when:
  - event: tag
    ref: refs/tags/v*

steps:
  # Build the CA-baked plugin image and push it to artifactapi's docker-internal
  # registry. buildah runs unprivileged in-cluster (vfs + chroot isolation).
  #
  # Push is credential-less: the in-cluster runner already has push access to the
  # artifactapi docker-internal registry (same pattern as autobackup-operator /
  # jellyfin-ha). --tls-verify=false is a deliberate bootstrap: THIS image is what
  # teaches k8s buildx to trust artifactapi's internal CA, so its own push cannot
  # yet rely on that trust.
  #
  # Commands are quoted: woodpecker templates ${CI_COMMIT_TAG} into the raw YAML
  # before parsing, so an unquoted "-t $${IMG}:${CI_COMMIT_TAG} ." can collapse to
  # "... -t $${IMG}: ." and YAML then reads the "colon-space" as a map key.
  - name: release
    image: quay.io/buildah/stable
    environment:
      IMG: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx
    commands:
      - "buildah build --isolation chroot --storage-driver vfs -t $${IMG}:${CI_COMMIT_TAG} ."
      - "buildah tag --storage-driver vfs $${IMG}:${CI_COMMIT_TAG} $${IMG}:latest"
      - "buildah push --storage-driver vfs --tls-verify=false $${IMG}:${CI_COMMIT_TAG}"
      - "buildah push --storage-driver vfs --tls-verify=false $${IMG}:latest"
    backend_options:
      kubernetes:
        serviceAccountName: plugin-docker-buildx
        resources:
          requests:
            memory: 512Mi
            cpu: 1
          limits:
            memory: 2Gi
            cpu: 2