ci: fix woodpecker pipeline — kaniko pattern matching mosaic-stack

- Switch from plugins/kaniko to gcr.io/kaniko-project/executor:debug
- Use gitea_username/gitea_token secret names (matches org pattern)
- Use YAML anchor for docker config setup
- Fix image destination to use shell variable (YAML anchors don't expand in commands)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.woodpecker/build.yml

@@ -1,49 +1,48 @@
+variables:
+  - &image git.mosaicstack.dev/mosaic/openbrain
+  - &kaniko_setup |
+      mkdir -p /kaniko/.docker
+      echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$GITEA_USER\",\"password\":\"$GITEA_TOKEN\"}}}" > /kaniko/.docker/config.json
+
 when:
   - event: push
     branch: main
   - event: tag
 
-variables:
-  - &registry git.mosaicstack.dev
-  - &image git.mosaicstack.dev/mosaic/openbrain
-
 steps:
   lint:
     image: python:3.12-slim
     commands:
-      - pip install ruff --quiet
+      - pip install ruff --quiet --no-cache-dir
       - ruff check src/
       - ruff format --check src/
 
   build:
-    image: plugins/kaniko
+    image: gcr.io/kaniko-project/executor:debug
-    settings:
+    environment:
-      registry: *registry
+      GITEA_USER:
-      repo: *image
+        from_secret: gitea_username
-      tags:
+      GITEA_TOKEN:
-        - sha-${CI_COMMIT_SHA:0:8}
+        from_secret: gitea_token
-        - latest
+      CI_COMMIT_SHA: ${CI_COMMIT_SHA}
-      username:
+      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-        from_secret: GITEA_USERNAME
+      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      password:
+    commands:
-        from_secret: GITEA_TOKEN
+      - *kaniko_setup
-      build_args:
+      - |
-        - BUILDKIT_INLINE_CACHE=1
+        IMAGE=git.mosaicstack.dev/mosaic/openbrain
-    when:
+        SHORT_SHA=$(echo "$CI_COMMIT_SHA" | cut -c1-8)
-      - event: push
+        DESTINATIONS="--destination $IMAGE:sha-$SHORT_SHA"
-        branch: main
+        if [ -n "$CI_COMMIT_TAG" ]; then
-
+          DESTINATIONS="$DESTINATIONS --destination $IMAGE:$CI_COMMIT_TAG"
-  build-tag:
+        fi
-    image: plugins/kaniko
+        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
-    settings:
+          DESTINATIONS="$DESTINATIONS --destination $IMAGE:latest"
-      registry: *registry
+        fi
-      repo: *image
+        /kaniko/executor \
-      tags:
+          --context . \
-        - ${CI_COMMIT_TAG}
+          --dockerfile Dockerfile \
-        - sha-${CI_COMMIT_SHA:0:8}
+          --snapshot-mode=redo \
-      username:
+          $DESTINATIONS
-        from_secret: GITEA_USERNAME
+    depends_on:
-      password:
+      - lint
-        from_secret: GITEA_TOKEN
-    when:
-      - event: tag