Add thin-parity-lib-publish template + disposition of #10's 9 repos

generate.py

@@ -120,13 +120,130 @@ steps:
 {attic_teardown}"""
 
 
+SECRET_ENV = {
+    "attic_token": ("ATTIC_TOKEN", "attic_token"),
+    "redis_password": ("REDIS_PASSWORD", "redis_password"),
+}
+
+
+def render_thin(repo: dict) -> str:
+    """Render the "thin parity-lib publish" family (oleks/ci-scripts#10):
+    no inline attic accelerator, publish is a pure `nix run .#publish[-s390x]`
+    front door, optionally gated by a pipeline-doctor step first."""
+    arch = repo["arch"]
+    mem_req = repo["memory_request"]
+    mem_lim = repo["memory_limit"]
+    cores = repo.get("cores")
+    max_jobs = repo.get("max_jobs", False)
+    doctor = repo.get("doctor", False)
+    token_direct = repo.get("token_direct", True)
+    publish_style = repo.get("publish_style", "publish1")
+    tags_full = repo.get("tags_full", False)
+    dead_secrets = repo.get("dead_secrets", [])
+    gitea_clone_token = repo.get("gitea_clone_token", True)
+
+    plugin_tags = "true" if tags_full else "false"
+    plugin_depth = "0" if tags_full else "1"
+
+    doctor_block = ""
+    if doctor:
+        doctor_block = f"""  # ENFORCEMENT gate (cluster #193): run parity-lib's pipeline-doctor --strict
+  # against THIS repo BEFORE publishing. Read-only, no registry contact, no
+  # token. The doctor's non-zero exit fails the pipeline on any parity-contract
+  # violation (or, in --strict, any warning), so a drifted repo never publishes.
+  - name: doctor
+    image: git.oleks.space/oleks/nix-ci-ccpp-rust:latest
+    commands:
+      - echo "▸ arch=$(uname -m)"
+      - nix run git+https://git.oleks.space/oleks/parity-lib#pipeline-doctor -- . --strict
+
+"""
+
+    env_lines = []
+    if gitea_clone_token:
+        env_lines += ["      GITEA_CLONE_TOKEN:", "        from_secret: gitea_clone_token"]
+    if token_direct:
+        env_lines += ["      REGISTRY_TOKEN:", "        from_secret: registry_token"]
+    else:
+        env_lines += ["      CI_REGISTRY_TOKEN:", "        from_secret: registry_token"]
+    for dead in dead_secrets:
+        name, secret = SECRET_ENV[dead]
+        env_lines += [f"      {name}:", f"        from_secret: {secret}"]
+    env_block = "\n".join(env_lines)
+
+    nix_conf_lines = []
+    if max_jobs:
+        nix_conf_lines.append('      - echo "max-jobs = 1" >> /etc/nix/nix.conf')
+    if cores:
+        nix_conf_lines.append(f'      - echo "cores = {cores}" >> /etc/nix/nix.conf')
+    nix_conf_lines.append('      - echo "sandbox = false" >> /etc/nix/nix.conf')
+    nix_conf_block = "\n".join(nix_conf_lines)
+
+    token_remap = ""
+    if not token_direct:
+        token_remap = (
+            "      # Thin parity-lib publish: build + publish all built versions on a v* tag.\n"
+            "      # The mkPyPiWheelPublishMulti app handles staging, idempotent 409-skip\n"
+            "      # uploads, and token resolution (cluster #192/#197, emmett#44).\n"
+            '      - export REGISTRY_TOKEN="$CI_REGISTRY_TOKEN"\n'
+        )
+
+    if publish_style == "publish1":
+        publish_cmd = "      - PUBLISH=1 nix run .#publish"
+    else:
+        publish_cmd = (
+            "      # Same front door as local; --publish flips it out of dry-run.\n"
+            "      - nix run .#publish-s390x -- --publish"
+        )
+
+    return f"""{HEADER}labels:
+  arch: {arch}
+
+clone:
+  - name: clone
+    image: woodpeckerci/plugin-git
+    environment:
+      CI_NETRC_MACHINE: git.oleks.space
+      CI_NETRC_USERNAME: oleks
+      CI_NETRC_PASSWORD:
+        from_secret: gitea_clone_token
+      PLUGIN_TAGS: "{plugin_tags}"
+      PLUGIN_DEPTH: "{plugin_depth}"
+
+when:
+  - event: tag
+    ref: "refs/tags/v*"
+steps:
+{doctor_block}  - name: publish
+    image: git.oleks.space/oleks/nix-ci-ccpp-rust:latest
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: {mem_req}
+          limits:
+            memory: {mem_lim}
+    environment:
+{env_block}
+    commands:
+      - echo "▸ arch=$(uname -m)"
+      - echo "nameserver 169.254.20.10" > /etc/resolv.conf && echo "options ndots:1" >> /etc/resolv.conf
+{nix_conf_block}
+      - nixos-ci-entrypoint true
+{token_remap}{publish_cmd}
+"""
+
+
 def main():
     manifest = yaml.safe_load((HERE / "manifest.yaml").read_text())
     check_only = "--check" in sys.argv
     changed = []
-    for repo in manifest["repos"]:
+    jobs = [(r, render) for r in manifest["repos"]] + [
+        (r, render_thin) for r in manifest.get("thin_repos", [])
+    ]
+    for repo, render_fn in jobs:
         target = BUILDING / repo["dir"] / ".woodpecker.yaml"
-        rendered = render(repo)
+        rendered = render_fn(repo)
         if check_only:
             current = target.read_text() if target.exists() else ""
             if current != rendered: