From 2414810a2f5ff106299fae10be337b1a6d95ce76 Mon Sep 17 00:00:00 2001 From: Jonas Arnfred Date: Thu, 2 Jul 2026 09:57:41 +0100 Subject: [PATCH 1/2] fix(ci): bootstrap pipeline with upstream plugin; remove privileged mode Co-Authored-By: Claude Sonnet 4.6 --- .woodpecker.yml | 31 ++++++++++++------------------- 1 file changed, 12 insertions(+), 19 deletions(-) diff --git a/.woodpecker.yml b/.woodpecker.yml index 5ede244..0a62be2 100644 --- a/.woodpecker.yml +++ b/.woodpecker.yml @@ -1,32 +1,25 @@ -# Triggers: -# - push to main → runs test-build, then publishes (see the publish step) -# - pull_request → runs test-build only (dry-run, no push) -# - manual (UI) → runs test-build only, on any branch when: - event: push branch: main - - event: pull_request - - event: manual steps: - # Dogfood build: compile and run inside our own published image to prove it - # actually works — not just that it compiles. dry-run + single-arch means a - # real build with no push. Runs on every trigger (push, pull_request, manual). - test-build: - image: gowerstreet/plugin-docker-buildx - privileged: true + # Build an amd64 staging image using the upstream plugin (woodpeckerci/plugin-docker-buildx + # has amd64 support). Pushes to a staging tag so the next step can pull and verify it. + build-staging: + image: woodpeckerci/plugin-docker-buildx settings: repo: gowerstreet/plugin-docker-buildx - dry-run: true + tags: staging-${CI_PIPELINE_NUMBER} platforms: linux/amd64 - auto_cache: false + username: + from_secret: docker_username + password: + from_secret: docker_password - # Publish multi-arch. Self-hosted: uses the previous `latest` to build and push - # the next one, keeping `latest` correct going forward. Only on pushes to main, - # and only if test-build succeeded. + # Use the freshly built staging image as the plugin to publish with final tags. + # This verifies the new image functions correctly as a plugin before it becomes :latest. publish: - image: gowerstreet/plugin-docker-buildx - privileged: true + image: gowerstreet/plugin-docker-buildx:staging-${CI_PIPELINE_NUMBER} settings: repo: gowerstreet/plugin-docker-buildx username: From f6a4c2a95d454e5fd9ece3e5c3e7ad1587eaec49 Mon Sep 17 00:00:00 2001 From: Jonas Arnfred Date: Thu, 2 Jul 2026 12:38:40 +0100 Subject: [PATCH 2/2] fix(ci): use gowerstreet fork for both steps now that amd64 image exists --- .woodpecker.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.woodpecker.yml b/.woodpecker.yml index 0a62be2..7b9fc0b 100644 --- a/.woodpecker.yml +++ b/.woodpecker.yml @@ -3,10 +3,10 @@ when: branch: main steps: - # Build an amd64 staging image using the upstream plugin (woodpeckerci/plugin-docker-buildx - # has amd64 support). Pushes to a staging tag so the next step can pull and verify it. + # Build an amd64 staging image using our fork. Pushes to a staging tag so the next + # step can pull and verify it works correctly as a plugin before promoting to :latest. build-staging: - image: woodpeckerci/plugin-docker-buildx + image: gowerstreet/plugin-docker-buildx settings: repo: gowerstreet/plugin-docker-buildx tags: staging-${CI_PIPELINE_NUMBER}