From ce86f7dc7f6e41b108585e282533a4545c2d4b72 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Fri, 28 Aug 2026 10:07:10 +0200 Subject: [PATCH] fix(ci): dispatch the remaining pipelines by deploy target MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rolls the security-scan pilot out to the other thirteen. Every workflow-root gate of the form - event: manual evaluate: 'PIPELINE == "x"' becomes - event: deployment evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "x"' The target rides in pipeline metadata rather than in the manual-run variable map, so it reaches the workflow-root filter on Woodpecker 3.18 where PIPELINE does not. Verified on the pilot: pipeline 7004 selected the security-scan workflow and nothing else. Two files also carry step-level manual gates, and those had to move with the root or the pipelines would have converted into something that runs but cannot do its job: deploy-infrastructure the apply step gates on TOFU_APPLY. Left on `event: manual` it would never fire again, so the pipeline would plan and silently never apply. TOFU_APPLY now arrives via `--param`, which lands in the same non-plugin environment step-level `when` evaluates against. No step here is a plugin — nothing in .woodpecker uses `settings:` — so that path holds. build-ci-images eight per-image steps gate on manual-or-push to decide whether to rebuild. All eight follow the root. Cron gates are untouched. They already matched by name everywhere except security-scan, which the pilot fixed. Also corrects the trigger documentation, including a claim in update-audit.yml that the other pipelines gate on "an injected PIPELINE var set at cron-create time in the UI". Crons cannot carry variables at all — `repo cron add` takes name, branch, schedule and enabled. That sentence described a mechanism that never existed and was the same misunderstanding that left the daily security scan silently not running. The `timeout: 30` lint warning on the four deploy-* files predates this and is left alone. --- .woodpecker/alert-monitor.yml | 8 ++++---- .woodpecker/build-ci-images.yml | 20 +++++++++---------- .woodpecker/ci-claude-refresh.yml | 8 ++++---- .woodpecker/deploy-claude-workstation.yml | 4 ++-- .woodpecker/deploy-infrastructure.yml | 6 +++--- .woodpecker/deploy-netbird-client.yml | 4 ++-- .woodpecker/deploy-netbird-proxy.yml | 4 ++-- .woodpecker/deploy-netbird-server.yml | 4 ++-- .woodpecker/e2e-test.yml | 4 ++-- .woodpecker/e2e.yml | 7 ++++--- .woodpecker/install-garage-synology.yml | 4 ++-- .woodpecker/issue-fix.yml | 8 ++++---- .woodpecker/pr-review.yml | 6 +++--- .woodpecker/update-audit.yml | 16 +++++++-------- .../apps/woodpecker/MIGRATION-namespace.md | 2 +- 15 files changed, 53 insertions(+), 52 deletions(-) diff --git a/.woodpecker/alert-monitor.yml b/.woodpecker/alert-monitor.yml index a961940d..01e6abce 100644 --- a/.woodpecker/alert-monitor.yml +++ b/.woodpecker/alert-monitor.yml @@ -32,13 +32,13 @@ # mechanism as update-audit.yml): # woodpecker repo cron add --repo k.renner/homelab \ # --name alert-monitor --branch master --schedule '*/15 * * * *' -# - manual : woodpecker pipeline create --branch master \ -# --var PIPELINE=alert-monitor k.renner/homelab +# - deploy : woodpecker-cli pipeline deploy k.renner/homelab alert-monitor +# where is an existing pipeline to promote. when: - event: cron cron: alert-monitor - - event: manual - evaluate: 'PIPELINE == "alert-monitor"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "alert-monitor"' steps: - name: fetch-alerts diff --git a/.woodpecker/build-ci-images.yml b/.woodpecker/build-ci-images.yml index 45025530..e6a990ae 100644 --- a/.woodpecker/build-ci-images.yml +++ b/.woodpecker/build-ci-images.yml @@ -31,8 +31,8 @@ when: - "ci/images/**" - "secret-rotator/**" - ".woodpecker/build-ci-images.yml" - - event: manual - evaluate: 'PIPELINE == "build-ci-images"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "build-ci-images"' steps: - name: build-ansible @@ -44,7 +44,7 @@ steps: # secret-rotator commit needlessly rebuilt all four ~1.3G ci-* images and # orphaned ~5G of registry layers per run — a main driver of #336. when: - - event: manual + - event: deployment - event: push path: ["ci/images/ansible/**", ".woodpecker/build-ci-images.yml"] environment: @@ -68,7 +68,7 @@ steps: directory: ci/images/k8s depends_on: [] when: - - event: manual + - event: deployment - event: push path: ["ci/images/k8s/**", ".woodpecker/build-ci-images.yml"] environment: @@ -92,7 +92,7 @@ steps: directory: ci/images/tofu depends_on: [] when: - - event: manual + - event: deployment - event: push path: ["ci/images/tofu/**", ".woodpecker/build-ci-images.yml"] environment: @@ -123,7 +123,7 @@ steps: directory: secret-rotator depends_on: [] when: - - event: manual + - event: deployment - event: push path: ["secret-rotator/**", ".woodpecker/build-ci-images.yml"] environment: @@ -152,7 +152,7 @@ steps: directory: ci/images/alpine-jq depends_on: [] when: - - event: manual + - event: deployment - event: push path: ["ci/images/alpine-jq/**", ".woodpecker/build-ci-images.yml"] environment: @@ -181,7 +181,7 @@ steps: directory: ci/images/cni-plugins depends_on: [] when: - - event: manual + - event: deployment - event: push path: ["ci/images/cni-plugins/**", ".woodpecker/build-ci-images.yml"] environment: @@ -210,7 +210,7 @@ steps: directory: ci/images/alpine-openssl depends_on: [] when: - - event: manual + - event: deployment - event: push path: ["ci/images/alpine-openssl/**", ".woodpecker/build-ci-images.yml"] environment: @@ -239,7 +239,7 @@ steps: directory: ci/images/heating-can depends_on: [] when: - - event: manual + - event: deployment - event: push path: ["ci/images/heating-can/**", ".woodpecker/build-ci-images.yml"] environment: diff --git a/.woodpecker/ci-claude-refresh.yml b/.woodpecker/ci-claude-refresh.yml index 3cd246f8..092e41ce 100644 --- a/.woodpecker/ci-claude-refresh.yml +++ b/.woodpecker/ci-claude-refresh.yml @@ -54,8 +54,8 @@ # # Triggering: # - cron : the cron NAMED exactly "ci-claude-refresh" (see above). -# - manual : woodpecker pipeline create --branch master \ -# --var PIPELINE=ci-claude-refresh k.renner/homelab +# - deploy : woodpecker-cli pipeline deploy k.renner/homelab ci-claude-refresh +# where is an existing pipeline to promote. # - push : a change to the Containerfile (or this file) ON master forces a # rebuild of the current latest version so Containerfile fixes ship # promptly. Restricted to master ON PURPOSE — a feature branch must @@ -65,8 +65,8 @@ when: - event: cron cron: ci-claude-refresh - - event: manual - evaluate: 'PIPELINE == "ci-claude-refresh"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "ci-claude-refresh"' - event: push branch: master path: diff --git a/.woodpecker/deploy-claude-workstation.yml b/.woodpecker/deploy-claude-workstation.yml index e39ce7ba..0e577512 100644 --- a/.woodpecker/deploy-claude-workstation.yml +++ b/.woodpecker/deploy-claude-workstation.yml @@ -6,8 +6,8 @@ when: - "ansible/roles/claude-workstation/**" - "ansible/plays/install-claude-workstation.yml" - ".woodpecker/deploy-claude-workstation.yml" - - event: manual - evaluate: 'PIPELINE == "deploy-claude-workstation"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-claude-workstation"' timeout: 30 diff --git a/.woodpecker/deploy-infrastructure.yml b/.woodpecker/deploy-infrastructure.yml index 1467fcfe..e0d35db0 100644 --- a/.woodpecker/deploy-infrastructure.yml +++ b/.woodpecker/deploy-infrastructure.yml @@ -8,8 +8,8 @@ when: path: - "opentofu/**" - ".woodpecker/deploy-infrastructure.yml" - - event: manual - evaluate: 'PIPELINE == "deploy-infrastructure"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-infrastructure"' steps: - name: validate-secrets @@ -84,7 +84,7 @@ steps: image: gitea.renner.uno/gitea_admin/ci-tofu:2026-04-29 directory: opentofu when: - - event: manual + - event: deployment evaluate: 'TOFU_APPLY == "true"' environment: TF_IN_AUTOMATION: "true" diff --git a/.woodpecker/deploy-netbird-client.yml b/.woodpecker/deploy-netbird-client.yml index e87aaaf5..a33fd357 100644 --- a/.woodpecker/deploy-netbird-client.yml +++ b/.woodpecker/deploy-netbird-client.yml @@ -7,8 +7,8 @@ when: - "ansible/plays/install-netbird-client.yml" - "ansible/inventory/group_vars/claude_workstation/**" - ".woodpecker/deploy-netbird-client.yml" - - event: manual - evaluate: 'PIPELINE == "deploy-netbird-client"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-client"' timeout: 30 diff --git a/.woodpecker/deploy-netbird-proxy.yml b/.woodpecker/deploy-netbird-proxy.yml index cbe04532..f41be67c 100644 --- a/.woodpecker/deploy-netbird-proxy.yml +++ b/.woodpecker/deploy-netbird-proxy.yml @@ -9,8 +9,8 @@ when: - "ansible/roles/netbird-proxy-watchdog/**" - "ansible/plays/install-netbird-proxy.yml" - ".woodpecker/deploy-netbird-proxy.yml" - - event: manual - evaluate: 'PIPELINE == "deploy-netbird-proxy"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-proxy"' timeout: 30 diff --git a/.woodpecker/deploy-netbird-server.yml b/.woodpecker/deploy-netbird-server.yml index b7e9a6cc..57409a26 100644 --- a/.woodpecker/deploy-netbird-server.yml +++ b/.woodpecker/deploy-netbird-server.yml @@ -9,8 +9,8 @@ when: - "ansible/roles/netbird-proxy-watchdog/**" - "ansible/plays/install-netbird-server.yml" - ".woodpecker/deploy-netbird-server.yml" - - event: manual - evaluate: 'PIPELINE == "deploy-netbird-server"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-server"' timeout: 30 diff --git a/.woodpecker/e2e-test.yml b/.woodpecker/e2e-test.yml index 1842b15a..11c4b4f1 100644 --- a/.woodpecker/e2e-test.yml +++ b/.woodpecker/e2e-test.yml @@ -1,6 +1,6 @@ when: - - event: manual - evaluate: 'PIPELINE == "e2e-test"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "e2e-test"' steps: - name: e2e diff --git a/.woodpecker/e2e.yml b/.woodpecker/e2e.yml index 263c836a..9b182e3b 100644 --- a/.woodpecker/e2e.yml +++ b/.woodpecker/e2e.yml @@ -7,7 +7,8 @@ # was harmless at daily/weekly cadence — but alert-monitor.yml # fires every 15 minutes, so piggybacking must be opt-in now. # A new cron that SHOULD also run e2e gets its name added here. -# - manual : `woodpecker pipeline create --branch master --var PIPELINE=e2e k.renner/homelab` +# - deploy : `woodpecker-cli pipeline deploy k.renner/homelab e2e`, where +# is an existing pipeline to promote. when: - event: cron @@ -16,8 +17,8 @@ when: cron: update-audit - event: cron cron: weekly-update - - event: manual - evaluate: 'PIPELINE == "e2e"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "e2e"' steps: - name: model-selection-tests diff --git a/.woodpecker/install-garage-synology.yml b/.woodpecker/install-garage-synology.yml index fec2844b..5cd132de 100644 --- a/.woodpecker/install-garage-synology.yml +++ b/.woodpecker/install-garage-synology.yml @@ -1,6 +1,6 @@ when: - - event: manual - evaluate: 'PIPELINE == "install-garage-synology"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "install-garage-synology"' steps: - name: run-playbook diff --git a/.woodpecker/issue-fix.yml b/.woodpecker/issue-fix.yml index 837d2228..e56ef916 100644 --- a/.woodpecker/issue-fix.yml +++ b/.woodpecker/issue-fix.yml @@ -34,13 +34,13 @@ # - cron : a cron NAMED exactly "issue-fix": # woodpecker repo cron add --repo k.renner/homelab \ # --name issue-fix --branch master --schedule '41 * * * *' -# - manual : woodpecker pipeline create --branch master \ -# --var PIPELINE=issue-fix k.renner/homelab +# - deploy : woodpecker-cli pipeline deploy k.renner/homelab issue-fix +# where is an existing pipeline to promote. when: - event: cron cron: issue-fix - - event: manual - evaluate: 'PIPELINE == "issue-fix"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "issue-fix"' steps: - name: fetch-diag diff --git a/.woodpecker/pr-review.yml b/.woodpecker/pr-review.yml index f85cca8a..422a3dcf 100644 --- a/.woodpecker/pr-review.yml +++ b/.woodpecker/pr-review.yml @@ -53,9 +53,9 @@ # # Triggering: pull_request only — automatic on PR open + push-to-open-PR. To # re-review a PR, push a commit (the new head sha clears the dedup marker below -# and earns a fresh review). There is deliberately no manual PIPELINE trigger: -# Woodpecker exposes a --var only to YAML variable substitution and `when` -# filters, NOT to a step's shell environment, so a --var PR= re-review would +# and earns a fresh review). There is deliberately no on-demand trigger for a +# specific PR: Woodpecker exposes injected variables to YAML substitution and +# `when` filters, NOT to a step's shell environment, so a PR= re-review would # silently no-op (the step would find no PR number and exit green). # (Note: keep literal dollar-brace out of THIS file entirely, even in comments — # Woodpecker runs its variable substitution over the whole YAML text, comments diff --git a/.woodpecker/update-audit.yml b/.woodpecker/update-audit.yml index e320f03d..6114ab82 100644 --- a/.woodpecker/update-audit.yml +++ b/.woodpecker/update-audit.yml @@ -10,14 +10,14 @@ # report; the pipeline posts it to a single persistent Gitea issue. # # Triggering: -# - cron : a cron NAMED exactly "update-audit". Unlike the other pipelines -# here (which gate on an injected `PIPELINE` var set at cron-create -# time in the UI), this uses Woodpecker's documented `cron:` name -# filter so the schedule can be created entirely from the CLI: +# - cron : a cron NAMED exactly "update-audit". Crons carry no variables — +# `repo cron add` takes name, branch, schedule and enabled — so the +# name filter is the only thing that can select a workflow for a +# scheduled run: # woodpecker repo cron add --repo k.renner/homelab \ # --name update-audit --branch master --schedule '@weekly' -# - manual : woodpecker pipeline create --branch master \ -# --var PIPELINE=update-audit k.renner/homelab +# - deploy : woodpecker-cli pipeline deploy k.renner/homelab update-audit +# where is an existing pipeline to promote. # # NOTE: e2e.yml runs on an explicit list of cron names that includes this one, # so a weekly e2e run piggybacks on the audit (it was a bare `event: cron` @@ -25,8 +25,8 @@ when: - event: cron cron: update-audit - - event: manual - evaluate: 'PIPELINE == "update-audit"' + - event: deployment + evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "update-audit"' steps: - name: update-audit-agent diff --git a/kubernetes/apps/woodpecker/MIGRATION-namespace.md b/kubernetes/apps/woodpecker/MIGRATION-namespace.md index 62c0453e..b5d1f2aa 100644 --- a/kubernetes/apps/woodpecker/MIGRATION-namespace.md +++ b/kubernetes/apps/woodpecker/MIGRATION-namespace.md @@ -305,7 +305,7 @@ server → agent → step pod → server end to end: ```sh curl -sS -o /dev/null -w '%{http_code}\n' https://ci.renner.uno/ -woodpecker pipeline create --branch master --var PIPELINE=e2e-test k.renner/homelab +woodpecker-cli pipeline deploy k.renner/homelab e2e-test ``` Step pods must still reach the server on `:8000` while still being unable to -- 2.54.0