ci: fix woodpecker pipeline — kaniko pattern matching mosaic-stack

- Switch from plugins/kaniko to gcr.io/kaniko-project/executor:debug
- Use gitea_username/gitea_token secret names (matches org pattern)
- Use YAML anchor for docker config setup
- Fix image destination to use shell variable (YAML anchors don't expand in commands)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.woodpecker/build.yml

@@ -1,49 +1,48 @@
+variables:
+  - &image git.mosaicstack.dev/mosaic/openbrain
+  - &kaniko_setup |
+      mkdir -p /kaniko/.docker
+      echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$GITEA_USER\",\"password\":\"$GITEA_TOKEN\"}}}" > /kaniko/.docker/config.json
+
 when:
   - event: push
     branch: main
   - event: tag
 
-variables:
-  - &registry git.mosaicstack.dev
-  - &image git.mosaicstack.dev/mosaic/openbrain
-
 steps:
   lint:
     image: python:3.12-slim
     commands:
-      - pip install ruff --quiet
+      - pip install ruff --quiet --no-cache-dir
       - ruff check src/
       - ruff format --check src/
 
   build:
-    image: plugins/kaniko
-    settings:
-      registry: *registry
-      repo: *image
-      tags:
-        - sha-${CI_COMMIT_SHA:0:8}
-        - latest
-      username:
-        from_secret: GITEA_USERNAME
-      password:
-        from_secret: GITEA_TOKEN
-      build_args:
-        - BUILDKIT_INLINE_CACHE=1
-    when:
-      - event: push
-        branch: main
-
-  build-tag:
-    image: plugins/kaniko
-    settings:
-      registry: *registry
-      repo: *image
-      tags:
-        - ${CI_COMMIT_TAG}
-        - sha-${CI_COMMIT_SHA:0:8}
-      username:
-        from_secret: GITEA_USERNAME
-      password:
-        from_secret: GITEA_TOKEN
-    when:
-      - event: tag
+    image: gcr.io/kaniko-project/executor:debug
+    environment:
+      GITEA_USER:
+        from_secret: gitea_username
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      CI_COMMIT_SHA: ${CI_COMMIT_SHA}
+      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
+      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
+    commands:
+      - *kaniko_setup
+      - |
+        IMAGE=git.mosaicstack.dev/mosaic/openbrain
+        SHORT_SHA=$(echo "$CI_COMMIT_SHA" | cut -c1-8)
+        DESTINATIONS="--destination $IMAGE:sha-$SHORT_SHA"
+        if [ -n "$CI_COMMIT_TAG" ]; then
+          DESTINATIONS="$DESTINATIONS --destination $IMAGE:$CI_COMMIT_TAG"
+        fi
+        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
+          DESTINATIONS="$DESTINATIONS --destination $IMAGE:latest"
+        fi
+        /kaniko/executor \
+          --context . \
+          --dockerfile Dockerfile \
+          --snapshot-mode=redo \
+          $DESTINATIONS
+    depends_on:
+      - lint