feat: Woodpecker-Plugin bump (Entwurf)

Setzt Version und Tag für den gepushten Branch wie bump-version, dazu hotfix/* -> beta, Bump nur des auslösenden Commits, [skip ci] im Bump-Commit. Nutzer und Autor oumta-ci, Secret oumta_ci_token (oumta-deploy docs/zugaenge.md). plugins.yaml baut beide Plugins. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci: plugin-docker-buildx:6 wie in WOODPECKER_PLUGINS_PRIVILEGED
2026-10-30 17:13:03 +01:00 · 2026-10-30 15:31:43 +01:00 · 2026-10-30 15:21:49 +01:00
2 changed files with 14 additions and 10 deletions
@@ -26,9 +26,10 @@ steps:
      context: woodpecker/deploy
      dockerfile: woodpecker/deploy/Dockerfile
      tags: ${CI_COMMIT_TAG##deploy-}
-      username: oumta-ci
+      username:
+        from_secret: registry_username
      password:
-        from_secret: oumta_ci_token
+        from_secret: registry_password
    when:
      event: tag
      ref: refs/tags/deploy-v*
@@ -52,9 +53,10 @@ steps:
      context: woodpecker/bump
      dockerfile: woodpecker/bump/Dockerfile
      tags: ${CI_COMMIT_TAG##bump-}
-      username: oumta-ci
+      username:
+        from_secret: registry_username
      password:
-        from_secret: oumta_ci_token
+        from_secret: registry_password
    when:
      event: tag
      ref: refs/tags/bump-v*
@@ -129,8 +129,8 @@ Writes a pushed dev or beta image with its digest to `tanztee/oumta-deploy` (D16
 Settings:

 - `var` (required): variable in `envs/<env>/images.env`, e.g. `AUTH_IMAGE`. `{major}` is replaced by the major of the tag (`APP_V{major}_IMAGE` -> `APP_V2_IMAGE`).
- `deploy_token` (required): token of `oumta-ci` (`oumta_ci_token`), write access to oumta-deploy
- `registry_username`, `registry_password`: read access to the registry for the digest (`oumta-ci` with the same token)
+- `deploy_token` (required): token of `oumta-ci`, write access to oumta-deploy only. Limit the secret to this image and the events `tag` and `manual`.
+- `registry_username`, `registry_password`: read access to the registry for the digest
 - `envs`: fixed environments instead of the tag rule, e.g. `dev beta` (oumta-keyklo)
 - `tag`: default `CI_COMMIT_TAG`
 - `registry`: default `git.uesome.de`
@@ -152,17 +152,19 @@ steps:
      registry: git.uesome.de
      repo: git.uesome.de/tanztee/oumta-auth
      tags: ${CI_COMMIT_TAG}
-      username: oumta-ci
+      username:
+        from_secret: registry_username
      password:
-        from_secret: oumta_ci_token
+        from_secret: registry_password

  - name: deploy
    image: git.uesome.de/actions/ci-cd/deploy:v1.0.0
    settings:
      var: AUTH_IMAGE
-      registry_username: oumta-ci
+      registry_username:
+        from_secret: registry_username
      registry_password:
-        from_secret: oumta_ci_token
+        from_secret: registry_password
      deploy_token:
        from_secret: oumta_ci_token
 ```