ci: re-trigger after artifactapi epel repodata caching fix (tf-artifactapi #8)

The rpm-vendor skip-check probes artifactapi, which serves an internally-signed
cert. Python requests uses certifi (Mozilla CAs) and so fails with
CERTIFICATE_VERIFY_FAILED, defeating the skip (builds still proceed via the
except path, but never skip). Point the artifactapi session at the OS CA bundle,
which trusts the internal CA, with an ARTIFACTAPI_CA_BUNDLE override.

.woodpecker/build-almalinux8.yaml

@@ -1,13 +1,88 @@
+# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: pull_request
 
+matrix:
+  PACKAGE:
+    - act_runner
+    - bind_exporter
+    - boilerplate
+    - claude-code
+    - cni-plugins
+    - code-server
+    - consul
+    - consul-cni
+    - etcd
+    - exportarr
+    - frr_exporter
+    - g10k
+    - git-delta
+    - hadolint
+    - helm
+    - helmfile
+    - jellyfin-ffmpeg-bin
+    - jellyfin-server
+    - jellyfin-web
+    - jsonnet
+    - jsonnet-language-server
+    - jsonnet-lint
+    - kubecolor
+    - kubeconform
+    - kubectx
+    - kustomize
+    - lazydocker
+    - libfoundationdb
+    - neovim
+    - neovim-glibc-2.17
+    - nfpm
+    - node_exporter
+    - nomad
+    - nomad-autoscaler
+    - nzbget
+    - nzbget_exporter
+    - openbao-plugin-secret-consul
+    - openbao-plugin-secret-nomad
+    - openbao-plugins
+    - packer
+    - pgbouncer_exporter
+    - postgres_exporter
+    - puppet-initial
+    - puppetdb_exporter
+    - ruff
+    - sops
+    - stalwart
+    - stalwart-cli
+    - stalwart-foundationdb
+    - starship
+    - stern
+    - tea
+    - terraform
+    - terragrunt
+    - tflint
+    - unkin-ca-certificates
+    - unkin-undionly-kpxe
+    - unrar
+    - uv
+    - vals
+    - vault
+    - victoria-logs
+    - vlutils
+    - vmagent
+    - vmalert
+    - vminsert
+    - vmselect
+    - vmstorage
+    - vmutils
+    - xh
+    - yq
+
 steps:
-  - name: build rpms
+  - name: build
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build-all --distro almalinux/el8 --buildah
+      - ./tools/build build --distro almalinux/el8 --buildah "$PACKAGE"
     privileged: true
     backend_options:
       kubernetes:
@@ -19,8 +94,3 @@ steps:
           limits:
             memory: 2Gi
             cpu: 2
-
-  - name: show rpms
-    image: git.unkin.net/unkin/almalinux8-base:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/build-almalinux9.yaml

@@ -1,13 +1,89 @@
+# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: pull_request
 
+matrix:
+  PACKAGE:
+    - act_runner
+    - bind_exporter
+    - boilerplate
+    - claude-code
+    - cni-plugins
+    - code-server
+    - consul
+    - consul-cni
+    - etcd
+    - exportarr
+    - frr_exporter
+    - g10k
+    - git-delta
+    - hadolint
+    - helm
+    - helmfile
+    - incus
+    - jellyfin-ffmpeg-bin
+    - jellyfin-server
+    - jellyfin-web
+    - jsonnet
+    - jsonnet-language-server
+    - jsonnet-lint
+    - kubecolor
+    - kubeconform
+    - kubectx
+    - kustomize
+    - lazydocker
+    - libfoundationdb
+    - neovim
+    - neovim-glibc-2.17
+    - nfpm
+    - node_exporter
+    - nomad
+    - nomad-autoscaler
+    - nzbget
+    - nzbget_exporter
+    - openbao-plugin-secret-consul
+    - openbao-plugin-secret-nomad
+    - openbao-plugins
+    - packer
+    - pgbouncer_exporter
+    - postgres_exporter
+    - puppet-initial
+    - puppetdb_exporter
+    - ruff
+    - sops
+    - stalwart
+    - stalwart-cli
+    - stalwart-foundationdb
+    - starship
+    - stern
+    - tea
+    - terraform
+    - terragrunt
+    - tflint
+    - unkin-ca-certificates
+    - unkin-undionly-kpxe
+    - unrar
+    - uv
+    - vals
+    - vault
+    - victoria-logs
+    - vlutils
+    - vmagent
+    - vmalert
+    - vminsert
+    - vmselect
+    - vmstorage
+    - vmutils
+    - xh
+    - yq
+
 steps:
-  - name: build rpms
+  - name: build
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build-all --distro almalinux/el9 --buildah
+      - ./tools/build build --distro almalinux/el9 --buildah "$PACKAGE"
     privileged: true
     backend_options:
       kubernetes:
@@ -19,8 +95,3 @@ steps:
           limits:
             memory: 2Gi
             cpu: 2
-
-  - name: show rpms
-    image: git.unkin.net/unkin/almalinux9-base:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/build-fedora42.yaml

@@ -1,13 +1,25 @@
+# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: pull_request
 
+matrix:
+  PACKAGE:
+    - consul
+    - nfpm
+    - tea
+    - unkin-ca-certificates
+    - uv
+    - vault
+    - xh
+    - yq
+
 steps:
-  - name: build rpms
+  - name: build
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build-all --distro fedora/42 --buildah
+      - ./tools/build build --distro fedora/42 --buildah "$PACKAGE"
     privileged: true
     backend_options:
       kubernetes:
@@ -19,8 +31,3 @@ steps:
           limits:
             memory: 2Gi
             cpu: 2
-
-  - name: show rpms
-    image: git.unkin.net/unkin/fedora42-base:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/build-fedora43.yaml

@@ -1,13 +1,25 @@
+# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: pull_request
 
+matrix:
+  PACKAGE:
+    - consul
+    - nfpm
+    - tea
+    - unkin-ca-certificates
+    - uv
+    - vault
+    - xh
+    - yq
+
 steps:
-  - name: build rpms
+  - name: build
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build-all --distro fedora/43 --buildah
+      - ./tools/build build --distro fedora/43 --buildah "$PACKAGE"
     privileged: true
     backend_options:
       kubernetes:
@@ -19,8 +31,3 @@ steps:
           limits:
             memory: 2Gi
             cpu: 2
-
-  - name: show rpms
-    image: git.unkin.net/unkin/fedora43-base:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/build-fedora44.yaml

@@ -1,13 +1,25 @@
+# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: pull_request
 
+matrix:
+  PACKAGE:
+    - consul
+    - nfpm
+    - tea
+    - unkin-ca-certificates
+    - uv
+    - vault
+    - xh
+    - yq
+
 steps:
-  - name: build rpms
+  - name: build
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build-all --distro fedora/44 --buildah
+      - ./tools/build build --distro fedora/44 --buildah "$PACKAGE"
     privileged: true
     backend_options:
       kubernetes:
@@ -19,8 +31,3 @@ steps:
           limits:
             memory: 2Gi
             cpu: 2
-
-  - name: show rpms
-    image: git.unkin.net/unkin/fedora44-base:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/deploy-almalinux8.yaml

@@ -1,14 +1,89 @@
+# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: push
     branch: master
 
+matrix:
+  PACKAGE:
+    - act_runner
+    - bind_exporter
+    - boilerplate
+    - claude-code
+    - cni-plugins
+    - code-server
+    - consul
+    - consul-cni
+    - etcd
+    - exportarr
+    - frr_exporter
+    - g10k
+    - git-delta
+    - hadolint
+    - helm
+    - helmfile
+    - jellyfin-ffmpeg-bin
+    - jellyfin-server
+    - jellyfin-web
+    - jsonnet
+    - jsonnet-language-server
+    - jsonnet-lint
+    - kubecolor
+    - kubeconform
+    - kubectx
+    - kustomize
+    - lazydocker
+    - libfoundationdb
+    - neovim
+    - neovim-glibc-2.17
+    - nfpm
+    - node_exporter
+    - nomad
+    - nomad-autoscaler
+    - nzbget
+    - nzbget_exporter
+    - openbao-plugin-secret-consul
+    - openbao-plugin-secret-nomad
+    - openbao-plugins
+    - packer
+    - pgbouncer_exporter
+    - postgres_exporter
+    - puppet-initial
+    - puppetdb_exporter
+    - ruff
+    - sops
+    - stalwart
+    - stalwart-cli
+    - stalwart-foundationdb
+    - starship
+    - stern
+    - tea
+    - terraform
+    - terragrunt
+    - tflint
+    - unkin-ca-certificates
+    - unkin-undionly-kpxe
+    - unrar
+    - uv
+    - vals
+    - vault
+    - victoria-logs
+    - vlutils
+    - vmagent
+    - vmalert
+    - vminsert
+    - vmselect
+    - vmstorage
+    - vmutils
+    - xh
+    - yq
+
 steps:
-  - name: build-rpms
+  - name: build
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build-all --distro almalinux/el8 --buildah
+      - ./tools/build build --distro almalinux/el8 --buildah "$PACKAGE"
     privileged: true
     backend_options:
       kubernetes:
@@ -21,28 +96,27 @@ steps:
             memory: 2Gi
             cpu: 2
 
-  - name: show-rpms
+  - name: upload
     image: git.unkin.net/unkin/almalinux9-base:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
-    depends_on: [build-rpms]
-
-  - name: deploy-rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-el8"
-        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+        for rpm in $(find dist -type f -name '*.rpm'); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
           code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
           if [ "$$code" = "200" ]; then
-            echo "$$FILE already exists in $$REPO; skipping"
+            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
             continue
           fi
-          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
+          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
+          curl -f -X PUT \
+            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
+            -H "Content-Type: application/x-rpm" \
+            --data-binary @"$$rpm"
         done
+    depends_on: [build]
     backend_options:
       kubernetes:
         serviceAccountName: default
@@ -53,4 +127,3 @@ steps:
           limits:
             memory: 512Mi
             cpu: 500m
-    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-almalinux9.yaml

@@ -1,14 +1,90 @@
+# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: push
     branch: master
 
+matrix:
+  PACKAGE:
+    - act_runner
+    - bind_exporter
+    - boilerplate
+    - claude-code
+    - cni-plugins
+    - code-server
+    - consul
+    - consul-cni
+    - etcd
+    - exportarr
+    - frr_exporter
+    - g10k
+    - git-delta
+    - hadolint
+    - helm
+    - helmfile
+    - incus
+    - jellyfin-ffmpeg-bin
+    - jellyfin-server
+    - jellyfin-web
+    - jsonnet
+    - jsonnet-language-server
+    - jsonnet-lint
+    - kubecolor
+    - kubeconform
+    - kubectx
+    - kustomize
+    - lazydocker
+    - libfoundationdb
+    - neovim
+    - neovim-glibc-2.17
+    - nfpm
+    - node_exporter
+    - nomad
+    - nomad-autoscaler
+    - nzbget
+    - nzbget_exporter
+    - openbao-plugin-secret-consul
+    - openbao-plugin-secret-nomad
+    - openbao-plugins
+    - packer
+    - pgbouncer_exporter
+    - postgres_exporter
+    - puppet-initial
+    - puppetdb_exporter
+    - ruff
+    - sops
+    - stalwart
+    - stalwart-cli
+    - stalwart-foundationdb
+    - starship
+    - stern
+    - tea
+    - terraform
+    - terragrunt
+    - tflint
+    - unkin-ca-certificates
+    - unkin-undionly-kpxe
+    - unrar
+    - uv
+    - vals
+    - vault
+    - victoria-logs
+    - vlutils
+    - vmagent
+    - vmalert
+    - vminsert
+    - vmselect
+    - vmstorage
+    - vmutils
+    - xh
+    - yq
+
 steps:
-  - name: build-rpms
+  - name: build
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build-all --distro almalinux/el9 --buildah
+      - ./tools/build build --distro almalinux/el9 --buildah "$PACKAGE"
     privileged: true
     backend_options:
       kubernetes:
@@ -21,28 +97,27 @@ steps:
             memory: 2Gi
             cpu: 2
 
-  - name: show-rpms
+  - name: upload
     image: git.unkin.net/unkin/almalinux9-base:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
-    depends_on: [build-rpms]
-
-  - name: deploy-rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-el9"
-        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+        for rpm in $(find dist -type f -name '*.rpm'); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
           code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
           if [ "$$code" = "200" ]; then
-            echo "$$FILE already exists in $$REPO; skipping"
+            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
             continue
           fi
-          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
+          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
+          curl -f -X PUT \
+            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
+            -H "Content-Type: application/x-rpm" \
+            --data-binary @"$$rpm"
         done
+    depends_on: [build]
     backend_options:
       kubernetes:
         serviceAccountName: default
@@ -53,4 +128,3 @@ steps:
           limits:
             memory: 512Mi
             cpu: 500m
-    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-fedora42.yaml

@@ -1,14 +1,26 @@
+# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: push
     branch: master
 
+matrix:
+  PACKAGE:
+    - consul
+    - nfpm
+    - tea
+    - unkin-ca-certificates
+    - uv
+    - vault
+    - xh
+    - yq
+
 steps:
-  - name: build-rpms
+  - name: build
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build-all --distro fedora/42 --buildah
+      - ./tools/build build --distro fedora/42 --buildah "$PACKAGE"
     privileged: true
     backend_options:
       kubernetes:
@@ -21,28 +33,27 @@ steps:
             memory: 2Gi
             cpu: 2
 
-  - name: show-rpms
-    image: git.unkin.net/unkin/fedora42-rpmbuilder:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
-    depends_on: [build-rpms]
-
-  - name: deploy-rpms
-    image: git.unkin.net/unkin/fedora42-rpmbuilder:latest
+  - name: upload
+    image: git.unkin.net/unkin/almalinux9-base:latest
     commands:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-f42"
-        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+        for rpm in $(find dist -type f -name '*.rpm'); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
           code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
           if [ "$$code" = "200" ]; then
-            echo "$$FILE already exists in $$REPO; skipping"
+            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
             continue
           fi
-          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
+          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
+          curl -f -X PUT \
+            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
+            -H "Content-Type: application/x-rpm" \
+            --data-binary @"$$rpm"
         done
+    depends_on: [build]
     backend_options:
       kubernetes:
         serviceAccountName: default
@@ -53,4 +64,3 @@ steps:
           limits:
             memory: 512Mi
             cpu: 500m
-    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-fedora43.yaml

@@ -1,14 +1,26 @@
+# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: push
     branch: master
 
+matrix:
+  PACKAGE:
+    - consul
+    - nfpm
+    - tea
+    - unkin-ca-certificates
+    - uv
+    - vault
+    - xh
+    - yq
+
 steps:
-  - name: build-rpms
+  - name: build
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build-all --distro fedora/43 --buildah
+      - ./tools/build build --distro fedora/43 --buildah "$PACKAGE"
     privileged: true
     backend_options:
       kubernetes:
@@ -21,28 +33,27 @@ steps:
             memory: 2Gi
             cpu: 2
 
-  - name: show-rpms
-    image: git.unkin.net/unkin/fedora43-rpmbuilder:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
-    depends_on: [build-rpms]
-
-  - name: deploy-rpms
-    image: git.unkin.net/unkin/fedora43-rpmbuilder:latest
+  - name: upload
+    image: git.unkin.net/unkin/almalinux9-base:latest
     commands:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-f43"
-        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+        for rpm in $(find dist -type f -name '*.rpm'); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
           code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
           if [ "$$code" = "200" ]; then
-            echo "$$FILE already exists in $$REPO; skipping"
+            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
             continue
           fi
-          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
+          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
+          curl -f -X PUT \
+            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
+            -H "Content-Type: application/x-rpm" \
+            --data-binary @"$$rpm"
         done
+    depends_on: [build]
     backend_options:
       kubernetes:
         serviceAccountName: default
@@ -53,4 +64,3 @@ steps:
           limits:
             memory: 512Mi
             cpu: 500m
-    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-fedora44.yaml

@@ -1,14 +1,26 @@
+# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: push
     branch: master
 
+matrix:
+  PACKAGE:
+    - consul
+    - nfpm
+    - tea
+    - unkin-ca-certificates
+    - uv
+    - vault
+    - xh
+    - yq
+
 steps:
-  - name: build-rpms
+  - name: build
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build-all --distro fedora/44 --buildah
+      - ./tools/build build --distro fedora/44 --buildah "$PACKAGE"
     privileged: true
     backend_options:
       kubernetes:
@@ -21,28 +33,27 @@ steps:
             memory: 2Gi
             cpu: 2
 
-  - name: show-rpms
-    image: git.unkin.net/unkin/fedora44-rpmbuilder:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
-    depends_on: [build-rpms]
-
-  - name: deploy-rpms
-    image: git.unkin.net/unkin/fedora44-rpmbuilder:latest
+  - name: upload
+    image: git.unkin.net/unkin/almalinux9-base:latest
     commands:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-f44"
-        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+        for rpm in $(find dist -type f -name '*.rpm'); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
           code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
           if [ "$$code" = "200" ]; then
-            echo "$$FILE already exists in $$REPO; skipping"
+            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
             continue
           fi
-          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
+          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
+          curl -f -X PUT \
+            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
+            -H "Content-Type: application/x-rpm" \
+            --data-binary @"$$rpm"
         done
+    depends_on: [build]
     backend_options:
       kubernetes:
         serviceAccountName: default
@@ -53,4 +64,3 @@ steps:
           limits:
             memory: 512Mi
             cpu: 500m
-    depends_on: [build-rpms, show-rpms]

Makefile

@@ -11,9 +11,14 @@ DISTRO ?= almalinux/el9
 PACKAGES := $(shell find $(ROOT_DIR)/rpms -mindepth 1 -maxdepth 1 -type d -exec test -f {}/metadata.yaml \; -print | xargs -n1 basename | sort)
 
 # Default target to build all packages
-.PHONY: all list build clean test
+.PHONY: all list build clean test pipelines
 all: build-all
 
+# Regenerate the per-distro Woodpecker matrix pipelines from rpms/*/metadata.yaml
+pipelines:
+	@echo "Regenerating .woodpecker pipelines..."
+	$(ROOT_DIR)/tools/gen-pipelines
+
 # List all available packages
 list:
 	@echo "Available packages:"

tools/gen-pipelines

@@ -0,0 +1,147 @@
+#!/usr/bin/env -S uv run --script
+# /// script
+# dependencies = [
+#   "pyyaml",
+# ]
+# ///
+
+# vim: filetype=python
+
+"""
+Generate Woodpecker pipelines for rpmbuilder.
+
+One pipeline file per distro (build-<distro>.yaml for pull_request checks and
+deploy-<distro>.yaml for master pushes). Each pipeline uses a Woodpecker matrix
+over the packages that target that distro, so every vendor package builds in its
+own job. Deploy jobs publish to the distro's artifactapi rpm-vendor local repo.
+
+The matrix package lists are derived from each rpms/*/metadata.yaml, so this
+script is the source of truth: run `make pipelines` (or ./tools/gen-pipelines)
+after adding/removing a package or changing its target distros, and commit the
+regenerated .woodpecker/*.yaml.
+"""
+
+import glob
+from pathlib import Path
+
+import yaml
+
+ROOT = Path(__file__).resolve().parent.parent
+WOODPECKER = ROOT / ".woodpecker"
+
+# Distro -> pipeline settings. `builder` runs buildah/the build tool (the actual
+# RPM build happens in a nested container using each package's metadata image);
+# `upload` only needs curl. rpm-vendor-<suffix> mirrors the artifactapi repos.
+DISTROS = [
+    {"key": "almalinux8", "distro": "almalinux/el8", "repo": "rpm-vendor-el8"},
+    {"key": "almalinux9", "distro": "almalinux/el9", "repo": "rpm-vendor-el9"},
+    {"key": "fedora42", "distro": "fedora/42", "repo": "rpm-vendor-f42"},
+    {"key": "fedora43", "distro": "fedora/43", "repo": "rpm-vendor-f43"},
+    {"key": "fedora44", "distro": "fedora/44", "repo": "rpm-vendor-f44"},
+]
+
+BUILDER_IMAGE = "git.unkin.net/unkin/almalinux9-rpmbuilder:latest"
+UPLOAD_IMAGE = "git.unkin.net/unkin/almalinux9-base:latest"
+ARTIFACTAPI = "https://artifactapi.k8s.syd1.au.unkin.net"
+
+HEADER = "# Generated by tools/gen-pipelines - do not edit by hand.\n"
+
+
+def packages_for(distro: str) -> list[str]:
+    names = []
+    for mf in sorted(glob.glob(str(ROOT / "rpms" / "*" / "metadata.yaml"))):
+        meta = yaml.safe_load(open(mf)) or {}
+        distros = {
+            repo
+            for build in meta.get("builds", [])
+            for repo in build.get("repository", [])
+        }
+        if distro in distros:
+            names.append(meta.get("name", Path(mf).parent.name))
+    return sorted(names)
+
+
+def matrix_block(packages: list[str]) -> str:
+    lines = "\n".join(f"    - {p}" for p in packages)
+    return f"matrix:\n  PACKAGE:\n{lines}\n"
+
+
+def build_step() -> str:
+    return f"""  - name: build
+    image: {BUILDER_IMAGE}
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - ./tools/build build --distro DISTRO --buildah "$PACKAGE"
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
+"""
+
+
+def upload_step(repo: str) -> str:
+    return f"""  - name: upload
+    image: {UPLOAD_IMAGE}
+    commands:
+      - |
+        HOST="{ARTIFACTAPI}"
+        REPO="{repo}"
+        for rpm in $(find dist -type f -name '*.rpm'); do
+          FILE=$$(basename "$$rpm")
+          # artifactapi has no HEAD route (405); probe the served Packages path.
+          code=$$(curl -s -o /dev/null -w '%{{http_code}}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
+          if [ "$$code" = "200" ]; then
+            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
+            continue
+          fi
+          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
+          curl -f -X PUT \\
+            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \\
+            -H "Content-Type: application/x-rpm" \\
+            --data-binary @"$$rpm"
+        done
+    depends_on: [build]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
+"""
+
+
+def render(distro_cfg: dict, deploy: bool) -> str:
+    packages = packages_for(distro_cfg["distro"])
+    if deploy:
+        when = "when:\n  - event: push\n    branch: master\n"
+    else:
+        when = "when:\n  - event: pull_request\n"
+    body = HEADER + when + "\n" + matrix_block(packages) + "\nsteps:\n"
+    body += build_step().replace("DISTRO", distro_cfg["distro"])
+    if deploy:
+        body += "\n" + upload_step(distro_cfg["repo"])
+    return body
+
+
+def main() -> None:
+    for cfg in DISTROS:
+        (WOODPECKER / f"build-{cfg['key']}.yaml").write_text(render(cfg, deploy=False))
+        (WOODPECKER / f"deploy-{cfg['key']}.yaml").write_text(render(cfg, deploy=True))
+        print(f"generated build-{cfg['key']}.yaml deploy-{cfg['key']}.yaml "
+              f"({len(packages_for(cfg['distro']))} packages)")
+
+
+if __name__ == "__main__":
+    main()