx image for artifactapi push The upstream woodpeckerci/plugin-docker-buildx image does not trust the internal CA, so buildx pushes to the artifactapi local docker registry fail on TLS verification. Switch the docker push step to the CA-baked plugin-docker-buildx image published to docker-internal, which bundles the internal CA and pushes cleanly. --- .woodpecker/docker.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml index 13fc4a2..a01d4f2 100644 --- a/.woodpecker/docker.yaml +++ b/.woodpecker/docker.yaml @@ -1,6 +1,6 @@ # Build and push the pdbmux container image on a v* tag. pdbmux is a k8s-only # daemon (deployed via argocd-apps), so it ships as an image. Mirrors the estate -# convention: the woodpeckerci/plugin-docker-buildx plugin pushes to the +# convention: the CA-baked plugin-docker-buildx image pushes to the # artifactapi local docker registry (unauthenticated in-cluster push). when: - event: tag @@ -8,7 +8,7 @@ when: steps: - name: docker - image: woodpeckerci/plugin-docker-buildx + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest settings: registry: artifactapi.k8s.syd1.au.unkin.net repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux