feat: migrate to woodpeckerci

- update build tool for kubernetes auth
- update build tool to build packages without docker (native + buildah)
- add woodpecker pre-commit and build jobs
- add woodpecker deployment jobs
- update pre-commit checks

.gitea/workflows/build.yaml

@@ -0,0 +1,59 @@
+name: Build
+
+on:
+  pull_request:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  build-8:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux8-actionsdind:latest
+      options: "--privileged --volume /etc/pki/tls/vault:/etc/pki/tls/vault:ro"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Build Packages
+        env:
+          VAULT_ROLE_ID: ${{ secrets.RPMBUILDER_VAULT_ROLEID }}
+        run: |
+          ./tools/build build-all --distro almalinux/el8
+
+      - name: Show RPMs
+        run: |
+          find /workspace -type f -name "*.rpm"
+
+      - name: Upload Artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: rpms-8
+          path: /workspace/unkin/rpmbuilder/dist/*/*/*.rpm
+
+  build-9:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
+      options: "--privileged --volume /etc/pki/tls/vault:/etc/pki/tls/vault:ro"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Build Packages
+        env:
+          VAULT_ROLE_ID: ${{ secrets.RPMBUILDER_VAULT_ROLEID }}
+        run: |
+          ./tools/build build-all --distro almalinux/el9
+
+      - name: Show RPMs
+        run: |
+          find /workspace -type f -name "*.rpm"
+
+      - name: Upload Artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: rpms-9
+          path: /workspace/unkin/rpmbuilder/dist/*/*/*.rpm

.gitea/workflows/deploy.yaml

@@ -0,0 +1,66 @@
+name: Deploy
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  deploy-8:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux8-actionsdind:latest
+      options: --privileged
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Download Artifacts
+        run: |
+          mkdir -p /workspace/unkin/rpmbuilder/dist/almalinux/el8
+          export PREVIOUS_RUN_ID=$((GITHUB_RUN_NUMBER - 1))
+          curl -L -o /workspace/rpms.zip "https://git.unkin.net/${GITHUB_REPOSITORY}/actions/runs/${PREVIOUS_RUN_ID}/artifacts/rpms-8"
+          unzip /workspace/rpms.zip -d /workspace/unkin/rpmbuilder/dist/almalinux/el8
+
+      - name: Show RPMs
+        run: |
+          find /workspace -type f -name "*.rpm"
+
+      - name: Upload RPMs to Gitea
+        env:
+          DRONECI_PASSWORD: ${{ secrets.DRONECI_PASSWORD }}
+        run: |
+          for rpm in $(find /workspace/unkin/rpmbuilder/dist/almalinux/el8 -type f -name "*.rpm"); do
+            curl --user droneci:${{ secrets.DRONECI_PASSWORD }} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
+          done
+
+  deploy-9:
+    runs-on: almalinux-8
+    container:
+      image: git.unkin.net/unkin/almalinux9-actionsdind:latest
+      options: --privileged
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Download Artifacts
+        run: |
+          mkdir -p /workspace/unkin/rpmbuilder/dist/almalinux/el9
+          export PREVIOUS_RUN_ID=$((GITHUB_RUN_NUMBER - 1))
+          curl -L -o /workspace/rpms.zip "https://git.unkin.net/${GITHUB_REPOSITORY}/actions/runs/${PREVIOUS_RUN_ID}/artifacts/rpms-9"
+          unzip /workspace/rpms.zip -d /workspace/unkin/rpmbuilder/dist/almalinux/el9
+
+      - name: Show RPMs
+        run: |
+          find /workspace -type f -name "*.rpm"
+
+      - name: Upload RPMs to Gitea
+        env:
+          DRONECI_PASSWORD: ${{ secrets.DRONECI_PASSWORD }}
+        run: |
+          for rpm in $(find /workspace/unkin/rpmbuilder/dist/almalinux/el9 -type f -name "*.rpm"); do
+            curl --user droneci:${{ secrets.DRONECI_PASSWORD }} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
+          done

.woodpecker/deploy-almalinux8.yaml

@@ -26,7 +26,7 @@ steps:
     commands:
       - |
         for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
-          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
+          curl --user droneci:${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
         done
     environment:
       DRONECI_PASSWORD:

.woodpecker/deploy-almalinux9.yaml

@@ -26,7 +26,7 @@ steps:
     commands:
       - |
         for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
-          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
+          curl --user droneci:${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
         done
     environment:
       DRONECI_PASSWORD:

rpms/claude-code/metadata.yaml

@@ -1,18 +0,0 @@
----
-arch: amd64
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 2.1.120
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 2.1.120
-claude_ai: true
-description: Claude Code - Anthropic's agentic AI coding tool
-homepage: https://claude.ai/code
-license: Proprietary
-maintainer: Anthropic
-name: claude-code
-platform: linux

rpms/claude-code/resources/build.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/bash
-
-set -e
-
-# Download claude-code binary
-wget -O /app/claude https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/claude-ai/claude-code-releases/${PACKAGE_VERSION}/linux-x64/claude
-chmod +x /app/claude
-
-# Process the nfpm.yaml template with environment variables
-envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
-
-# Build the RPM
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/claude-code/resources/nfpm.yaml

@@ -1,33 +0,0 @@
-# nfpm.yaml
-
-name: ${PACKAGE_NAME}
-version: ${PACKAGE_VERSION}
-release: ${PACKAGE_RELEASE}
-arch: ${PACKAGE_ARCH}
-platform: ${PACKAGE_PLATFORM}
-section: default
-priority: extra
-description: "${PACKAGE_DESCRIPTION}"
-
-maintainer: ${PACKAGE_MAINTAINER}
-homepage: ${PACKAGE_HOMEPAGE}
-license: ${PACKAGE_LICENSE}
-
-disable_globbing: false
-
-replaces:
-  - claude-code
-  - claude
-
-provides:
-  - claude-code
-  - claude
-
-# Files to include in the package
-contents:
-  - src: /app/claude
-    dst: /usr/bin/claude
-    file_info:
-      mode: 0755
-      owner: root
-      group: root

rpms/stern/metadata.yaml

@@ -1,20 +0,0 @@
----
-name: stern
-github: stern/stern
-description: Multi pod and container log tailing for Kubernetes.
-arch: amd64
-platform: linux
-maintainer: stern
-homepage: https://github.com/stern/stern
-license: Apache-2.0
-builds:
-- repository:
-  - almalinux/el8
-  image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-  release: 1
-  version: 1.33.1
-- repository:
-  - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-  release: 1
-  version: 1.33.1

rpms/stern/resources/build.sh

@@ -1,10 +0,0 @@
-#!/usr/bin/bash
-
-set -e
-
-wget -O /app/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/stern/stern/releases/download/v${PACKAGE_VERSION}/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz
-tar xf /app/stern_${PACKAGE_VERSION}_linux_amd64.tar.gz
-
-envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
-
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/stern/resources/nfpm.yaml

@@ -1,30 +0,0 @@
-# nfpm.yaml
-
-name: ${PACKAGE_NAME}
-version: ${PACKAGE_VERSION}
-release: ${PACKAGE_RELEASE}
-arch: ${PACKAGE_ARCH}
-platform: ${PACKAGE_PLATFORM}
-section: default
-priority: extra
-description: "${PACKAGE_DESCRIPTION}"
-
-maintainer: ${PACKAGE_MAINTAINER}
-homepage: ${PACKAGE_HOMEPAGE}
-license: ${PACKAGE_LICENSE}
-
-disable_globbing: false
-
-replaces:
-  - stern
-
-provides:
-  - stern
-
-contents:
-  - src: /app/stern
-    dst: /usr/bin/stern
-    file_info:
-      mode: 0755
-      owner: root
-      group: root

rpms/tea/metadata.yaml

@@ -1,20 +0,0 @@
----
-name: tea
-github: unknown/tea
-description: The official CLI for Gitea.
-arch: amd64
-platform: linux
-maintainer: Gitea
-homepage: https://gitea.com/gitea/tea
-license: MIT
-builds:
-- repository:
-  - almalinux/el8
-  image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-  release: 1
-  version: 0.14.0
-- repository:
-  - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-  release: 1
-  version: 0.14.0

rpms/tea/resources/build.sh

@@ -1,10 +0,0 @@
-#!/usr/bin/bash
-
-set -e
-
-curl -L --output /app/tea-linux-amd64 https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/tea/${PACKAGE_VERSION}/tea-${PACKAGE_VERSION}-linux-amd64
-chmod +x /app/tea-linux-amd64
-
-envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
-
-nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/tea/resources/nfpm.yaml

@@ -1,30 +0,0 @@
-# nfpm.yaml
-
-name: ${PACKAGE_NAME}
-version: ${PACKAGE_VERSION}
-release: ${PACKAGE_RELEASE}
-arch: ${PACKAGE_ARCH}
-platform: ${PACKAGE_PLATFORM}
-section: default
-priority: extra
-description: "${PACKAGE_DESCRIPTION}"
-
-maintainer: ${PACKAGE_MAINTAINER}
-homepage: ${PACKAGE_HOMEPAGE}
-license: ${PACKAGE_LICENSE}
-
-disable_globbing: false
-
-replaces:
-  - tea
-
-provides:
-  - tea
-
-contents:
-  - src: /app/tea-linux-amd64
-    dst: /usr/bin/tea
-    file_info:
-      mode: 0755
-      owner: root
-      group: root

tools/build

@@ -769,7 +769,6 @@ def build_package_docker(
         build_args = [
             'docker', 'build',
             '--pull',
-            '--network=host',
             '-f', str(central_dockerfile),
             '--build-arg', f'BASE_IMAGE={base_image}',
             '--build-arg', f'PACKAGE_NAME={package_name}',
@@ -802,7 +801,6 @@ def build_package_docker(
         # Step 2: Create and start container
         create_args = [
             'docker', 'create',
-            '--network=host',
             '--name', container_name,
             image_name
         ]
@@ -1457,13 +1455,9 @@ class Builder:
                     return True
 
             # Check build tool availability (unless dry run)
-            use_native = native
+            use_native = native or (not buildah and check_native_build_deps())
-            use_buildah = buildah
+            use_buildah = buildah or (not use_native and check_buildah_available())
             use_docker = not use_native and not use_buildah and check_docker_available()
-            if not use_native and not use_buildah and not use_docker:
-                use_buildah = check_buildah_available()
-            if not use_native and not use_buildah and not use_docker:
-                use_native = check_native_build_deps()
 
             if not dry_run and not use_native and not use_buildah and not use_docker:
                 self.logger.error("No build tools available (tried native, Buildah, Docker)")

tools/update-gh

@@ -154,33 +154,6 @@ def load_env_vars(env_file: Path) -> Dict[str, str]:
     return env_vars
 
 
-def get_claude_ai_latest_version() -> Optional[str]:
-    """
-    Get the latest claude-code version from downloads.claude.ai.
-
-    Returns:
-        Latest version string or None if not found
-    """
-    logger = logging.getLogger(__name__)
-
-    try:
-        url = "https://downloads.claude.ai/claude-code-releases/latest"
-        logger.debug(f"Checking claude-code latest version: {url}")
-        response = requests.get(url, timeout=30)
-
-        if response.status_code == 200:
-            version = response.text.strip()
-            logger.debug(f"Latest claude-code version: {version}")
-            return version
-        else:
-            logger.warning(f"Unexpected response from claude.ai: {response.status_code}")
-            return None
-
-    except requests.RequestException as e:
-        logger.error(f"Failed to check claude-code version: {e}")
-        return None
-
-
 def get_github_latest_release(repo: str) -> Optional[Dict]:
     """
     Get the latest release from GitHub API.
@@ -342,30 +315,26 @@ def check_package_updates(package_dir: Path, dry_run: bool = False) -> bool:
         package_name = metadata.get('name', package_dir.name)
         current_version = metadata.get('version')
         github_repo = metadata.get('github')
-        claude_ai = metadata.get('claude_ai', False)
 
-        if not github_repo and not claude_ai:
+        if not github_repo:
-            logger.debug(f"Package {package_name} has no GitHub repo or claude_ai configured")
+            logger.debug(f"Package {package_name} has no GitHub repo configured")
             return True
 
         if not current_version:
             logger.warning(f"Package {package_name} has no version in metadata")
             return False
 
-        if claude_ai:
+        logger.info(f"Checking {package_name} (current: {current_version}) from {github_repo}")
-            logger.info(f"Checking {package_name} (current: {current_version}) from downloads.claude.ai")
+
-            latest_version = get_claude_ai_latest_version()
+        # Get latest release from GitHub
-            if not latest_version:
+        latest_release = get_github_latest_release(github_repo)
-                return False
+        if not latest_release:
-        else:
+            return False
-            logger.info(f"Checking {package_name} (current: {current_version}) from {github_repo}")
+
-            latest_release = get_github_latest_release(github_repo)
+        latest_version = normalize_version(latest_release.get('tag_name', ''))
-            if not latest_release:
+        if not latest_version:
-                return False
+            logger.warning(f"Could not determine latest version for {package_name}")
-            latest_version = normalize_version(latest_release.get('tag_name', ''))
+            return False
-            if not latest_version:
-                logger.warning(f"Could not determine latest version for {package_name}")
-                return False
 
         # Compare versions
         if compare_versions(current_version, latest_version):
@@ -404,7 +373,7 @@ def find_packages_with_github(rpms_dir: Path) -> List[Path]:
             with open(metadata_file, 'r') as f:
                 metadata = yaml.safe_load(f)
 
-            if metadata.get('github') or metadata.get('claude_ai'):
+            if metadata.get('github'):
                 github_packages.append(package_dir)
         except Exception:
             continue