---
# Golden runner image self-rebuild pipeline.
# Repo: infra/buildkit-runner-golden (Forgejo, libre-daoshi instance)
# Schedule: weekly Sunday 03:00 UTC — satisfies ADR-039 constraint golden-image-rebuild-cadence.
#
# This pipeline runs on a Woodpecker agent (k8s pod in daoshi), not on an
# ephemeral runner. The nushell-hcloud tool image provides nu + hcloud CLI.
# build-golden-image.nu provisions a fresh seed VM, bakes the snapshot, then
# destroys the seed — the ephemeral runner infra is the output, not the vehicle.

cron:
  rebuild-golden:
    schedule: "0 3 * * 0"
    branch: main

when:
  - event: cron
    cron: rebuild-golden

steps:
  rebuild-golden-image:
    image: reg.librecloud.online/images/nushell-hcloud:latest
    environment:
      PROVISIONING_REPO: https://forgejo.librecloud.online/librecloud/provisioning
    secrets:
      - hcloud_token
      - orchestrator_ssh_key_name
    commands:
      - git clone --depth 1 $PROVISIONING_REPO /tmp/provisioning
      - >-
        HCLOUD_TOKEN=$HCLOUD_TOKEN
        nu /tmp/provisioning/extensions/components/buildkit_runner/scripts/build-golden-image.nu
        --location fsn1
        --server_type cax21
        --ssh_key $ORCHESTRATOR_SSH_KEY_NAME

  gc-old-snapshots:
    image: reg.librecloud.online/images/nushell-hcloud:latest
    secrets:
      - hcloud_token
    commands:
      - git clone --depth 1 $PROVISIONING_REPO /tmp/provisioning
      - >-
        HCLOUD_TOKEN=$HCLOUD_TOKEN
        nu /tmp/provisioning/extensions/components/buildkit_runner/scripts/gc-snapshots.nu
        --keep 4
    environment:
      PROVISIONING_REPO: https://forgejo.librecloud.online/librecloud/provisioning
    depends_on: [rebuild-golden-image]