stack/.woodpecker/deploy.yml

# ── Deploy ───────────────────────────────────────────────────────
# Builds the Python package, pushes it to Gitea's PyPI registry,
# then builds, scans, and pushes container images.
# Only runs on pushes to main (i.e. after PR merge).

when:
  - event: push
    branch: main

steps:
  # ── Python package ──────────────────────────────────────────
  - name: build-package
    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
    commands:
      # Stamp a unique version using Woodpecker pipeline number
      - BASE=$(grep '^version' pyproject.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
      - uv version "$BASE.dev${CI_PIPELINE_NUMBER}" --no-sync
      - uv build --out-dir dist/
      - ls -lh dist/

  - name: publish-package
    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
    environment:
      REGISTRY_USER:
        from_secret: registry_user
      REGISTRY_PASS:
        from_secret: registry_pass
    commands:
      - uv publish --publish-url http://gitea:3000/api/packages/homelab/pypi --username "$REGISTRY_USER" --password "$REGISTRY_PASS" dist/*
    depends_on:
      - build-package

  # ── Notebooks image ─────────────────────────────────────────
  - name: build-notebooks
    image: docker:cli
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
      - docker build -t localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8} ./notebooks
      - docker tag localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8} localhost:3000/homelab/notebooks:latest
    when:
      - path: "notebooks/**"

  - name: scan-notebooks
    image: aquasec/trivy:latest
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8}
      - trivy image --severity HIGH,CRITICAL --format json -o notebooks-scan.json localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8}
    depends_on:
      - build-notebooks
    when:
      - path: "notebooks/**"

  - name: push-notebooks
    image: docker:cli
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    environment:
      REGISTRY_USER:
        from_secret: registry_user
      REGISTRY_PASS:
        from_secret: registry_pass
    commands:
      - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
      - docker push localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8}
      - docker push localhost:3000/homelab/notebooks:latest
    depends_on:
      - scan-notebooks
    when:
      - path: "notebooks/**"

  # ── Zotero image ────────────────────────────────────────────
  - name: build-zotero
    image: docker:cli
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
      - docker build -t localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8} ./zotero
      - docker tag localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8} localhost:3000/homelab/zotero:latest
    when:
      - path: "zotero/**"

  - name: scan-zotero
    image: aquasec/trivy:latest
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8}
      - trivy image --severity HIGH,CRITICAL --format json -o zotero-scan.json localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8}
    depends_on:
      - build-zotero
    when:
      - path: "zotero/**"

  - name: push-zotero
    image: docker:cli
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    environment:
      REGISTRY_USER:
        from_secret: registry_user
      REGISTRY_PASS:
        from_secret: registry_pass
    commands:
      - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
      - docker push localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8}
      - docker push localhost:3000/homelab/zotero:latest
    depends_on:
      - scan-zotero
    when:
      - path: "zotero/**"

  # ── Upload scan results ─────────────────────────────────────
  - name: upload-notebooks-scan
    image: woodpeckerci/plugin-s3
    settings:
      endpoint: http://rustfs:9000
      bucket: gitea
      access_key:
        from_secret: s3_access_key
      secret_key:
        from_secret: s3_secret_key
      source: "notebooks-scan.json"
      target: /ci/${CI_REPO}/${CI_COMMIT_SHA:0:8}/
      path_style: true
    depends_on:
      - scan-notebooks
    when:
      - path: "notebooks/**"

  - name: upload-zotero-scan
    image: woodpeckerci/plugin-s3
    settings:
      endpoint: http://rustfs:9000
      bucket: gitea
      access_key:
        from_secret: s3_access_key
      secret_key:
        from_secret: s3_secret_key
      source: "zotero-scan.json"
      target: /ci/${CI_REPO}/${CI_COMMIT_SHA:0:8}/
      path_style: true
    depends_on:
      - scan-zotero
    when:
      - path: "zotero/**"