Publish RPMs to artifactapi rpm-vendor repos

Vendored RPMs currently upload to Gitea's per-distro RPM registry. Publish
them instead to the artifactapi per-distro rpm-vendor local repos (real yum
repos; repodata regenerates automatically), keeping them separate from
in-house software (rpm-internal). The build jobs are unchanged (build-all
per distro).

- .woodpecker/deploy-*.yaml: retarget the deploy-rpms step from
  git.unkin.net/api/packages/... to a PUT against artifactapi
  /api/v2/remotes/rpm-vendor-<distro>/files/ (unauthenticated, like the other
  repos), with an existence probe to skip re-uploads. Drops the
  DRONECI_PASSWORD secret.
- tools/build: repoint check_package_exists from the Gitea packages API to
  the artifactapi rpm-vendor repo so build-all's skip check matches the real
  publish target; verify artifactapi's internal TLS cert against the OS CA
  bundle; carry arch on PackageInfo so the probed filename matches the RPM.

.woodpecker/build-almalinux8.yaml

@@ -1,88 +1,13 @@
-# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: pull_request
 
-matrix:
-  PACKAGE:
-    - act_runner
-    - bind_exporter
-    - boilerplate
-    - claude-code
-    - cni-plugins
-    - code-server
-    - consul
-    - consul-cni
-    - etcd
-    - exportarr
-    - frr_exporter
-    - g10k
-    - git-delta
-    - hadolint
-    - helm
-    - helmfile
-    - jellyfin-ffmpeg-bin
-    - jellyfin-server
-    - jellyfin-web
-    - jsonnet
-    - jsonnet-language-server
-    - jsonnet-lint
-    - kubecolor
-    - kubeconform
-    - kubectx
-    - kustomize
-    - lazydocker
-    - libfoundationdb
-    - neovim
-    - neovim-glibc-2.17
-    - nfpm
-    - node_exporter
-    - nomad
-    - nomad-autoscaler
-    - nzbget
-    - nzbget_exporter
-    - openbao-plugin-secret-consul
-    - openbao-plugin-secret-nomad
-    - openbao-plugins
-    - packer
-    - pgbouncer_exporter
-    - postgres_exporter
-    - puppet-initial
-    - puppetdb_exporter
-    - ruff
-    - sops
-    - stalwart
-    - stalwart-cli
-    - stalwart-foundationdb
-    - starship
-    - stern
-    - tea
-    - terraform
-    - terragrunt
-    - tflint
-    - unkin-ca-certificates
-    - unkin-undionly-kpxe
-    - unrar
-    - uv
-    - vals
-    - vault
-    - victoria-logs
-    - vlutils
-    - vmagent
-    - vmalert
-    - vminsert
-    - vmselect
-    - vmstorage
-    - vmutils
-    - xh
-    - yq
-
 steps:
-  - name: build
+  - name: build rpms
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build --distro almalinux/el8 --buildah "$PACKAGE"
+      - ./tools/build build-all --distro almalinux/el8 --buildah
     privileged: true
     backend_options:
       kubernetes:
@@ -94,3 +19,8 @@ steps:
           limits:
             memory: 2Gi
             cpu: 2
+
+  - name: show rpms
+    image: git.unkin.net/unkin/almalinux8-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/build-almalinux9.yaml

@@ -1,89 +1,13 @@
-# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: pull_request
 
-matrix:
-  PACKAGE:
-    - act_runner
-    - bind_exporter
-    - boilerplate
-    - claude-code
-    - cni-plugins
-    - code-server
-    - consul
-    - consul-cni
-    - etcd
-    - exportarr
-    - frr_exporter
-    - g10k
-    - git-delta
-    - hadolint
-    - helm
-    - helmfile
-    - incus
-    - jellyfin-ffmpeg-bin
-    - jellyfin-server
-    - jellyfin-web
-    - jsonnet
-    - jsonnet-language-server
-    - jsonnet-lint
-    - kubecolor
-    - kubeconform
-    - kubectx
-    - kustomize
-    - lazydocker
-    - libfoundationdb
-    - neovim
-    - neovim-glibc-2.17
-    - nfpm
-    - node_exporter
-    - nomad
-    - nomad-autoscaler
-    - nzbget
-    - nzbget_exporter
-    - openbao-plugin-secret-consul
-    - openbao-plugin-secret-nomad
-    - openbao-plugins
-    - packer
-    - pgbouncer_exporter
-    - postgres_exporter
-    - puppet-initial
-    - puppetdb_exporter
-    - ruff
-    - sops
-    - stalwart
-    - stalwart-cli
-    - stalwart-foundationdb
-    - starship
-    - stern
-    - tea
-    - terraform
-    - terragrunt
-    - tflint
-    - unkin-ca-certificates
-    - unkin-undionly-kpxe
-    - unrar
-    - uv
-    - vals
-    - vault
-    - victoria-logs
-    - vlutils
-    - vmagent
-    - vmalert
-    - vminsert
-    - vmselect
-    - vmstorage
-    - vmutils
-    - xh
-    - yq
-
 steps:
-  - name: build
+  - name: build rpms
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build --distro almalinux/el9 --buildah "$PACKAGE"
+      - ./tools/build build-all --distro almalinux/el9 --buildah
     privileged: true
     backend_options:
       kubernetes:
@@ -95,3 +19,8 @@ steps:
           limits:
             memory: 2Gi
             cpu: 2
+
+  - name: show rpms
+    image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/build-fedora42.yaml

@@ -1,25 +1,13 @@
-# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: pull_request
 
-matrix:
-  PACKAGE:
-    - consul
-    - nfpm
-    - tea
-    - unkin-ca-certificates
-    - uv
-    - vault
-    - xh
-    - yq
-
 steps:
-  - name: build
+  - name: build rpms
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build --distro fedora/42 --buildah "$PACKAGE"
+      - ./tools/build build-all --distro fedora/42 --buildah
     privileged: true
     backend_options:
       kubernetes:
@@ -31,3 +19,8 @@ steps:
           limits:
             memory: 2Gi
             cpu: 2
+
+  - name: show rpms
+    image: git.unkin.net/unkin/fedora42-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/build-fedora43.yaml

@@ -1,25 +1,13 @@
-# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: pull_request
 
-matrix:
-  PACKAGE:
-    - consul
-    - nfpm
-    - tea
-    - unkin-ca-certificates
-    - uv
-    - vault
-    - xh
-    - yq
-
 steps:
-  - name: build
+  - name: build rpms
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build --distro fedora/43 --buildah "$PACKAGE"
+      - ./tools/build build-all --distro fedora/43 --buildah
     privileged: true
     backend_options:
       kubernetes:
@@ -31,3 +19,8 @@ steps:
           limits:
             memory: 2Gi
             cpu: 2
+
+  - name: show rpms
+    image: git.unkin.net/unkin/fedora43-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/build-fedora44.yaml

@@ -1,25 +1,13 @@
-# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: pull_request
 
-matrix:
-  PACKAGE:
-    - consul
-    - nfpm
-    - tea
-    - unkin-ca-certificates
-    - uv
-    - vault
-    - xh
-    - yq
-
 steps:
-  - name: build
+  - name: build rpms
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build --distro fedora/44 --buildah "$PACKAGE"
+      - ./tools/build build-all --distro fedora/44 --buildah
     privileged: true
     backend_options:
       kubernetes:
@@ -31,3 +19,8 @@ steps:
           limits:
             memory: 2Gi
             cpu: 2
+
+  - name: show rpms
+    image: git.unkin.net/unkin/fedora44-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/deploy-almalinux8.yaml

@@ -1,89 +1,14 @@
-# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: push
     branch: master
 
-matrix:
-  PACKAGE:
-    - act_runner
-    - bind_exporter
-    - boilerplate
-    - claude-code
-    - cni-plugins
-    - code-server
-    - consul
-    - consul-cni
-    - etcd
-    - exportarr
-    - frr_exporter
-    - g10k
-    - git-delta
-    - hadolint
-    - helm
-    - helmfile
-    - jellyfin-ffmpeg-bin
-    - jellyfin-server
-    - jellyfin-web
-    - jsonnet
-    - jsonnet-language-server
-    - jsonnet-lint
-    - kubecolor
-    - kubeconform
-    - kubectx
-    - kustomize
-    - lazydocker
-    - libfoundationdb
-    - neovim
-    - neovim-glibc-2.17
-    - nfpm
-    - node_exporter
-    - nomad
-    - nomad-autoscaler
-    - nzbget
-    - nzbget_exporter
-    - openbao-plugin-secret-consul
-    - openbao-plugin-secret-nomad
-    - openbao-plugins
-    - packer
-    - pgbouncer_exporter
-    - postgres_exporter
-    - puppet-initial
-    - puppetdb_exporter
-    - ruff
-    - sops
-    - stalwart
-    - stalwart-cli
-    - stalwart-foundationdb
-    - starship
-    - stern
-    - tea
-    - terraform
-    - terragrunt
-    - tflint
-    - unkin-ca-certificates
-    - unkin-undionly-kpxe
-    - unrar
-    - uv
-    - vals
-    - vault
-    - victoria-logs
-    - vlutils
-    - vmagent
-    - vmalert
-    - vminsert
-    - vmselect
-    - vmstorage
-    - vmutils
-    - xh
-    - yq
-
 steps:
-  - name: build
+  - name: build-rpms
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build --distro almalinux/el8 --buildah "$PACKAGE"
+      - ./tools/build build-all --distro almalinux/el8 --buildah
     privileged: true
     backend_options:
       kubernetes:
@@ -96,27 +21,28 @@ steps:
             memory: 2Gi
             cpu: 2
 
-  - name: upload
+  - name: show-rpms
     image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-el8"
-        for rpm in $(find dist -type f -name '*.rpm'); do
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
           code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
           if [ "$$code" = "200" ]; then
-            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
+            echo "$$FILE already exists in $$REPO; skipping"
             continue
           fi
-          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
-          curl -f -X PUT \
-            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
-            -H "Content-Type: application/x-rpm" \
-            --data-binary @"$$rpm"
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
         done
-    depends_on: [build]
     backend_options:
       kubernetes:
         serviceAccountName: default
@@ -127,3 +53,4 @@ steps:
           limits:
             memory: 512Mi
             cpu: 500m
+    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-almalinux9.yaml

@@ -1,90 +1,14 @@
-# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: push
     branch: master
 
-matrix:
-  PACKAGE:
-    - act_runner
-    - bind_exporter
-    - boilerplate
-    - claude-code
-    - cni-plugins
-    - code-server
-    - consul
-    - consul-cni
-    - etcd
-    - exportarr
-    - frr_exporter
-    - g10k
-    - git-delta
-    - hadolint
-    - helm
-    - helmfile
-    - incus
-    - jellyfin-ffmpeg-bin
-    - jellyfin-server
-    - jellyfin-web
-    - jsonnet
-    - jsonnet-language-server
-    - jsonnet-lint
-    - kubecolor
-    - kubeconform
-    - kubectx
-    - kustomize
-    - lazydocker
-    - libfoundationdb
-    - neovim
-    - neovim-glibc-2.17
-    - nfpm
-    - node_exporter
-    - nomad
-    - nomad-autoscaler
-    - nzbget
-    - nzbget_exporter
-    - openbao-plugin-secret-consul
-    - openbao-plugin-secret-nomad
-    - openbao-plugins
-    - packer
-    - pgbouncer_exporter
-    - postgres_exporter
-    - puppet-initial
-    - puppetdb_exporter
-    - ruff
-    - sops
-    - stalwart
-    - stalwart-cli
-    - stalwart-foundationdb
-    - starship
-    - stern
-    - tea
-    - terraform
-    - terragrunt
-    - tflint
-    - unkin-ca-certificates
-    - unkin-undionly-kpxe
-    - unrar
-    - uv
-    - vals
-    - vault
-    - victoria-logs
-    - vlutils
-    - vmagent
-    - vmalert
-    - vminsert
-    - vmselect
-    - vmstorage
-    - vmutils
-    - xh
-    - yq
-
 steps:
-  - name: build
+  - name: build-rpms
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build --distro almalinux/el9 --buildah "$PACKAGE"
+      - ./tools/build build-all --distro almalinux/el9 --buildah
     privileged: true
     backend_options:
       kubernetes:
@@ -97,27 +21,28 @@ steps:
             memory: 2Gi
             cpu: 2
 
-  - name: upload
+  - name: show-rpms
     image: git.unkin.net/unkin/almalinux9-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-el9"
-        for rpm in $(find dist -type f -name '*.rpm'); do
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
           code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
           if [ "$$code" = "200" ]; then
-            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
+            echo "$$FILE already exists in $$REPO; skipping"
             continue
           fi
-          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
-          curl -f -X PUT \
-            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
-            -H "Content-Type: application/x-rpm" \
-            --data-binary @"$$rpm"
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
         done
-    depends_on: [build]
     backend_options:
       kubernetes:
         serviceAccountName: default
@@ -128,3 +53,4 @@ steps:
           limits:
             memory: 512Mi
             cpu: 500m
+    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-fedora42.yaml

@@ -1,26 +1,14 @@
-# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: push
     branch: master
 
-matrix:
-  PACKAGE:
-    - consul
-    - nfpm
-    - tea
-    - unkin-ca-certificates
-    - uv
-    - vault
-    - xh
-    - yq
-
 steps:
-  - name: build
+  - name: build-rpms
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build --distro fedora/42 --buildah "$PACKAGE"
+      - ./tools/build build-all --distro fedora/42 --buildah
     privileged: true
     backend_options:
       kubernetes:
@@ -33,27 +21,28 @@ steps:
             memory: 2Gi
             cpu: 2
 
-  - name: upload
-    image: git.unkin.net/unkin/almalinux9-base:latest
+  - name: show-rpms
+    image: git.unkin.net/unkin/fedora42-rpmbuilder:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: git.unkin.net/unkin/fedora42-rpmbuilder:latest
     commands:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-f42"
-        for rpm in $(find dist -type f -name '*.rpm'); do
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
           code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
           if [ "$$code" = "200" ]; then
-            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
+            echo "$$FILE already exists in $$REPO; skipping"
             continue
           fi
-          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
-          curl -f -X PUT \
-            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
-            -H "Content-Type: application/x-rpm" \
-            --data-binary @"$$rpm"
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
         done
-    depends_on: [build]
     backend_options:
       kubernetes:
         serviceAccountName: default
@@ -64,3 +53,4 @@ steps:
           limits:
             memory: 512Mi
             cpu: 500m
+    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-fedora43.yaml

@@ -1,26 +1,14 @@
-# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: push
     branch: master
 
-matrix:
-  PACKAGE:
-    - consul
-    - nfpm
-    - tea
-    - unkin-ca-certificates
-    - uv
-    - vault
-    - xh
-    - yq
-
 steps:
-  - name: build
+  - name: build-rpms
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build --distro fedora/43 --buildah "$PACKAGE"
+      - ./tools/build build-all --distro fedora/43 --buildah
     privileged: true
     backend_options:
       kubernetes:
@@ -33,27 +21,28 @@ steps:
             memory: 2Gi
             cpu: 2
 
-  - name: upload
-    image: git.unkin.net/unkin/almalinux9-base:latest
+  - name: show-rpms
+    image: git.unkin.net/unkin/fedora43-rpmbuilder:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: git.unkin.net/unkin/fedora43-rpmbuilder:latest
     commands:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-f43"
-        for rpm in $(find dist -type f -name '*.rpm'); do
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
           code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
           if [ "$$code" = "200" ]; then
-            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
+            echo "$$FILE already exists in $$REPO; skipping"
             continue
           fi
-          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
-          curl -f -X PUT \
-            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
-            -H "Content-Type: application/x-rpm" \
-            --data-binary @"$$rpm"
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
         done
-    depends_on: [build]
     backend_options:
       kubernetes:
         serviceAccountName: default
@@ -64,3 +53,4 @@ steps:
           limits:
             memory: 512Mi
             cpu: 500m
+    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-fedora44.yaml

@@ -1,26 +1,14 @@
-# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: push
     branch: master
 
-matrix:
-  PACKAGE:
-    - consul
-    - nfpm
-    - tea
-    - unkin-ca-certificates
-    - uv
-    - vault
-    - xh
-    - yq
-
 steps:
-  - name: build
+  - name: build-rpms
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build --distro fedora/44 --buildah "$PACKAGE"
+      - ./tools/build build-all --distro fedora/44 --buildah
     privileged: true
     backend_options:
       kubernetes:
@@ -33,27 +21,28 @@ steps:
             memory: 2Gi
             cpu: 2
 
-  - name: upload
-    image: git.unkin.net/unkin/almalinux9-base:latest
+  - name: show-rpms
+    image: git.unkin.net/unkin/fedora44-rpmbuilder:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: git.unkin.net/unkin/fedora44-rpmbuilder:latest
     commands:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-f44"
-        for rpm in $(find dist -type f -name '*.rpm'); do
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
           code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
           if [ "$$code" = "200" ]; then
-            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
+            echo "$$FILE already exists in $$REPO; skipping"
             continue
           fi
-          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
-          curl -f -X PUT \
-            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
-            -H "Content-Type: application/x-rpm" \
-            --data-binary @"$$rpm"
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
         done
-    depends_on: [build]
     backend_options:
       kubernetes:
         serviceAccountName: default
@@ -64,3 +53,4 @@ steps:
           limits:
             memory: 512Mi
             cpu: 500m
+    depends_on: [build-rpms, show-rpms]

Makefile

@@ -11,14 +11,9 @@ DISTRO ?= almalinux/el9
 PACKAGES := $(shell find $(ROOT_DIR)/rpms -mindepth 1 -maxdepth 1 -type d -exec test -f {}/metadata.yaml \; -print | xargs -n1 basename | sort)
 
 # Default target to build all packages
-.PHONY: all list build clean test pipelines
+.PHONY: all list build clean test
 all: build-all
 
-# Regenerate the per-distro Woodpecker matrix pipelines from rpms/*/metadata.yaml
-pipelines:
-	@echo "Regenerating .woodpecker pipelines..."
-	$(ROOT_DIR)/tools/gen-pipelines
-
 # List all available packages
 list:
 	@echo "Available packages:"

tools/gen-pipelines

@@ -1,147 +0,0 @@
-#!/usr/bin/env -S uv run --script
-# /// script
-# dependencies = [
-#   "pyyaml",
-# ]
-# ///
-
-# vim: filetype=python
-
-"""
-Generate Woodpecker pipelines for rpmbuilder.
-
-One pipeline file per distro (build-<distro>.yaml for pull_request checks and
-deploy-<distro>.yaml for master pushes). Each pipeline uses a Woodpecker matrix
-over the packages that target that distro, so every vendor package builds in its
-own job. Deploy jobs publish to the distro's artifactapi rpm-vendor local repo.
-
-The matrix package lists are derived from each rpms/*/metadata.yaml, so this
-script is the source of truth: run `make pipelines` (or ./tools/gen-pipelines)
-after adding/removing a package or changing its target distros, and commit the
-regenerated .woodpecker/*.yaml.
-"""
-
-import glob
-from pathlib import Path
-
-import yaml
-
-ROOT = Path(__file__).resolve().parent.parent
-WOODPECKER = ROOT / ".woodpecker"
-
-# Distro -> pipeline settings. `builder` runs buildah/the build tool (the actual
-# RPM build happens in a nested container using each package's metadata image);
-# `upload` only needs curl. rpm-vendor-<suffix> mirrors the artifactapi repos.
-DISTROS = [
-    {"key": "almalinux8", "distro": "almalinux/el8", "repo": "rpm-vendor-el8"},
-    {"key": "almalinux9", "distro": "almalinux/el9", "repo": "rpm-vendor-el9"},
-    {"key": "fedora42", "distro": "fedora/42", "repo": "rpm-vendor-f42"},
-    {"key": "fedora43", "distro": "fedora/43", "repo": "rpm-vendor-f43"},
-    {"key": "fedora44", "distro": "fedora/44", "repo": "rpm-vendor-f44"},
-]
-
-BUILDER_IMAGE = "git.unkin.net/unkin/almalinux9-rpmbuilder:latest"
-UPLOAD_IMAGE = "git.unkin.net/unkin/almalinux9-base:latest"
-ARTIFACTAPI = "https://artifactapi.k8s.syd1.au.unkin.net"
-
-HEADER = "# Generated by tools/gen-pipelines - do not edit by hand.\n"
-
-
-def packages_for(distro: str) -> list[str]:
-    names = []
-    for mf in sorted(glob.glob(str(ROOT / "rpms" / "*" / "metadata.yaml"))):
-        meta = yaml.safe_load(open(mf)) or {}
-        distros = {
-            repo
-            for build in meta.get("builds", [])
-            for repo in build.get("repository", [])
-        }
-        if distro in distros:
-            names.append(meta.get("name", Path(mf).parent.name))
-    return sorted(names)
-
-
-def matrix_block(packages: list[str]) -> str:
-    lines = "\n".join(f"    - {p}" for p in packages)
-    return f"matrix:\n  PACKAGE:\n{lines}\n"
-
-
-def build_step() -> str:
-    return f"""  - name: build
-    image: {BUILDER_IMAGE}
-    commands:
-      - mkdir -p /woodpecker/rpms
-      - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build --distro DISTRO --buildah "$PACKAGE"
-    privileged: true
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 2
-"""
-
-
-def upload_step(repo: str) -> str:
-    return f"""  - name: upload
-    image: {UPLOAD_IMAGE}
-    commands:
-      - |
-        HOST="{ARTIFACTAPI}"
-        REPO="{repo}"
-        for rpm in $(find dist -type f -name '*.rpm'); do
-          FILE=$$(basename "$$rpm")
-          # artifactapi has no HEAD route (405); probe the served Packages path.
-          code=$$(curl -s -o /dev/null -w '%{{http_code}}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
-          if [ "$$code" = "200" ]; then
-            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
-            continue
-          fi
-          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
-          curl -f -X PUT \\
-            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \\
-            -H "Content-Type: application/x-rpm" \\
-            --data-binary @"$$rpm"
-        done
-    depends_on: [build]
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 128Mi
-            cpu: 100m
-          limits:
-            memory: 512Mi
-            cpu: 500m
-"""
-
-
-def render(distro_cfg: dict, deploy: bool) -> str:
-    packages = packages_for(distro_cfg["distro"])
-    if deploy:
-        when = "when:\n  - event: push\n    branch: master\n"
-    else:
-        when = "when:\n  - event: pull_request\n"
-    body = HEADER + when + "\n" + matrix_block(packages) + "\nsteps:\n"
-    body += build_step().replace("DISTRO", distro_cfg["distro"])
-    if deploy:
-        body += "\n" + upload_step(distro_cfg["repo"])
-    return body
-
-
-def main() -> None:
-    for cfg in DISTROS:
-        (WOODPECKER / f"build-{cfg['key']}.yaml").write_text(render(cfg, deploy=False))
-        (WOODPECKER / f"deploy-{cfg['key']}.yaml").write_text(render(cfg, deploy=True))
-        print(f"generated build-{cfg['key']}.yaml deploy-{cfg['key']}.yaml "
-              f"({len(packages_for(cfg['distro']))} packages)")
-
-
-if __name__ == "__main__":
-    main()