feat: migrate to woodpeckerci

- update build tool for kubernetes auth
- add woodpecker pre-commit and build jobs

.woodpecker/build-almalinux8.yaml

@@ -2,14 +2,14 @@ when:
   - event: pull_request
 
 steps:
-  - name: build rpms
+  - name: build-rpms
     image: git.unkin.net/unkin/almalinux8-actionsdind:latest
     commands:
       - ./tools/build build-all --distro almalinux/el8
     backend_options:
       kubernetes:
         serviceAccountName: default
-  - name: show rpms
+  - name: build-rpms
     image: git.unkin.net/unkin/almalinux8-base:latest
     commands:
       - find /workspace -type f -name "*.rpm"

.woodpecker/build-almalinux9.yaml

@@ -2,14 +2,14 @@ when:
   - event: pull_request
 
 steps:
-  - name: build rpms
+  - name: build-rpms
     image: git.unkin.net/unkin/almalinux9-actionsdind:latest
     commands:
       - ./tools/build build-all --distro almalinux/el8
     backend_options:
       kubernetes:
         serviceAccountName: default
-  - name: show rpms
+  - name: build-rpms
     image: git.unkin.net/unkin/almalinux8-base:latest
     commands:
       - find /workspace -type f -name "*.rpm"

Makefile

@@ -6,7 +6,6 @@ DISTRO ?= almalinux/el9
 # Authentication variables (optional)
 # VAULT_ROLE_ID - Use AppRole authentication if set
 # VAULT_ROLE - Kubernetes role for service account authentication (default: rpmbuilder)
-# VAULT_AUDIENCE - Audience for Kubernetes authentication (default: vault)
 
 # Automatically find all packages with metadata.yaml
 PACKAGES := $(shell find $(ROOT_DIR)/rpms -mindepth 1 -maxdepth 1 -type d -exec test -f {}/metadata.yaml \; -print | xargs -n1 basename | sort)

tools/build

@@ -167,7 +167,6 @@ def get_vault_client() -> hvac.Client:
     vault_addr = os.getenv('VAULT_ADDR', 'https://vault.service.consul:8200')
     vault_role_id = os.getenv('VAULT_ROLE_ID')
     vault_role = os.getenv('VAULT_ROLE', 'rpmbuilder')
-    vault_audience = os.getenv('VAULT_AUDIENCE', 'vault')
 
     # Initialize Vault client with CA certificate
     client = hvac.Client(
@@ -207,8 +206,7 @@ def get_vault_client() -> hvac.Client:
             client.auth.kubernetes.login(
                 role=vault_role,
                 jwt=jwt_token,
-                mount_point='k8s/au/syd1',
+                mount_point='k8s/au/syd1'
-                audience=vault_audience
             )
 
             if not client.is_authenticated():