feat(github): allowlist jellyfin-plugin-sso release assets

jellyfin-ha bakes the SSO auth plugin at image build time, but the CI build network cannot reach github directly. Route it through the artifactapi github proxy by allowlisting the SSO plugin release asset.
Merge pull request 'Allow ghcr.io/arabcoders/watchstate via artifactapi' (#38 ) from benvin/ghcr-remote into main
2026-08-26 23:32:07 +10:00 · 2026-08-24 21:39:05 +10:00 · 2026-08-24 21:37:30 +10:00 · 2026-08-24 21:22:58 +10:00 · 2026-08-23 22:31:48 +10:00 · 2026-08-23 22:21:06 +10:00
5 changed files with 6 additions and 1 deletions
@@ -21,7 +21,7 @@ init:

 plan: init
 	@$(call vault_env) && \
-	terragrunt run --all --parallelism 4 --non-interactive plan
+	terragrunt run --all --parallelism 4 --non-interactive plan -- -lock=false

 apply: init
 	@$(call vault_env) && \
@@ -3,6 +3,7 @@ description: GitHub Container Registry
 immutable_ttl: 0
 mutable_ttl: 300
 patterns:
+  - "^arabcoders/watchstate"
  - "^cloudnative-pg/"
  - "^dexidp/"
  - "^emberstack/helm-charts"
@@ -13,6 +14,7 @@ patterns:
  - "^jellyfin/"
  - "^k8up-io/"
  - "^netbox-community/"
+  - "^oauth2-proxy/"
  - "^onedr0p/"
  - "^open-webui/open-webui"
  - "^openvoxproject/"
@@ -5,4 +5,5 @@ mutable_ttl: 300
 patterns:
  - "^autoscaling/vpa-"
  - "^external-dns/external-dns"
+  - "^kube-state-metrics/"
  - "^sig-storage/"
@@ -7,3 +7,4 @@ patterns:
  - "^brancz/kube-rbac-proxy"
  - "^cephcsi/cephcsi"
  - "^jetstack/cert-manager-"
+  - "^oauth2-proxy/"
@@ -10,6 +10,7 @@ mutable_patterns:
  - "iplocate/ip-address-databases/raw/.*/ip-to-country/.*"
 patterns:
  - ".*/archive/refs/tags/.*.tar.gz$"
+  - "9p4/jellyfin-plugin-sso/.*/sso-authentication_.*.zip$"
  - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
  - "ahmetb/kubectx/.*/kubens_.*_linux_x86_64.tar.gz$"
  - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
Author	SHA1	Message	Date
unkin-agent	bc6d2b218d	feat(github): allowlist jellyfin-plugin-sso release assets ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details jellyfin-ha bakes the SSO auth plugin at image build time, but the CI build network cannot reach github directly. Route it through the artifactapi github proxy by allowlisting the SSO plugin release asset.	2026-08-26 23:32:07 +10:00
benvin	e7113bb0b3	Merge pull request 'Allow ghcr.io/arabcoders/watchstate via artifactapi' (#38 ) from benvin/ghcr-remote into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #38	2026-08-24 21:39:05 +10:00
unkin-agent	b776d16a9c	Narrow arabcoders allow-pattern to watchstate per review ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-08-24 21:37:30 +10:00
unkin-agent	5596088c57	Allow ghcr.io/arabcoders/watchstate via artifactapi ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details Add arabcoders pattern to ghcr remote to enable pulling watchstate image through artifactapi for media watch-state sync deployment.	2026-08-24 21:22:58 +10:00
benvin	4e141add6f	Merge pull request 'Run plan without acquiring the Consul state lock' (#37 ) from benvin/lockfree-plan into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #37	2026-08-23 22:31:48 +10:00
unkin-agent	1013d5a26b	Run plan without acquiring the Consul state lock ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details PR plan pipelines were failing with "Error acquiring the state lock" when they collided with a concurrent apply (or another plan) holding the lock on the same Consul-backed state. - plan: pass -lock=false to terragrunt plan; apply keeps locking	2026-08-23 22:21:06 +10:00
benvin	f160ded56f	Merge pull request 'Allow kube-state-metrics through the k8s-registry docker remote' (#36 ) from benvin/registry-k8s-io into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #36	2026-08-23 21:36:37 +10:00
unkin-agent	35b44f3956	Allow kube-state-metrics through the k8s-registry docker remote ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details	2026-08-23 21:32:05 +10:00
benvin	212a82539c	Merge pull request 'quay remote: allowlist oauth2-proxy images' (#35 ) from benvin/quay-oauth2-proxy into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #35	2026-08-17 21:30:39 +10:00
unkin-agent	62c8307c08	quay remote: allowlist oauth2-proxy images ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details Adds the ^oauth2-proxy/ pattern to the quay.io remote so the artifactapi caching proxy will serve quay.io/oauth2-proxy/oauth2-proxy. Needed so the arrproxy oauth2-proxy sidecar can pull the real upstream quay.io address via the rke2 registries.yaml mirror.	2026-08-17 20:43:43 +10:00
benvin	8ddfc99e00	Merge pull request 'ghcr: allowlist oauth2-proxy for the arrproxy sidecar' (#34 ) from benvin/oauth2-proxy-image into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #34	2026-08-16 17:37:11 +10:00
unkin-agent	f68de9283b	ghcr: allowlist oauth2-proxy for the arrproxy sidecar ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-08-16 16:25:43 +10:00