.woodpecker/alert-monitor.yml

@@ -32,13 +32,13 @@
 #              mechanism as update-audit.yml):
 #                woodpecker repo cron add --repo k.renner/homelab \
 #                  --name alert-monitor --branch master --schedule '*/15 * * * *'
-#   - manual : woodpecker pipeline create --branch master \
-#                --var PIPELINE=alert-monitor k.renner/homelab
+#   - deploy : woodpecker-cli pipeline deploy k.renner/homelab <n> alert-monitor
+#              where <n> is an existing pipeline to promote.
 when:
   - event: cron
     cron: alert-monitor
-  - event: manual
-    evaluate: 'PIPELINE == "alert-monitor"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "alert-monitor"'
 
 steps:
   - name: fetch-alerts

.woodpecker/build-ci-images.yml

@@ -31,8 +31,8 @@ when:
       - "ci/images/**"
       - "secret-rotator/**"
       - ".woodpecker/build-ci-images.yml"
-  - event: manual
-    evaluate: 'PIPELINE == "build-ci-images"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "build-ci-images"'
 
 steps:
   - name: build-ansible
@@ -44,7 +44,7 @@ steps:
     # secret-rotator commit needlessly rebuilt all four ~1.3G ci-* images and
     # orphaned ~5G of registry layers per run — a main driver of #336.
     when:
-      - event: manual
+      - event: deployment
       - event: push
         path: ["ci/images/ansible/**", ".woodpecker/build-ci-images.yml"]
     environment:
@@ -68,7 +68,7 @@ steps:
     directory: ci/images/k8s
     depends_on: []
     when:
-      - event: manual
+      - event: deployment
       - event: push
         path: ["ci/images/k8s/**", ".woodpecker/build-ci-images.yml"]
     environment:
@@ -92,7 +92,7 @@ steps:
     directory: ci/images/tofu
     depends_on: []
     when:
-      - event: manual
+      - event: deployment
       - event: push
         path: ["ci/images/tofu/**", ".woodpecker/build-ci-images.yml"]
     environment:
@@ -123,7 +123,7 @@ steps:
     directory: secret-rotator
     depends_on: []
     when:
-      - event: manual
+      - event: deployment
       - event: push
         path: ["secret-rotator/**", ".woodpecker/build-ci-images.yml"]
     environment:
@@ -152,7 +152,7 @@ steps:
     directory: ci/images/alpine-jq
     depends_on: []
     when:
-      - event: manual
+      - event: deployment
       - event: push
         path: ["ci/images/alpine-jq/**", ".woodpecker/build-ci-images.yml"]
     environment:
@@ -181,7 +181,7 @@ steps:
     directory: ci/images/cni-plugins
     depends_on: []
     when:
-      - event: manual
+      - event: deployment
       - event: push
         path: ["ci/images/cni-plugins/**", ".woodpecker/build-ci-images.yml"]
     environment:
@@ -210,7 +210,7 @@ steps:
     directory: ci/images/alpine-openssl
     depends_on: []
     when:
-      - event: manual
+      - event: deployment
       - event: push
         path: ["ci/images/alpine-openssl/**", ".woodpecker/build-ci-images.yml"]
     environment:
@@ -239,7 +239,7 @@ steps:
     directory: ci/images/heating-can
     depends_on: []
     when:
-      - event: manual
+      - event: deployment
       - event: push
         path: ["ci/images/heating-can/**", ".woodpecker/build-ci-images.yml"]
     environment:

.woodpecker/ci-claude-refresh.yml

@@ -54,8 +54,8 @@
 #
 # Triggering:
 #   - cron   : the cron NAMED exactly "ci-claude-refresh" (see above).
-#   - manual : woodpecker pipeline create --branch master \
-#                --var PIPELINE=ci-claude-refresh k.renner/homelab
+#   - deploy : woodpecker-cli pipeline deploy k.renner/homelab <n> ci-claude-refresh
+#              where <n> is an existing pipeline to promote.
 #   - push   : a change to the Containerfile (or this file) ON master forces a
 #              rebuild of the current latest version so Containerfile fixes ship
 #              promptly. Restricted to master ON PURPOSE — a feature branch must
@@ -65,8 +65,8 @@
 when:
   - event: cron
     cron: ci-claude-refresh
-  - event: manual
-    evaluate: 'PIPELINE == "ci-claude-refresh"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "ci-claude-refresh"'
   - event: push
     branch: master
     path:

.woodpecker/deploy-claude-workstation.yml

@@ -6,8 +6,8 @@ when:
       - "ansible/roles/claude-workstation/**"
       - "ansible/plays/install-claude-workstation.yml"
       - ".woodpecker/deploy-claude-workstation.yml"
-  - event: manual
-    evaluate: 'PIPELINE == "deploy-claude-workstation"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-claude-workstation"'
 
 timeout: 30
 

.woodpecker/deploy-infrastructure.yml

@@ -8,8 +8,8 @@ when:
     path:
       - "opentofu/**"
       - ".woodpecker/deploy-infrastructure.yml"
-  - event: manual
-    evaluate: 'PIPELINE == "deploy-infrastructure"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-infrastructure"'
 
 steps:
   - name: validate-secrets
@@ -84,7 +84,7 @@ steps:
     image: gitea.renner.uno/gitea_admin/ci-tofu:2026-04-29
     directory: opentofu
     when:
-      - event: manual
+      - event: deployment
         evaluate: 'TOFU_APPLY == "true"'
     environment:
       TF_IN_AUTOMATION: "true"

.woodpecker/deploy-netbird-client.yml

@@ -7,8 +7,8 @@ when:
       - "ansible/plays/install-netbird-client.yml"
       - "ansible/inventory/group_vars/claude_workstation/**"
       - ".woodpecker/deploy-netbird-client.yml"
-  - event: manual
-    evaluate: 'PIPELINE == "deploy-netbird-client"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-client"'
 
 timeout: 30
 

.woodpecker/deploy-netbird-proxy.yml

@@ -9,8 +9,8 @@ when:
       - "ansible/roles/netbird-proxy-watchdog/**"
       - "ansible/plays/install-netbird-proxy.yml"
       - ".woodpecker/deploy-netbird-proxy.yml"
-  - event: manual
-    evaluate: 'PIPELINE == "deploy-netbird-proxy"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-proxy"'
 
 timeout: 30
 

.woodpecker/deploy-netbird-server.yml

@@ -9,8 +9,8 @@ when:
       - "ansible/roles/netbird-proxy-watchdog/**"
       - "ansible/plays/install-netbird-server.yml"
       - ".woodpecker/deploy-netbird-server.yml"
-  - event: manual
-    evaluate: 'PIPELINE == "deploy-netbird-server"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-server"'
 
 timeout: 30
 

.woodpecker/e2e-test.yml

@@ -1,6 +1,6 @@
 when:
-  - event: manual
-    evaluate: 'PIPELINE == "e2e-test"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "e2e-test"'
 
 steps:
   - name: e2e

.woodpecker/e2e.yml

@@ -7,7 +7,8 @@
 #                was harmless at daily/weekly cadence — but alert-monitor.yml
 #                fires every 15 minutes, so piggybacking must be opt-in now.
 #                A new cron that SHOULD also run e2e gets its name added here.
-#   - manual   : `woodpecker pipeline create --branch master --var PIPELINE=e2e k.renner/homelab`
+#   - deploy   : `woodpecker-cli pipeline deploy k.renner/homelab <n> e2e`, where
+#                <n> is an existing pipeline to promote.
 
 when:
   - event: cron
@@ -16,8 +17,8 @@ when:
     cron: update-audit
   - event: cron
     cron: weekly-update
-  - event: manual
-    evaluate: 'PIPELINE == "e2e"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "e2e"'
 
 steps:
   - name: model-selection-tests

.woodpecker/install-garage-synology.yml

@@ -1,6 +1,6 @@
 when:
-  - event: manual
-    evaluate: 'PIPELINE == "install-garage-synology"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "install-garage-synology"'
 
 steps:
   - name: run-playbook

.woodpecker/issue-fix.yml

@@ -34,13 +34,13 @@
 #   - cron   : a cron NAMED exactly "issue-fix":
 #                woodpecker repo cron add --repo k.renner/homelab \
 #                  --name issue-fix --branch master --schedule '41 * * * *'
-#   - manual : woodpecker pipeline create --branch master \
-#                --var PIPELINE=issue-fix k.renner/homelab
+#   - deploy : woodpecker-cli pipeline deploy k.renner/homelab <n> issue-fix
+#              where <n> is an existing pipeline to promote.
 when:
   - event: cron
     cron: issue-fix
-  - event: manual
-    evaluate: 'PIPELINE == "issue-fix"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "issue-fix"'
 
 steps:
   - name: fetch-diag

.woodpecker/pr-review.yml

@@ -53,9 +53,9 @@
 #
 # Triggering: pull_request only — automatic on PR open + push-to-open-PR. To
 # re-review a PR, push a commit (the new head sha clears the dedup marker below
-# and earns a fresh review). There is deliberately no manual PIPELINE trigger:
-# Woodpecker exposes a --var only to YAML variable substitution and `when`
-# filters, NOT to a step's shell environment, so a --var PR=<n> re-review would
+# and earns a fresh review). There is deliberately no on-demand trigger for a
+# specific PR: Woodpecker exposes injected variables to YAML substitution and
+# `when` filters, NOT to a step's shell environment, so a PR=<n> re-review would
 # silently no-op (the step would find no PR number and exit green).
 # (Note: keep literal dollar-brace out of THIS file entirely, even in comments —
 # Woodpecker runs its variable substitution over the whole YAML text, comments

.woodpecker/update-audit.yml

@@ -10,14 +10,14 @@
 # report; the pipeline posts it to a single persistent Gitea issue.
 #
 # Triggering:
-#   - cron   : a cron NAMED exactly "update-audit". Unlike the other pipelines
-#              here (which gate on an injected `PIPELINE` var set at cron-create
-#              time in the UI), this uses Woodpecker's documented `cron:` name
-#              filter so the schedule can be created entirely from the CLI:
+#   - cron   : a cron NAMED exactly "update-audit". Crons carry no variables —
+#              `repo cron add` takes name, branch, schedule and enabled — so the
+#              name filter is the only thing that can select a workflow for a
+#              scheduled run:
 #                woodpecker repo cron add --repo k.renner/homelab \
 #                  --name update-audit --branch master --schedule '@weekly'
-#   - manual : woodpecker pipeline create --branch master \
-#                --var PIPELINE=update-audit k.renner/homelab
+#   - deploy : woodpecker-cli pipeline deploy k.renner/homelab <n> update-audit
+#              where <n> is an existing pipeline to promote.
 #
 # NOTE: e2e.yml runs on an explicit list of cron names that includes this one,
 # so a weekly e2e run piggybacks on the audit (it was a bare `event: cron`
@@ -25,8 +25,8 @@
 when:
   - event: cron
     cron: update-audit
-  - event: manual
-    evaluate: 'PIPELINE == "update-audit"'
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "update-audit"'
 
 steps:
   - name: update-audit-agent

kubernetes/apps/woodpecker/MIGRATION-namespace.md

@@ -305,7 +305,7 @@ server → agent → step pod → server end to end:
 
 ```sh
 curl -sS -o /dev/null -w '%{http_code}\n' https://ci.renner.uno/
-woodpecker pipeline create --branch master --var PIPELINE=e2e-test k.renner/homelab
+woodpecker-cli pipeline deploy k.renner/homelab <pipeline-number> e2e-test
 ```
 
 Step pods must still reach the server on `:8000` while still being unable to