From 7f3adc5725c075d23fccc2dd2f38347ea3cff07a Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 15 Aug 2026 16:26:38 +1000
Subject: [PATCH] woodpecker: quote buildah commands (YAML colon-space parse
 fix)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

woodpecker interpolates ${CI_COMMIT_TAG} into the raw pipeline text before YAML
parsing; when empty, '-t $${IMG}:${CI_COMMIT_TAG} .' collapses to '... : .'
and the colon-space is parsed as a map key ('cannot unmarshal map ... into a
string value'). Quote every buildah command so it stays a scalar.
---
 .woodpecker/build.yaml   |  2 +-
 .woodpecker/release.yaml | 12 ++++++++----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
index 2ffb30e..c92a45c 100644
--- a/.woodpecker/build.yaml
+++ b/.woodpecker/build.yaml
@@ -7,7 +7,7 @@ steps:
   - name: build
     image: quay.io/buildah/stable
     commands:
-      - buildah build --isolation chroot --storage-driver vfs -t plugin-docker-buildx:${CI_COMMIT_SHA} .
+      - "buildah build --isolation chroot --storage-driver vfs -t plugin-docker-buildx:${CI_COMMIT_SHA} ."
     backend_options:
       kubernetes:
         serviceAccountName: plugin-docker-buildx
diff --git a/.woodpecker/release.yaml b/.woodpecker/release.yaml
index 0c60e71..88f54b1 100644
--- a/.woodpecker/release.yaml
+++ b/.woodpecker/release.yaml
@@ -11,15 +11,19 @@ steps:
   # jellyfin-ha). --tls-verify=false is a deliberate bootstrap: THIS image is what
   # teaches k8s buildx to trust artifactapi's internal CA, so its own push cannot
   # yet rely on that trust.
+  #
+  # Commands are quoted: woodpecker templates ${CI_COMMIT_TAG} into the raw YAML
+  # before parsing, so an unquoted "-t $${IMG}:${CI_COMMIT_TAG} ." can collapse to
+  # "... -t $${IMG}: ." and YAML then reads the "colon-space" as a map key.
   - name: release
     image: quay.io/buildah/stable
     environment:
       IMG: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx
     commands:
-      - buildah build --isolation chroot --storage-driver vfs -t $${IMG}:${CI_COMMIT_TAG} .
-      - buildah tag --storage-driver vfs $${IMG}:${CI_COMMIT_TAG} $${IMG}:latest
-      - buildah push --storage-driver vfs --tls-verify=false $${IMG}:${CI_COMMIT_TAG}
-      - buildah push --storage-driver vfs --tls-verify=false $${IMG}:latest
+      - "buildah build --isolation chroot --storage-driver vfs -t $${IMG}:${CI_COMMIT_TAG} ."
+      - "buildah tag --storage-driver vfs $${IMG}:${CI_COMMIT_TAG} $${IMG}:latest"
+      - "buildah push --storage-driver vfs --tls-verify=false $${IMG}:${CI_COMMIT_TAG}"
+      - "buildah push --storage-driver vfs --tls-verify=false $${IMG}:latest"
     backend_options:
       kubernetes:
         serviceAccountName: plugin-docker-buildx