expand Woodpecker CI with plugins: buildx, trivy, S3, gitea-release, gitea-comment, git-push, and failure reporter

refs #82 #83 #84 #85 #86 #87 #88 #89 #90 #91 #92

- Replace all docker:cli build/tag/push with woodpeckerci/plugin-docker-buildx
- Replace all aquasec/trivy shell commands with woodpeckerci/plugin-trivy
- Add fhirworx/api image to deploy, infra-ci, and rebuild-all pipelines
- Add docs trivy scan + S3 upload (was missing)
- Add coverage badge S3 upload and git-push auto-commit
- Add PR comment plugin for CI feedback
- Create release.yml for tag-triggered Gitea releases
- Wire diag failure reporter into all 5 pipelines

.woodpecker/ci.yml

@@ -46,9 +46,76 @@ steps:
     depends_on:
       - test
 
+  - name: commit-badge
+    image: woodpeckerci/plugin-git-push
+    failure: ignore
+    settings:
+      remote: http://gitea:3000/homelab/stack.git
+      branch: main
+      author_name: woodpecker-ci
+      author_email: ci@fhirworx.io
+      commit_message: "update coverage badge [skip ci]"
+      path: coverage.svg
+      username:
+        from_secret: registry_user
+      password:
+        from_secret: registry_pass
+    when:
+      - branch: main
+        event: push
+    depends_on:
+      - test
+
+  - name: upload-coverage-badge
+    image: woodpeckerci/plugin-s3
+    failure: ignore
+    settings:
+      endpoint: http://rustfs:9000
+      bucket: gitea
+      access_key:
+        from_secret: s3_access_key
+      secret_key:
+        from_secret: s3_secret_key
+      source: "coverage.svg"
+      target: /badges/homelab/stack/
+      path_style: true
+    depends_on:
+      - test
+
+  - name: pr-comment
+    image: woodpeckerci/plugin-gitea-comment
+    settings:
+      gitea_url:
+        from_secret: gitea_url
+      api_key:
+        from_secret: gitea_token
+      message: >
+        **CI** for `${CI_COMMIT_SHA:0:8}` —
+        [pipeline #${CI_PIPELINE_NUMBER}](${CI_PIPELINE_URL})
+    when:
+      - event: pull_request
+    depends_on:
+      - test
+      - coverage-badge
+
   - name: validate-compose
     image: docker:cli
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
     commands:
       - docker compose config --quiet
+
+  # ── Failure reporter ─────────────────────────────────────────
+  - name: report-failure
+    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+    environment:
+      UV_PYTHON_PREFERENCE: only-system
+      UV_LINK_MODE: copy
+      UV_PROJECT_ENVIRONMENT: .venv
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - uv sync --no-dev
+      - uv run python -m api.diag
+    when:
+      - status: [failure]

.woodpecker/deploy.yml

@@ -5,12 +5,11 @@
 # Only runs on pushes to main (i.e. after PR merge).
 #
 # Image naming:
-#   fhirworx/<service>:<short-sha>      (local tag, used by compose)
-#   localhost:3000/homelab/<service>:*  (registry push only)
+#   localhost:3000/homelab/<service>:sha-<8chars>  (registry)
+#   localhost:3000/homelab/<service>:latest         (registry)
 #
-# The deploy step writes COMMIT_SHA=<short-sha> into .env so
-# compose.yml resolves fhirworx/<svc>:${COMMIT_SHA:-latest} to
-# the exact image just built.
+# The deploy step writes COMMIT_SHA=sha-<short> into .env so
+# compose.yml resolves the exact image just built.
 
 when:
   - event: push
@@ -39,118 +38,143 @@ steps:
       - build-package
 
   # ── Notebooks image ─────────────────────────────────────────
-  - name: build-notebooks
-    image: docker:cli
+  - name: build-push-notebooks
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: localhost:3000/homelab/notebooks
+      dockerfile: notebooks/Dockerfile
+      context: notebooks/
+      tags:
+        - "sha-${CI_COMMIT_SHA:0:8}"
+        - latest
+      daemon_off: true
+      insecure: true
+      username:
+        from_secret: registry_user
+      password:
+        from_secret: registry_pass
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    commands:
-      - TAG=${CI_COMMIT_SHA:0:8}
-      - docker build -t fhirworx/notebooks:$TAG ./notebooks
-      - docker tag fhirworx/notebooks:$TAG fhirworx/notebooks:latest
 
   - name: scan-notebooks
-    image: aquasec/trivy:latest
+    image: woodpeckerci/plugin-trivy
+    settings:
+      image_ref: "localhost:3000/homelab/notebooks:sha-${CI_COMMIT_SHA:0:8}"
+      severity: HIGH,CRITICAL
+      exit_code: 0
+      output: notebooks-scan.json
+      format: json
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    commands:
-      - TAG=${CI_COMMIT_SHA:0:8}
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table fhirworx/notebooks:$TAG
-      - trivy image --severity HIGH,CRITICAL --format json -o notebooks-scan.json fhirworx/notebooks:$TAG
     depends_on:
-      - build-notebooks
-
-  - name: push-notebooks
-    image: docker:cli
-    volumes:
-      - /run/user/1000/docker.sock:/var/run/docker.sock
-    environment:
-      REGISTRY_USER:
-        from_secret: registry_user
-      REGISTRY_PASS:
-        from_secret: registry_pass
-    commands:
-      - TAG=${CI_COMMIT_SHA:0:8}
-      - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
-      - docker tag fhirworx/notebooks:$TAG localhost:3000/homelab/notebooks:$TAG
-      - docker push localhost:3000/homelab/notebooks:$TAG
-      - docker tag fhirworx/notebooks:latest localhost:3000/homelab/notebooks:latest
-      - docker push localhost:3000/homelab/notebooks:latest
-    depends_on:
-      - scan-notebooks
+      - build-push-notebooks
 
   # ── Zotero image ────────────────────────────────────────────
-  - name: build-zotero
-    image: docker:cli
+  - name: build-push-zotero
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: localhost:3000/homelab/zotero
+      dockerfile: zotero/Dockerfile
+      context: zotero/
+      tags:
+        - "sha-${CI_COMMIT_SHA:0:8}"
+        - latest
+      daemon_off: true
+      insecure: true
+      username:
+        from_secret: registry_user
+      password:
+        from_secret: registry_pass
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    commands:
-      - TAG=${CI_COMMIT_SHA:0:8}
-      - docker build -t fhirworx/zotero:$TAG ./zotero
-      - docker tag fhirworx/zotero:$TAG fhirworx/zotero:latest
 
   - name: scan-zotero
-    image: aquasec/trivy:latest
+    image: woodpeckerci/plugin-trivy
+    settings:
+      image_ref: "localhost:3000/homelab/zotero:sha-${CI_COMMIT_SHA:0:8}"
+      severity: HIGH,CRITICAL
+      exit_code: 0
+      output: zotero-scan.json
+      format: json
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    commands:
-      - TAG=${CI_COMMIT_SHA:0:8}
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table fhirworx/zotero:$TAG
-      - trivy image --severity HIGH,CRITICAL --format json -o zotero-scan.json fhirworx/zotero:$TAG
     depends_on:
-      - build-zotero
+      - build-push-zotero
 
-  - name: push-zotero
-    image: docker:cli
+  # ── Docs image ──────────────────────────────────────────────
+  # Needs bib.sqlite from host data dir in the build context.
+  - name: prep-docs-context
+    image: alpine:3
     volumes:
-      - /run/user/1000/docker.sock:/var/run/docker.sock
-    environment:
-      REGISTRY_USER:
-        from_secret: registry_user
-      REGISTRY_PASS:
-        from_secret: registry_pass
-    commands:
-      - TAG=${CI_COMMIT_SHA:0:8}
-      - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
-      - docker tag fhirworx/zotero:$TAG localhost:3000/homelab/zotero:$TAG
-      - docker push localhost:3000/homelab/zotero:$TAG
-      - docker tag fhirworx/zotero:latest localhost:3000/homelab/zotero:latest
-      - docker push localhost:3000/homelab/zotero:latest
-    depends_on:
-      - scan-zotero
-
-  # ── Docs image ─────────────────────────────────────────────
-  # No path filter — docstrings and bib data change with any src/ edit.
-  # Host data dir is mounted so bib.sqlite is available for library export.
-  - name: build-docs
-    image: docker:cli
-    volumes:
-      - /run/user/1000/docker.sock:/var/run/docker.sock
       - /home/kert/stack/data:/host-data:ro
     commands:
-      - TAG=${CI_COMMIT_SHA:0:8}
       - mkdir -p data
       - cp /host-data/bib.sqlite data/ 2>/dev/null || true
-      - docker build -t fhirworx/docs:$TAG -f docs/Dockerfile .
-      - docker tag fhirworx/docs:$TAG fhirworx/docs:latest
 
-  - name: push-docs
-    image: docker:cli
+  - name: build-push-docs
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: localhost:3000/homelab/docs
+      dockerfile: docs/Dockerfile
+      context: .
+      tags:
+        - "sha-${CI_COMMIT_SHA:0:8}"
+        - latest
+      daemon_off: true
+      insecure: true
+      username:
+        from_secret: registry_user
+      password:
+        from_secret: registry_pass
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    environment:
-      REGISTRY_USER:
-        from_secret: registry_user
-      REGISTRY_PASS:
-        from_secret: registry_pass
-    commands:
-      - TAG=${CI_COMMIT_SHA:0:8}
-      - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
-      - docker tag fhirworx/docs:$TAG localhost:3000/homelab/docs:$TAG
-      - docker push localhost:3000/homelab/docs:$TAG
-      - docker tag fhirworx/docs:latest localhost:3000/homelab/docs:latest
-      - docker push localhost:3000/homelab/docs:latest
     depends_on:
-      - build-docs
+      - prep-docs-context
+
+  - name: scan-docs
+    image: woodpeckerci/plugin-trivy
+    settings:
+      image_ref: "localhost:3000/homelab/docs:sha-${CI_COMMIT_SHA:0:8}"
+      severity: HIGH,CRITICAL
+      exit_code: 0
+      output: docs-scan.json
+      format: json
+    volumes:
+      - /run/user/1000/docker.sock:/var/run/docker.sock
+    depends_on:
+      - build-push-docs
+
+  # ── API image ───────────────────────────────────────────────
+  - name: build-push-api
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: localhost:3000/homelab/api
+      dockerfile: api/Dockerfile
+      context: .
+      tags:
+        - "sha-${CI_COMMIT_SHA:0:8}"
+        - latest
+      daemon_off: true
+      insecure: true
+      username:
+        from_secret: registry_user
+      password:
+        from_secret: registry_pass
+    volumes:
+      - /run/user/1000/docker.sock:/var/run/docker.sock
+
+  - name: scan-api
+    image: woodpeckerci/plugin-trivy
+    settings:
+      image_ref: "localhost:3000/homelab/api:sha-${CI_COMMIT_SHA:0:8}"
+      severity: HIGH,CRITICAL
+      exit_code: 0
+      output: api-scan.json
+      format: json
+    volumes:
+      - /run/user/1000/docker.sock:/var/run/docker.sock
+    depends_on:
+      - build-push-api
 
   # ── Upload scan results ─────────────────────────────────────
   - name: upload-notebooks-scan
@@ -183,6 +207,36 @@ steps:
     depends_on:
       - scan-zotero
 
+  - name: upload-docs-scan
+    image: woodpeckerci/plugin-s3
+    settings:
+      endpoint: http://rustfs:9000
+      bucket: gitea
+      access_key:
+        from_secret: s3_access_key
+      secret_key:
+        from_secret: s3_secret_key
+      source: "docs-scan.json"
+      target: /ci/${CI_REPO}/${CI_COMMIT_SHA:0:8}/
+      path_style: true
+    depends_on:
+      - scan-docs
+
+  - name: upload-api-scan
+    image: woodpeckerci/plugin-s3
+    settings:
+      endpoint: http://rustfs:9000
+      bucket: gitea
+      access_key:
+        from_secret: s3_access_key
+      secret_key:
+        from_secret: s3_secret_key
+      source: "api-scan.json"
+      target: /ci/${CI_REPO}/${CI_COMMIT_SHA:0:8}/
+      path_style: true
+    depends_on:
+      - scan-api
+
   # ── Deploy: pull latest code + restart services ────────────────
   - name: deploy
     image: docker:cli
@@ -197,16 +251,15 @@ steps:
       - git reset --hard FETCH_HEAD
       - cp .env.bak .env 2>/dev/null || true
       # Pin compose to the exact images just built
-      - TAG=${CI_COMMIT_SHA:0:8}
+      - TAG=sha-${CI_COMMIT_SHA:0:8}
       - sed -i "s/^COMMIT_SHA=.*/COMMIT_SHA=$TAG/" .env 2>/dev/null || echo "COMMIT_SHA=$TAG" >> .env
       - docker compose up -d --remove-orphans
     depends_on:
       - publish-package
-      - push-notebooks
       - upload-notebooks-scan
-      - push-zotero
       - upload-zotero-scan
-      - push-docs
+      - upload-api-scan
+      - upload-docs-scan
 
   # ── Provision: derive credentials and rotate backends ────────
   - name: provision
@@ -222,3 +275,18 @@ steps:
       - uv run python -m api.auth provision ${CI_COMMIT_SHA}
     depends_on:
       - deploy
+
+  # ── Failure reporter ─────────────────────────────────────────
+  - name: report-failure
+    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+    environment:
+      UV_PYTHON_PREFERENCE: only-system
+      UV_LINK_MODE: copy
+      UV_PROJECT_ENVIRONMENT: .venv
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - uv sync --no-dev
+      - uv run python -m api.diag
+    when:
+      - status: [failure]

.woodpecker/infra-ci.yml

@@ -24,12 +24,15 @@ steps:
       - path: "notebooks/**"
 
   - name: build-notebooks
-    image: docker:cli
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      dockerfile: notebooks/Dockerfile
+      context: notebooks/
+      tags: ["ci-test"]
+      daemon_off: true
+      dry_run: true
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    commands:
-      - docker build -t ci-test/fhirworx/notebooks:${CI_COMMIT_SHA:0:8} ./notebooks
-      - docker rmi ci-test/fhirworx/notebooks:${CI_COMMIT_SHA:0:8}
     depends_on:
       - hadolint-notebooks
     when:
@@ -44,12 +47,15 @@ steps:
       - path: "zotero/**"
 
   - name: build-zotero
-    image: docker:cli
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      dockerfile: zotero/Dockerfile
+      context: zotero/
+      tags: ["ci-test"]
+      daemon_off: true
+      dry_run: true
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    commands:
-      - docker build -t ci-test/fhirworx/zotero:${CI_COMMIT_SHA:0:8} ./zotero
-      - docker rmi ci-test/fhirworx/zotero:${CI_COMMIT_SHA:0:8}
     depends_on:
       - hadolint-zotero
     when:
@@ -64,17 +70,49 @@ steps:
       - path: "docs/**"
 
   - name: build-docs
-    image: docker:cli
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      dockerfile: docs/Dockerfile
+      context: .
+      tags: ["ci-test"]
+      daemon_off: true
+      dry_run: true
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    commands:
-      - docker build -t ci-test/fhirworx/docs:${CI_COMMIT_SHA:0:8} -f docs/Dockerfile .
-      - docker rmi ci-test/fhirworx/docs:${CI_COMMIT_SHA:0:8}
     depends_on:
       - hadolint-docs
     when:
       - path: "docs/**"
 
+  # ── API image ─────────────────────────────────────────────────
+  - name: hadolint-api
+    image: hadolint/hadolint:latest-debian
+    commands:
+      - hadolint api/Dockerfile
+    when:
+      - path:
+          - "api/**"
+          - "src/**"
+          - "pyproject.toml"
+
+  - name: build-api
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      dockerfile: api/Dockerfile
+      context: .
+      tags: ["ci-test"]
+      daemon_off: true
+      dry_run: true
+    volumes:
+      - /run/user/1000/docker.sock:/var/run/docker.sock
+    depends_on:
+      - hadolint-api
+    when:
+      - path:
+          - "api/**"
+          - "src/**"
+          - "pyproject.toml"
+
   # ── Nginx / Dashboard ─────────────────────────────────────────
   - name: validate-nginx
     image: nginx:alpine
@@ -146,3 +184,18 @@ steps:
         $OK
     when:
       - path: "trino/etc/**"
+
+  # ── Failure reporter ─────────────────────────────────────────
+  - name: report-failure
+    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+    environment:
+      UV_PYTHON_PREFERENCE: only-system
+      UV_LINK_MODE: copy
+      UV_PROJECT_ENVIRONMENT: .venv
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - uv sync --no-dev
+      - uv run python -m api.diag
+    when:
+      - status: [failure]

.woodpecker/rebuild-all.yml

@@ -2,77 +2,120 @@ when:
   - event: manual
 
 steps:
-  - name: build-notebooks
-    image: docker:cli
+  - name: build-push-notebooks
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: localhost:3000/homelab/notebooks
+      dockerfile: notebooks/Dockerfile
+      context: notebooks/
+      tags:
+        - "sha-${CI_COMMIT_SHA:0:8}"
+        - latest
+      daemon_off: true
+      insecure: true
+      username:
+        from_secret: registry_user
+      password:
+        from_secret: registry_pass
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    commands:
-      - TAG=${CI_COMMIT_SHA:0:8}
-      - docker build -t fhirworx/notebooks:$TAG ./notebooks
-      - docker tag fhirworx/notebooks:$TAG fhirworx/notebooks:latest
 
-  - name: build-zotero
-    image: docker:cli
+  - name: build-push-zotero
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: localhost:3000/homelab/zotero
+      dockerfile: zotero/Dockerfile
+      context: zotero/
+      tags:
+        - "sha-${CI_COMMIT_SHA:0:8}"
+        - latest
+      daemon_off: true
+      insecure: true
+      username:
+        from_secret: registry_user
+      password:
+        from_secret: registry_pass
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    commands:
-      - TAG=${CI_COMMIT_SHA:0:8}
-      - docker build -t fhirworx/zotero:$TAG ./zotero
-      - docker tag fhirworx/zotero:$TAG fhirworx/zotero:latest
 
-  - name: build-docs
-    image: docker:cli
+  - name: prep-docs-context
+    image: alpine:3
     volumes:
-      - /run/user/1000/docker.sock:/var/run/docker.sock
       - /home/kert/stack/data:/host-data:ro
     commands:
-      - TAG=${CI_COMMIT_SHA:0:8}
       - mkdir -p data
       - cp /host-data/bib.sqlite data/ 2>/dev/null || true
-      - docker build -t fhirworx/docs:$TAG -f docs/Dockerfile .
-      - docker tag fhirworx/docs:$TAG fhirworx/docs:latest
+
+  - name: build-push-docs
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: localhost:3000/homelab/docs
+      dockerfile: docs/Dockerfile
+      context: .
+      tags:
+        - "sha-${CI_COMMIT_SHA:0:8}"
+        - latest
+      daemon_off: true
+      insecure: true
+      username:
+        from_secret: registry_user
+      password:
+        from_secret: registry_pass
+    volumes:
+      - /run/user/1000/docker.sock:/var/run/docker.sock
+    depends_on:
+      - prep-docs-context
+
+  - name: build-push-api
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: localhost:3000/homelab/api
+      dockerfile: api/Dockerfile
+      context: .
+      tags:
+        - "sha-${CI_COMMIT_SHA:0:8}"
+        - latest
+      daemon_off: true
+      insecure: true
+      username:
+        from_secret: registry_user
+      password:
+        from_secret: registry_pass
+    volumes:
+      - /run/user/1000/docker.sock:/var/run/docker.sock
 
   - name: scan-notebooks
-    image: aquasec/trivy:latest
+    image: woodpeckerci/plugin-trivy
+    settings:
+      image_ref: "localhost:3000/homelab/notebooks:sha-${CI_COMMIT_SHA:0:8}"
+      severity: HIGH,CRITICAL
+      exit_code: 0
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table fhirworx/notebooks:${CI_COMMIT_SHA:0:8}
     depends_on:
-      - build-notebooks
+      - build-push-notebooks
 
   - name: scan-zotero
-    image: aquasec/trivy:latest
+    image: woodpeckerci/plugin-trivy
+    settings:
+      image_ref: "localhost:3000/homelab/zotero:sha-${CI_COMMIT_SHA:0:8}"
+      severity: HIGH,CRITICAL
+      exit_code: 0
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table fhirworx/zotero:${CI_COMMIT_SHA:0:8}
     depends_on:
-      - build-zotero
+      - build-push-zotero
 
-  - name: push-images
-    image: docker:cli
+  - name: scan-api
+    image: woodpeckerci/plugin-trivy
+    settings:
+      image_ref: "localhost:3000/homelab/api:sha-${CI_COMMIT_SHA:0:8}"
+      severity: HIGH,CRITICAL
+      exit_code: 0
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
-    environment:
-      REGISTRY_USER:
-        from_secret: registry_user
-      REGISTRY_PASS:
-        from_secret: registry_pass
-    commands:
-      - TAG=${CI_COMMIT_SHA:0:8}
-      - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
-      - |
-        for SVC in notebooks zotero docs; do
-          docker tag fhirworx/$SVC:$TAG localhost:3000/homelab/$SVC:$TAG
-          docker push localhost:3000/homelab/$SVC:$TAG
-          docker tag fhirworx/$SVC:latest localhost:3000/homelab/$SVC:latest
-          docker push localhost:3000/homelab/$SVC:latest
-        done
     depends_on:
-      - scan-notebooks
-      - scan-zotero
-      - build-docs
+      - build-push-api
 
   - name: deploy
     image: docker:cli
@@ -81,8 +124,26 @@ steps:
       - /home/kert/stack:/home/kert/stack
     commands:
       - cd /home/kert/stack
-      - TAG=${CI_COMMIT_SHA:0:8}
+      - TAG=sha-${CI_COMMIT_SHA:0:8}
       - sed -i "s/^COMMIT_SHA=.*/COMMIT_SHA=$TAG/" .env 2>/dev/null || echo "COMMIT_SHA=$TAG" >> .env
       - docker compose up -d --remove-orphans
     depends_on:
-      - push-images
+      - scan-notebooks
+      - scan-zotero
+      - scan-api
+      - build-push-docs
+
+  # ── Failure reporter ─────────────────────────────────────────
+  - name: report-failure
+    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+    environment:
+      UV_PYTHON_PREFERENCE: only-system
+      UV_LINK_MODE: copy
+      UV_PROJECT_ENVIRONMENT: .venv
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - uv sync --no-dev
+      - uv run python -m api.diag
+    when:
+      - status: [failure]

.woodpecker/release.yml

@@ -0,0 +1,42 @@
+# ── Release ──────────────────────────────────────────────────────
+# Builds the Python package and creates a Gitea release with
+# wheel + sdist artifacts.  Triggered on tag pushes (e.g. v0.5.0).
+
+when:
+  - event: tag
+
+steps:
+  - name: build-package
+    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+    commands:
+      - uv build --out-dir dist/
+      - ls -lh dist/
+
+  - name: release
+    image: woodpeckerci/plugin-gitea-release
+    settings:
+      api_key:
+        from_secret: gitea_token
+      base_url:
+        from_secret: gitea_url
+      files:
+        - dist/*.whl
+        - dist/*.tar.gz
+      title: "${CI_COMMIT_TAG}"
+    depends_on:
+      - build-package
+
+  # ── Failure reporter ─────────────────────────────────────────
+  - name: report-failure
+    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+    environment:
+      UV_PYTHON_PREFERENCE: only-system
+      UV_LINK_MODE: copy
+      UV_PROJECT_ENVIRONMENT: .venv
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - uv sync --no-dev
+      - uv run python -m api.diag
+    when:
+      - status: [failure]