buildah (quay.io/buildah/stable) enforces short-name resolution and cannot
prompt without a TTY, so 'FROM woodpeckerci/plugin-docker-buildx:latest' errors.
Qualify as docker.io/... . Keep it on docker.io (public CA) deliberately: this
image is what bootstraps internal-CA trust, so pulling its own base through the
internal-CA artifactapi registry would reintroduce the x509 problem in-build.
woodpecker interpolates ${CI_COMMIT_TAG} into the raw pipeline text before YAML
parsing; when empty, '-t $${IMG}:${CI_COMMIT_TAG} .' collapses to '... : .'
and the colon-space is parsed as a map key ('cannot unmarshal map ... into a
string value'). Quote every buildah command so it stays a scalar.
Bake the internal Vault-PKI CA into a rebuild of
woodpeckerci/plugin-docker-buildx so k8s buildx jobs can push to
artifactapi's docker-internal registry over TLS.
- Dockerfile: copy unkin-ca.crt into /etc/docker/certs.d/<registry>/ca.crt
and the system trust store
- unkin-ca.crt: vault-ca-cert bundle (root + intermediate)
- .woodpecker/build.yaml: PR gate, buildah build-only
- .woodpecker/release.yaml: on v* tag, buildah build + credless push to
docker-internal with --tls-verify=false (bootstrap)
unkin-agent