Merge pull request 'ci: allow manual trigger of apply on main' (#48 ) from benvin/apply-manual-trigger into main

Reviewed-on: #48
ci: allow manual trigger of apply on main
2026-09-19 23:36:36 +10:00 · 2026-09-19 22:32:40 +10:00 · 2026-09-19 18:41:25 +10:00 · 2026-09-19 17:42:00 +10:00 · 2026-09-19 16:29:07 +10:00 · 2026-09-19 16:22:41 +10:00
9 changed files with 61 additions and 2 deletions
@@ -1,6 +1,8 @@
 when:
  - event: push
    branch: main
+  - event: manual
+    branch: main

 steps:
  - name: apply
@@ -21,7 +21,7 @@ init:

 plan: init
 	@$(call vault_env) && \
-	terragrunt run --all --parallelism 4 --non-interactive plan
+	terragrunt run --all --parallelism 4 --non-interactive plan -- -lock=false

 apply: init
 	@$(call vault_env) && \
@@ -0,0 +1,2 @@
+---
+description: "Jellyfin plugin zips built in-house (JPRM release archives published on tag)"
@@ -0,0 +1,2 @@
+---
+description: "Neovim plugin release archives (<plugin>-<version>.zip) installed by arti-pack"
@@ -3,6 +3,7 @@ description: GitHub Container Registry
 immutable_ttl: 0
 mutable_ttl: 300
 patterns:
+  - "^arabcoders/watchstate"
  - "^cloudnative-pg/"
  - "^dexidp/"
  - "^emberstack/helm-charts"
@@ -5,4 +5,5 @@ mutable_ttl: 300
 patterns:
  - "^autoscaling/vpa-"
  - "^external-dns/external-dns"
+  - "^kube-state-metrics/"
  - "^sig-storage/"
@@ -0,0 +1,6 @@
+base_url: https://git.unkin.net
+description: Internal Gitea unkin tag source archives
+immutable_ttl: 0
+mutable_ttl: 7200
+patterns:
+  - "^unkin/[^/]+/archive/refs/tags/[^/]+\\.zip$"
@@ -3,16 +3,53 @@ description: GitHub releases and files
 immutable_ttl: 0
 mutable_ttl: 7200
 mutable_patterns:
-  - ".*/archive/refs/heads/.*.tar.gz$"
+  # Branch archives of tagless Neovim plugins; a branch ref moves, so these
+  # revalidate on mutable_ttl instead of caching immutably.
+  - "^HampusHauffman/block\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-buffer/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-nvim-lsp/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-nvim-lsp-signature-help/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-nvim-lua/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-path/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-vsnip/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/vim-vsnip/archive/refs/heads/master\\.(zip|tar\\.gz)$"
+  - "^junegunn/gv\\.vim/archive/refs/heads/master\\.(zip|tar\\.gz)$"
+  - "^jvirtanen/vim-hcl/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^Mofiqul/dracula\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^numToStr/FTerm\\.nvim/archive/refs/heads/master\\.(zip|tar\\.gz)$"
+  - "^qvalentin/helm-ls\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^rafamadriz/friendly-snippets/archive/refs/heads/main\\.(zip|tar\\.gz)$"
  - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
  # iplocate IP databases (Git-LFS; the /raw/ path redirects to the LFS media host).
  - "iplocate/ip-address-databases/raw/.*/ip-to-asn/.*"
  - "iplocate/ip-address-databases/raw/.*/ip-to-country/.*"
 patterns:
+  # Branch archives of Neovim plugins that publish no tags. patterns is a
+  # strict allowlist checked before mutable_patterns, so each repo must be
+  # listed in both. Anchored per repo: matching is a substring search, so an
+  # unanchored entry would also admit evil/<owner>/<repo>/....
+  - "^HampusHauffman/block\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-buffer/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-nvim-lsp/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-nvim-lsp-signature-help/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-nvim-lua/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-path/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-vsnip/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/vim-vsnip/archive/refs/heads/master\\.(zip|tar\\.gz)$"
+  - "^junegunn/gv\\.vim/archive/refs/heads/master\\.(zip|tar\\.gz)$"
+  - "^jvirtanen/vim-hcl/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^Mofiqul/dracula\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^numToStr/FTerm\\.nvim/archive/refs/heads/master\\.(zip|tar\\.gz)$"
+  - "^qvalentin/helm-ls\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^rafamadriz/friendly-snippets/archive/refs/heads/main\\.(zip|tar\\.gz)$"
  - ".*/archive/refs/tags/.*.tar.gz$"
+  - ".*/archive/refs/tags/.*\\.zip$"
+  - "9p4/jellyfin-plugin-sso/.*/sso-authentication_.*.zip$"
  - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
  - "ahmetb/kubectx/.*/kubens_.*_linux_x86_64.tar.gz$"
  - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
+  - "argoproj/argo-cd/.*/argocd-linux-amd64$"
+  - "argoproj/argo-cd/.*/cli_checksums.txt$"
  - "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
  - "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
  - "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
@@ -33,6 +70,8 @@ patterns:
  - "iplocate/ip-address-databases/raw/.*/ip-to-asn/.*"
  - "iplocate/ip-address-databases/raw/.*/ip-to-country/.*"
  - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
+  - "JohnnyMorganz/StyLua/.*/stylua-linux-x86_64\\.zip$"
+  - "JohnnyMorganz/StyLua/.*/stylua-linux-x86_64-musl\\.zip$"
  - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
  - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
  - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
@@ -0,0 +1,6 @@
+base_url: https://repo.jellyfin.org
+description: Jellyfin official plugin repository
+immutable_ttl: 0
+mutable_ttl: 7200
+patterns:
+  - "files/plugin/ldap-authentication/ldap-authentication_.*.zip$"
Author	SHA1	Message	Date
benvin	b7e10718c3	Merge pull request 'ci: allow manual trigger of apply on main' (#48 ) from benvin/apply-manual-trigger into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #48	2026-09-19 23:36:36 +10:00
unkin-agent	0a245e7bca	ci: allow manual trigger of apply on main ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-09-19 22:32:40 +10:00
benvin	dc07c26c2e	Merge pull request 'feat: add jellyfin-plugins local generic repo' (#47 ) from benvin/jellyfin-plugins-local into main Reviewed-on: #47	2026-09-19 18:41:25 +10:00
unkin-agent	e8c09807ae	feat: add jellyfin-plugins local generic repo	2026-09-19 17:42:00 +10:00
benvin	f64b553e15	Merge pull request 'feat: allow argocd CLI release assets through the github remote' (#46 ) from benvin/argocd-cli-remote into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #46	2026-09-19 16:29:07 +10:00
unkin-agent	f0e63a091e	feat: allow argocd CLI release assets through the github remote ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-09-19 16:22:41 +10:00
benvin	03eb79f27b	Merge pull request 'Allow GitHub branch archives through the github remote' (#45 ) from benvin/github-branch-archives into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #45	2026-09-11 23:37:08 +10:00
unkin-agent	d7542d8fe2	Narrow GitHub branch archives to named repos ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details The wildcard heads entries admitted a branch archive from any repository on GitHub. patterns is the admission allowlist, so only the repos that need a branch install belong in it. - Replace the wildcard heads entries with one anchored entry per repo - Cover the 14 Neovim plugins that publish no tags, zip and tar.gz - List each repo in both patterns and mutable_patterns	2026-09-11 23:34:12 +10:00
unkin-agent	b76fddecb9	Allow GitHub branch archives through the github remote ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details patterns is a strict allowlist evaluated before mutable_patterns, so /archive/refs/heads/ downloads are denied despite the mutable entry. - Add heads .zip and .tar.gz to patterns - Add heads .zip to mutable_patterns and escape the tar.gz dots	2026-09-11 23:26:29 +10:00
benvin	9ef54c7338	Merge pull request 'Add gitea generic remote for internal tag archives' (#44 ) from benvin/gitea-generic-remote into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #44	2026-09-09 23:47:47 +10:00
unkin-agent	20838caa8f	Add gitea generic remote for internal tag archives ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details Proxy unkin tag source zips from git.unkin.net through artifactapi.	2026-09-09 23:32:31 +10:00
benvin	00a931ed35	Merge pull request 'Allow stylua linux release assets through the github remote' (#42 ) from benvin/stylua-release-asset into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #42	2026-09-09 22:36:12 +10:00
benvin	35c1fb2195	Merge pull request 'Add nvim-plugins local generic repo' (#43 ) from benvin/nvim-plugins-local-generic into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #43	2026-09-09 22:34:57 +10:00
unkin-agent	901aaf1f1f	Add nvim-plugins local generic repo ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details Receives Neovim plugin release archives for arti-pack installs.	2026-09-09 21:12:00 +10:00
unkin-agent	e7c4c76002	Allow stylua linux release assets through the github remote ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-09-09 21:05:06 +10:00
benvin	ad8d530687	Merge pull request 'Allow GitHub tag zip archives through the github remote' (#41 ) from benvin/github-tag-zips into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #41	2026-09-08 00:37:09 +10:00
unkin-agent	888e3e84ce	Allow GitHub tag zip archives through the github remote ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-09-07 23:49:10 +10:00
benvin	5a0c1fe814	Merge pull request 'Add artifactapi remotes for jellyfin-ha auth plugins' (#39 ) from benvin/jellyfin-plugin-remotes into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #39	2026-08-29 11:52:23 +10:00
unkin-agent	11c3059b05	Add artifactapi remotes for jellyfin-ha auth plugins ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details jellyfin-ha bakes the LDAP and SSO auth plugins into its image, and all outside artifacts must be fetched via artifactapi rather than direct. - Add remote_generic/jellyfin.yaml proxying repo.jellyfin.org, scoped to the ldap-authentication plugin zip. - Add a github.yaml pattern for 9p4/jellyfin-plugin-sso release zips (GitHub redirects release downloads to objects.githubusercontent.com, which the existing github remote already follows).	2026-08-26 23:23:27 +10:00
benvin	e7113bb0b3	Merge pull request 'Allow ghcr.io/arabcoders/watchstate via artifactapi' (#38 ) from benvin/ghcr-remote into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #38	2026-08-24 21:39:05 +10:00
unkin-agent	b776d16a9c	Narrow arabcoders allow-pattern to watchstate per review ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-08-24 21:37:30 +10:00
unkin-agent	5596088c57	Allow ghcr.io/arabcoders/watchstate via artifactapi ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details Add arabcoders pattern to ghcr remote to enable pulling watchstate image through artifactapi for media watch-state sync deployment.	2026-08-24 21:22:58 +10:00
benvin	4e141add6f	Merge pull request 'Run plan without acquiring the Consul state lock' (#37 ) from benvin/lockfree-plan into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #37	2026-08-23 22:31:48 +10:00
unkin-agent	1013d5a26b	Run plan without acquiring the Consul state lock ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details PR plan pipelines were failing with "Error acquiring the state lock" when they collided with a concurrent apply (or another plan) holding the lock on the same Consul-backed state. - plan: pass -lock=false to terragrunt plan; apply keeps locking	2026-08-23 22:21:06 +10:00
benvin	f160ded56f	Merge pull request 'Allow kube-state-metrics through the k8s-registry docker remote' (#36 ) from benvin/registry-k8s-io into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #36	2026-08-23 21:36:37 +10:00
unkin-agent	35b44f3956	Allow kube-state-metrics through the k8s-registry docker remote ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details	2026-08-23 21:32:05 +10:00