ci: move Go steps to gobuilder, enable S3 build cache

Standardizes on the estate gobuilder image for every step invoking
the Go toolchain and wires in the shared S3-backed GOCACHEPROG.

- Replace golang:1.25 and almalinux9-gobuilder:20260606 with
  gobuilder:0.1.2-alma9 in build/test/pre-commit/release(build)
- Add GOCACHE_* env + AWS creds from org secrets to those steps
- Bump their k8s resource requests/limits for compile+cache overhead

.woodpecker/build.yml

@@ -3,6 +3,28 @@ when:
 
 steps:
   - name: build
-    image: golang:1.25
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - make build
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-vault-plugin-secrets-litellm
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 3Gi
+            cpu: 2

.woodpecker/pre-commit.yaml

@@ -3,16 +3,28 @@ when:
 
 steps:
   - name: pre-commit
-    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - uvx pre-commit run --all-files
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-vault-plugin-secrets-litellm
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     backend_options:
       kubernetes:
         serviceAccountName: default
         resources:
           requests:
-            memory: 512Mi
+            memory: 1Gi
             cpu: 1
           limits:
-            memory: 2Gi
+            memory: 3Gi
             cpu: 2

.woodpecker/release.yml

@@ -3,15 +3,47 @@ when:
 
 steps:
   - name: build
-    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - make build VERSION=${CI_COMMIT_TAG}
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-vault-plugin-secrets-litellm
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 3Gi
+            cpu: 2
 
   - name: package
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - ./scripts/build-rpm.sh ${CI_COMMIT_TAG}
     depends_on: [build]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
 
   - name: upload
     image: git.unkin.net/unkin/almalinux9-base:20260606
@@ -36,3 +68,13 @@ steps:
             --data-binary @"$$rpm"
         done
     depends_on: [package]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m

.woodpecker/test.yml

@@ -3,11 +3,55 @@ when:
 
 steps:
   - name: lint
-    image: golang:1.25
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - make lint
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-vault-plugin-secrets-litellm
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 3Gi
+            cpu: 2
 
   - name: test
-    image: golang:1.25
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9
     commands:
       - make test
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-vault-plugin-secrets-litellm
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 3Gi
+            cpu: 2

packaging/nfpm.yaml

@@ -1,6 +1,8 @@
 ---
 # nfpm config for building the vault-plugin-secrets-litellm RPM.
 # Rendered through envsubst (see scripts/build-rpm.sh) then fed to `nfpm pkg`.
+# Built once per target server (Vault, OpenBao); PACKAGE_NAME and
+# PACKAGE_PLUGIN_DIR vary per flavour.
 
 name: ${PACKAGE_NAME}
 version: ${PACKAGE_VERSION}
@@ -18,19 +20,19 @@ license: ${PACKAGE_LICENSE}
 disable_globbing: false
 
 replaces:
-  - vault-plugin-secrets-litellm
+  - ${PACKAGE_NAME}
 provides:
-  - vault-plugin-secrets-litellm
+  - ${PACKAGE_NAME}
 
-# Install the plugin binary into the Vault/OpenBao plugin directory. Point the
+# Install the plugin binary into the server's plugin directory. Point the
-# server's plugin_directory at /opt/vault-plugins to pick it up.
+# server's plugin_directory at PACKAGE_PLUGIN_DIR to pick it up.
 contents:
   - src: dist/vault-plugin-secrets-litellm
-    dst: /opt/vault-plugins/vault-plugin-secrets-litellm
+    dst: ${PACKAGE_PLUGIN_DIR}/vault-plugin-secrets-litellm
     file_info:
       mode: 0755
       owner: root
       group: root
 
 scripts:
-  preinstall: packaging/scripts/preinstall.sh
+  preinstall: ${PACKAGE_PREINSTALL}

packaging/scripts/preinstall.sh

@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-# Ensure the plugin directory exists before the binary is laid down.
-mkdir -p /opt/vault-plugins

packaging/scripts/preinstall.sh.tmpl

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# Ensure the plugin directory exists before the binary is laid down.
+# Rendered per flavour via envsubst (see scripts/build-rpm.sh).
+mkdir -p ${PACKAGE_PLUGIN_DIR}

scripts/build-rpm.sh

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 #
-# Package the (already built) plugin binary into an RPM with nfpm.
+# Package the (already built) plugin binary into RPMs with nfpm.
+# Builds one RPM per target server: Vault (/opt/vault-plugins) and
+# OpenBao (/opt/openbao-plugins). Both wrap the same binary.
 # Usage: scripts/build-rpm.sh [version]   (version defaults to $CI_COMMIT_TAG)
 #
 set -euo pipefail
@@ -18,7 +20,7 @@ if [ ! -f "${DIST}/${BINARY}" ]; then
   exit 1
 fi
 
-export PACKAGE_NAME="${BINARY}"
+# Fields shared across every flavour.
 export PACKAGE_VERSION="${VERSION}"
 export PACKAGE_RELEASE="1"
 export PACKAGE_ARCH="amd64"
@@ -28,8 +30,20 @@ export PACKAGE_MAINTAINER="Ben Vincent <ben@unkin.net>"
 export PACKAGE_HOMEPAGE="https://git.unkin.net/unkin/vault-plugin-secrets-litellm"
 export PACKAGE_LICENSE="MIT"
 
-envsubst < packaging/nfpm.yaml > "${DIST}/nfpm.yaml"
+# build_flavor <package-name> <plugin-dir>
-nfpm pkg --config "${DIST}/nfpm.yaml" --target "${DIST}" --packager rpm
+build_flavor() {
+  export PACKAGE_NAME="$1"
+  export PACKAGE_PLUGIN_DIR="$2"
+  export PACKAGE_PREINSTALL="${DIST}/preinstall-${PACKAGE_NAME}.sh"
+
+  envsubst '${PACKAGE_PLUGIN_DIR}' \
+    < packaging/scripts/preinstall.sh.tmpl > "${PACKAGE_PREINSTALL}"
+  envsubst < packaging/nfpm.yaml > "${DIST}/nfpm-${PACKAGE_NAME}.yaml"
+  nfpm pkg --config "${DIST}/nfpm-${PACKAGE_NAME}.yaml" --target "${DIST}" --packager rpm
+}
+
+build_flavor "vault-plugin-secrets-litellm"   "/opt/vault-plugins"
+build_flavor "openbao-plugin-secrets-litellm" "/opt/openbao-plugins"
 
 echo "Built:"
 ls -1 "${DIST}"/*.rpm