unkin-agent
7f3adc5725
ci/woodpecker/pr/build Pipeline failed
woodpecker interpolates ${CI_COMMIT_TAG} into the raw pipeline text before YAML
parsing; when empty, '-t $${IMG}:${CI_COMMIT_TAG} .' collapses to '... : .'
and the colon-space is parsed as a map key ('cannot unmarshal map ... into a
string value'). Quote every buildah command so it stays a scalar.
37 lines
1.5 KiB
YAML
37 lines
1.5 KiB
YAML
when:
|
|
- event: tag
|
|
ref: refs/tags/v*
|
|
|
|
steps:
|
|
# Build the CA-baked plugin image and push it to artifactapi's docker-internal
|
|
# registry. buildah runs unprivileged in-cluster (vfs + chroot isolation).
|
|
#
|
|
# Push is credential-less: the in-cluster runner already has push access to the
|
|
# artifactapi docker-internal registry (same pattern as autobackup-operator /
|
|
# jellyfin-ha). --tls-verify=false is a deliberate bootstrap: THIS image is what
|
|
# teaches k8s buildx to trust artifactapi's internal CA, so its own push cannot
|
|
# yet rely on that trust.
|
|
#
|
|
# Commands are quoted: woodpecker templates ${CI_COMMIT_TAG} into the raw YAML
|
|
# before parsing, so an unquoted "-t $${IMG}:${CI_COMMIT_TAG} ." can collapse to
|
|
# "... -t $${IMG}: ." and YAML then reads the "colon-space" as a map key.
|
|
- name: release
|
|
image: quay.io/buildah/stable
|
|
environment:
|
|
IMG: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx
|
|
commands:
|
|
- "buildah build --isolation chroot --storage-driver vfs -t $${IMG}:${CI_COMMIT_TAG} ."
|
|
- "buildah tag --storage-driver vfs $${IMG}:${CI_COMMIT_TAG} $${IMG}:latest"
|
|
- "buildah push --storage-driver vfs --tls-verify=false $${IMG}:${CI_COMMIT_TAG}"
|
|
- "buildah push --storage-driver vfs --tls-verify=false $${IMG}:latest"
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: plugin-docker-buildx
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 1
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 2
|