Merge pull request 'ci: allow manual trigger of apply on main' (#48 ) from benvin/apply-manual-trigger into main

Reviewed-on: #48
ci: allow manual trigger of apply on main
2026-09-19 23:36:36 +10:00 · 2026-09-19 22:32:40 +10:00 · 2026-09-19 18:41:25 +10:00 · 2026-09-19 17:42:00 +10:00 · 2026-09-19 16:29:07 +10:00 · 2026-09-19 16:22:41 +10:00
14 changed files with 76 additions and 3 deletions
@@ -1,6 +1,8 @@
 when:
  - event: push
    branch: main
+  - event: manual
+    branch: main

 steps:
  - name: apply
@@ -21,7 +21,7 @@ init:

 plan: init
 	@$(call vault_env) && \
-	terragrunt run --all --parallelism 4 --non-interactive plan
+	terragrunt run --all --parallelism 4 --non-interactive plan -- -lock=false

 apply: init
 	@$(call vault_env) && \
@@ -0,0 +1,2 @@
+---
+description: "Jellyfin plugin zips built in-house (JPRM release archives published on tag)"
@@ -0,0 +1,2 @@
+---
+description: "Neovim plugin release archives (<plugin>-<version>.zip) installed by arti-pack"
@@ -28,7 +28,9 @@ patterns:
  - "^jfrog/"
  - "^jpgouin/"
  - "^kanidm/"
+  - "^linuxserver/"
  - "^natsio/"
+  - "^oliver006/redis_exporter"
  - "^osixia/"
  - "^rancher/"
  - "^rspamd/rspamd"
@@ -3,6 +3,7 @@ description: GitHub Container Registry
 immutable_ttl: 0
 mutable_ttl: 300
 patterns:
+  - "^arabcoders/watchstate"
  - "^cloudnative-pg/"
  - "^dexidp/"
  - "^emberstack/helm-charts"
@@ -11,7 +12,9 @@ patterns:
  - "^goodtune/ghp"
  - "^home-operations/"
  - "^jellyfin/"
+  - "^k8up-io/"
  - "^netbox-community/"
+  - "^oauth2-proxy/"
  - "^onedr0p/"
  - "^open-webui/open-webui"
  - "^openvoxproject/"
@@ -19,5 +22,6 @@ patterns:
  - "^plexguide/"
  - "^stakater/reloader"
  - "^stalwartlabs/stalwart"
+  - "^valkey-io/"
  - "^voxpupuli/puppetboard"
  - "^woodpecker-ci/helm"
@@ -5,4 +5,5 @@ mutable_ttl: 300
 patterns:
  - "^autoscaling/vpa-"
  - "^external-dns/external-dns"
+  - "^kube-state-metrics/"
  - "^sig-storage/"
@@ -7,3 +7,4 @@ patterns:
  - "^brancz/kube-rbac-proxy"
  - "^cephcsi/cephcsi"
  - "^jetstack/cert-manager-"
+  - "^oauth2-proxy/"
@@ -0,0 +1,6 @@
+base_url: https://git.unkin.net
+description: Internal Gitea unkin tag source archives
+immutable_ttl: 0
+mutable_ttl: 7200
+patterns:
+  - "^unkin/[^/]+/archive/refs/tags/[^/]+\\.zip$"
@@ -3,16 +3,53 @@ description: GitHub releases and files
 immutable_ttl: 0
 mutable_ttl: 7200
 mutable_patterns:
-  - ".*/archive/refs/heads/.*.tar.gz$"
+  # Branch archives of tagless Neovim plugins; a branch ref moves, so these
+  # revalidate on mutable_ttl instead of caching immutably.
+  - "^HampusHauffman/block\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-buffer/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-nvim-lsp/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-nvim-lsp-signature-help/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-nvim-lua/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-path/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-vsnip/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/vim-vsnip/archive/refs/heads/master\\.(zip|tar\\.gz)$"
+  - "^junegunn/gv\\.vim/archive/refs/heads/master\\.(zip|tar\\.gz)$"
+  - "^jvirtanen/vim-hcl/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^Mofiqul/dracula\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^numToStr/FTerm\\.nvim/archive/refs/heads/master\\.(zip|tar\\.gz)$"
+  - "^qvalentin/helm-ls\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^rafamadriz/friendly-snippets/archive/refs/heads/main\\.(zip|tar\\.gz)$"
  - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
  # iplocate IP databases (Git-LFS; the /raw/ path redirects to the LFS media host).
  - "iplocate/ip-address-databases/raw/.*/ip-to-asn/.*"
  - "iplocate/ip-address-databases/raw/.*/ip-to-country/.*"
 patterns:
+  # Branch archives of Neovim plugins that publish no tags. patterns is a
+  # strict allowlist checked before mutable_patterns, so each repo must be
+  # listed in both. Anchored per repo: matching is a substring search, so an
+  # unanchored entry would also admit evil/<owner>/<repo>/....
+  - "^HampusHauffman/block\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-buffer/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-nvim-lsp/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-nvim-lsp-signature-help/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-nvim-lua/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-path/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/cmp-vsnip/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^hrsh7th/vim-vsnip/archive/refs/heads/master\\.(zip|tar\\.gz)$"
+  - "^junegunn/gv\\.vim/archive/refs/heads/master\\.(zip|tar\\.gz)$"
+  - "^jvirtanen/vim-hcl/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^Mofiqul/dracula\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^numToStr/FTerm\\.nvim/archive/refs/heads/master\\.(zip|tar\\.gz)$"
+  - "^qvalentin/helm-ls\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$"
+  - "^rafamadriz/friendly-snippets/archive/refs/heads/main\\.(zip|tar\\.gz)$"
  - ".*/archive/refs/tags/.*.tar.gz$"
+  - ".*/archive/refs/tags/.*\\.zip$"
+  - "9p4/jellyfin-plugin-sso/.*/sso-authentication_.*.zip$"
  - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
  - "ahmetb/kubectx/.*/kubens_.*_linux_x86_64.tar.gz$"
  - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
+  - "argoproj/argo-cd/.*/argocd-linux-amd64$"
+  - "argoproj/argo-cd/.*/cli_checksums.txt$"
  - "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
  - "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
  - "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
@@ -33,6 +70,8 @@ patterns:
  - "iplocate/ip-address-databases/raw/.*/ip-to-asn/.*"
  - "iplocate/ip-address-databases/raw/.*/ip-to-country/.*"
  - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
+  - "JohnnyMorganz/StyLua/.*/stylua-linux-x86_64\\.zip$"
+  - "JohnnyMorganz/StyLua/.*/stylua-linux-x86_64-musl\\.zip$"
  - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
  - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
  - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
@@ -0,0 +1,6 @@
+base_url: https://repo.jellyfin.org
+description: Jellyfin official plugin repository
+immutable_ttl: 0
+mutable_ttl: 7200
+patterns:
+  - "files/plugin/ldap-authentication/ldap-authentication_.*.zip$"
@@ -0,0 +1,7 @@
+base_url: https://valkey.io/valkey-helm
+description: Valkey Helm charts (valkey-operator)
+immutable_ttl: 0
+mutable_ttl: 3600
+check_mutable: true
+immutable_patterns:
+  - "\\.tgz$"
@@ -1,4 +1,4 @@
-base_url: https://syd.mirror.rackspace.com/fedora
+base_url: https://gsl-syd.mm.fcix.net/fedora/linux
 description: Fedora Linux RPM package repository
 immutable_ttl: 0
 mutable_ttl: 7200
@@ -15,5 +15,6 @@ members:
  - rancher-stable
  - stakater
  - traefik
+  - valkey
  - victoriametrics
  - argo-helm
Author	SHA1	Message	Date
benvin	b7e10718c3	Merge pull request 'ci: allow manual trigger of apply on main' (#48 ) from benvin/apply-manual-trigger into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #48	2026-09-19 23:36:36 +10:00
unkin-agent	0a245e7bca	ci: allow manual trigger of apply on main ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-09-19 22:32:40 +10:00
benvin	dc07c26c2e	Merge pull request 'feat: add jellyfin-plugins local generic repo' (#47 ) from benvin/jellyfin-plugins-local into main Reviewed-on: #47	2026-09-19 18:41:25 +10:00
unkin-agent	e8c09807ae	feat: add jellyfin-plugins local generic repo	2026-09-19 17:42:00 +10:00
benvin	f64b553e15	Merge pull request 'feat: allow argocd CLI release assets through the github remote' (#46 ) from benvin/argocd-cli-remote into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #46	2026-09-19 16:29:07 +10:00
unkin-agent	f0e63a091e	feat: allow argocd CLI release assets through the github remote ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-09-19 16:22:41 +10:00
benvin	03eb79f27b	Merge pull request 'Allow GitHub branch archives through the github remote' (#45 ) from benvin/github-branch-archives into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #45	2026-09-11 23:37:08 +10:00
unkin-agent	d7542d8fe2	Narrow GitHub branch archives to named repos ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details The wildcard heads entries admitted a branch archive from any repository on GitHub. patterns is the admission allowlist, so only the repos that need a branch install belong in it. - Replace the wildcard heads entries with one anchored entry per repo - Cover the 14 Neovim plugins that publish no tags, zip and tar.gz - List each repo in both patterns and mutable_patterns	2026-09-11 23:34:12 +10:00
unkin-agent	b76fddecb9	Allow GitHub branch archives through the github remote ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details patterns is a strict allowlist evaluated before mutable_patterns, so /archive/refs/heads/ downloads are denied despite the mutable entry. - Add heads .zip and .tar.gz to patterns - Add heads .zip to mutable_patterns and escape the tar.gz dots	2026-09-11 23:26:29 +10:00
benvin	9ef54c7338	Merge pull request 'Add gitea generic remote for internal tag archives' (#44 ) from benvin/gitea-generic-remote into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #44	2026-09-09 23:47:47 +10:00
unkin-agent	20838caa8f	Add gitea generic remote for internal tag archives ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details Proxy unkin tag source zips from git.unkin.net through artifactapi.	2026-09-09 23:32:31 +10:00
benvin	00a931ed35	Merge pull request 'Allow stylua linux release assets through the github remote' (#42 ) from benvin/stylua-release-asset into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #42	2026-09-09 22:36:12 +10:00
benvin	35c1fb2195	Merge pull request 'Add nvim-plugins local generic repo' (#43 ) from benvin/nvim-plugins-local-generic into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #43	2026-09-09 22:34:57 +10:00
unkin-agent	901aaf1f1f	Add nvim-plugins local generic repo ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details Receives Neovim plugin release archives for arti-pack installs.	2026-09-09 21:12:00 +10:00
unkin-agent	e7c4c76002	Allow stylua linux release assets through the github remote ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-09-09 21:05:06 +10:00
benvin	ad8d530687	Merge pull request 'Allow GitHub tag zip archives through the github remote' (#41 ) from benvin/github-tag-zips into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #41	2026-09-08 00:37:09 +10:00
unkin-agent	888e3e84ce	Allow GitHub tag zip archives through the github remote ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-09-07 23:49:10 +10:00
benvin	5a0c1fe814	Merge pull request 'Add artifactapi remotes for jellyfin-ha auth plugins' (#39 ) from benvin/jellyfin-plugin-remotes into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #39	2026-08-29 11:52:23 +10:00
unkin-agent	11c3059b05	Add artifactapi remotes for jellyfin-ha auth plugins ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details jellyfin-ha bakes the LDAP and SSO auth plugins into its image, and all outside artifacts must be fetched via artifactapi rather than direct. - Add remote_generic/jellyfin.yaml proxying repo.jellyfin.org, scoped to the ldap-authentication plugin zip. - Add a github.yaml pattern for 9p4/jellyfin-plugin-sso release zips (GitHub redirects release downloads to objects.githubusercontent.com, which the existing github remote already follows).	2026-08-26 23:23:27 +10:00
benvin	e7113bb0b3	Merge pull request 'Allow ghcr.io/arabcoders/watchstate via artifactapi' (#38 ) from benvin/ghcr-remote into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #38	2026-08-24 21:39:05 +10:00
unkin-agent	b776d16a9c	Narrow arabcoders allow-pattern to watchstate per review ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-08-24 21:37:30 +10:00
unkin-agent	5596088c57	Allow ghcr.io/arabcoders/watchstate via artifactapi ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details Add arabcoders pattern to ghcr remote to enable pulling watchstate image through artifactapi for media watch-state sync deployment.	2026-08-24 21:22:58 +10:00
benvin	4e141add6f	Merge pull request 'Run plan without acquiring the Consul state lock' (#37 ) from benvin/lockfree-plan into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #37	2026-08-23 22:31:48 +10:00
unkin-agent	1013d5a26b	Run plan without acquiring the Consul state lock ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details PR plan pipelines were failing with "Error acquiring the state lock" when they collided with a concurrent apply (or another plan) holding the lock on the same Consul-backed state. - plan: pass -lock=false to terragrunt plan; apply keeps locking	2026-08-23 22:21:06 +10:00
benvin	f160ded56f	Merge pull request 'Allow kube-state-metrics through the k8s-registry docker remote' (#36 ) from benvin/registry-k8s-io into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #36	2026-08-23 21:36:37 +10:00
unkin-agent	35b44f3956	Allow kube-state-metrics through the k8s-registry docker remote ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details	2026-08-23 21:32:05 +10:00
benvin	212a82539c	Merge pull request 'quay remote: allowlist oauth2-proxy images' (#35 ) from benvin/quay-oauth2-proxy into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #35	2026-08-17 21:30:39 +10:00
unkin-agent	62c8307c08	quay remote: allowlist oauth2-proxy images ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details Adds the ^oauth2-proxy/ pattern to the quay.io remote so the artifactapi caching proxy will serve quay.io/oauth2-proxy/oauth2-proxy. Needed so the arrproxy oauth2-proxy sidecar can pull the real upstream quay.io address via the rke2 registries.yaml mirror.	2026-08-17 20:43:43 +10:00
benvin	8ddfc99e00	Merge pull request 'ghcr: allowlist oauth2-proxy for the arrproxy sidecar' (#34 ) from benvin/oauth2-proxy-image into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #34	2026-08-16 17:37:11 +10:00
unkin-agent	f68de9283b	ghcr: allowlist oauth2-proxy for the arrproxy sidecar ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-08-16 16:25:43 +10:00
benvin	96555885be	Merge pull request 'fix(fedora): repoint remote to gsl-syd (rackspace dropped F44)' (#32 ) from benvin/fedora-mirror-fcix into main ci/woodpecker/push/apply Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details Reviewed-on: #32	2026-08-15 15:34:49 +10:00
unkin-agent	8e88642bfa	fix(fedora): repoint remote to gsl-syd (rackspace dropped F44) ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details Rackspace (syd.mirror.rackspace.com) never synced Fedora 44: it serves releases/43 but 404s on releases/44/.../repomd.xml, breaking dnf makecache for F44 through the caching proxy. Repoint to gsl-syd.mm.fcix.net, a Sydney-local FCIX tier-1 mirror that is fully synced for F44 (releases + updates + Packages, verified 200, ~25ms), using the standard /fedora/linux layout root.	2026-08-15 15:25:13 +10:00
benvin	770c489e40	Merge pull request 'dockerhub: allowlist linuxserver images for arrstack' (#31 ) from benvin/media-arr-images into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #31	2026-08-15 13:21:23 +10:00
unkin-agent	b4670ea796	dockerhub: allowlist linuxserver images for arrstack ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-08-15 13:12:48 +10:00
benvin	baba4ba26e	Merge pull request 'ghcr: allow k8up-io images through the docker remote' (#30 ) from benvin/k8up-images into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #30	2026-08-15 12:30:25 +10:00
benvin	05e8903207	Merge pull request 'Add valkey-operator artifactapi remotes' (#29 ) from benvin/valkey-operator-artifactapi into main ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #29	2026-08-15 12:13:03 +10:00
unkin-agent	01a09a229a	ghcr: allow k8up-io images through the docker remote ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details The k8up operator (deployed via the k8up-system app) and its restic backup/prune/check jobs both run ghcr.io/k8up-io/k8up, which the containerd mirror only serves when the image path is allowlisted. - Add ^k8up-io/ to the ghcr remote patterns	2026-08-15 12:09:28 +10:00
unkin-agent	5b6af846b8	Add valkey-operator artifactapi remotes ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details Adds a valkey helm remote and allowlists the operator/exporter images so the valkey-operator install in argocd-apps resolves everything through artifactapi. - Add config/remote_helm/valkey.yaml proxying https://valkey.io/valkey-helm - Add valkey to the virtual/helm member list - Allow ^valkey-io/ on the ghcr remote (operator image ghcr.io/valkey-io/valkey-operator) - Allow ^oliver006/redis_exporter on dockerhub (Valkey metrics exporter)	2026-08-15 12:06:00 +10:00