# Manifest for the "pypi-wheel-attic" Woodpecker template (template.yaml.py). # # Scope note (oleks/ci-scripts#1): only repos that share the SAME pipeline # shape (single build-and-publish step, inline `attic watch-store` accelerator # optional, PLUGIN_TAGS=false/PLUGIN_DEPTH=1) are templated here. # # A second family ("thin parity-lib publish": no inline attic, pure # `nix run .#publish[-s390x]` front door) is templated separately below under # `thin_repos:` — see oleks/ci-scripts#10 for the re-audit that found which of # the originally-suspected 9 repos actually belong there, and which don't # (scikit-learn-s390x/scipy-s390x turned out to be attic+redis shaped like # THIS family, but their Redis setup writes to a file via heredoc rather than # exporting directly — a real behavioral difference from tiktoken-s390x's # style, not confirmed safe to normalize, so left hand-maintained rather than # forced into either template). # # Fields: # dir - path relative to ~/projects/building/ # arch - node-pinning label (oleks/ci-scripts#5): amd64 (cross-build # host) or arm64 (native build host) # memory_request / memory_limit - k8s resource sizing # cores - Nix `cores` setting written into /etc/nix/nix.conf # max_jobs - whether to also cap `max-jobs = 1` (small/serial builds) # attic - whether to run the inline `attic watch-store` accelerator # no_build - if true, render a NEUTRALIZED pipeline (event: manual, no # build/publish). s390x = no-build: s390x hardware is # currently UNAVAILABLE, so those wheels are not built — # the repo code is kept as a cross-compile reference only. # Entries under s390x/ default to no_build even without the # flag (generate.py is_no_build). Re-enable by setting # no_build: false. arm64 builds are unaffected (arm64 hw is # available). See wiki Spec/* + memory feedback-no-s390x-builds. repos: - dir: s390x/lxml-s390x no_build: true arch: amd64 memory_request: 2Gi memory_limit: 6Gi cores: 2 max_jobs: true attic: true - dir: s390x/pillow-s390x no_build: true arch: amd64 memory_request: 6Gi memory_limit: 6Gi cores: 2 max_jobs: true attic: true - dir: s390x/psycopg-s390x no_build: true arch: amd64 memory_request: 6Gi memory_limit: 6Gi cores: 2 max_jobs: true attic: true - dir: s390x/psycopg2-binary-s390x no_build: true arch: amd64 memory_request: 6Gi memory_limit: 6Gi cores: 2 max_jobs: true attic: true - dir: s390x/tiktoken-s390x no_build: true arch: amd64 memory_request: 6Gi memory_limit: 6Gi cores: 2 max_jobs: true attic: true redis_cache: true - dir: s390x/duckdb-s390x no_build: true arch: amd64 memory_request: 8Gi memory_limit: 32Gi cores: 4 max_jobs: true attic: true - dir: s390x/faiss-cpu-s390x no_build: true arch: amd64 memory_request: 8Gi memory_limit: 32Gi cores: 4 max_jobs: true attic: true - dir: s390x/numpy-s390x no_build: true arch: amd64 memory_request: 8Gi memory_limit: 32Gi cores: 4 max_jobs: true attic: true - dir: s390x/pymupdf-s390x no_build: true arch: amd64 memory_request: 8Gi memory_limit: 50Gi cores: null max_jobs: false attic: true - dir: s390x/markupsafe-s390x no_build: true arch: amd64 memory_request: 2Gi memory_limit: 6Gi cores: 2 max_jobs: true attic: false # Second family (oleks/ci-scripts#10): "thin parity-lib publish" — no inline # attic accelerator, publish is a pure `nix run .#publish[-s390x]` front door. # Real variance across this family (verified per-repo, not assumed): # doctor - whether a `pipeline-doctor --strict` gate step runs first # token_direct - true: REGISTRY_TOKEN straight from secret # false: CI_REGISTRY_TOKEN from secret + explicit # `export REGISTRY_TOKEN="$CI_REGISTRY_TOKEN"` remap # publish_style - "publish1": `PUBLISH=1 nix run .#publish` # "publish-arch": `nix run .#publish-s390x -- --publish` # tags_full - true: PLUGIN_TAGS=true/PLUGIN_DEPTH=0 (full clone, tags) # false: PLUGIN_TAGS=false/PLUGIN_DEPTH=1 # dead_secrets - ATTIC_TOKEN/REDIS_PASSWORD declared in `environment:` but # never referenced in `commands:` on some repos (pre-existing # dead config, preserved as-is here — not this issue's scope # to clean up) # # Excluded after re-audit (documented, not forced): # - fastuuid-s390x: declares CI_REGISTRY_TOKEN but has NO # `export REGISTRY_TOKEN=...` remap before `PUBLISH=1 nix run .#publish` # (cryptography-s390x, the only other CI_REGISTRY_TOKEN user, DOES have # the remap). This looks like a real latent bug — publish would run with # REGISTRY_TOKEN unset. Not silently "fixed" via templating; flagged # separately, left untouched. # - onnxruntime-s390x: same CI_REGISTRY_TOKEN-without-remap pattern as # fastuuid, AND it's actually attic+redis shaped (single step) like the # family above, not this one — a template would have to either paper over # the missing remap or diverge from every other repo's shape. Left as a # bespoke hand-maintained file; flagged alongside fastuuid. thin_repos: - dir: s390x/asyncpg-s390x no_build: true arch: amd64 memory_request: 8Gi memory_limit: 32Gi doctor: true token_direct: true publish_style: publish1 tags_full: true dead_secrets: [] gitea_clone_token: false - dir: s390x/cryptography-s390x no_build: true arch: amd64 memory_request: 8Gi memory_limit: 32Gi cores: 4 max_jobs: true doctor: false token_direct: false publish_style: publish1 tags_full: false dead_secrets: [attic_token, redis_password] - dir: s390x/lightningcss-s390x no_build: true arch: amd64 memory_request: 8Gi memory_limit: 32Gi doctor: false token_direct: true publish_style: publish-arch tags_full: true dead_secrets: [attic_token, redis_password] - dir: s390x/nextjs-swc-s390x no_build: true arch: amd64 memory_request: 8Gi memory_limit: 50Gi doctor: false token_direct: true publish_style: publish-arch tags_full: true dead_secrets: [attic_token, redis_password] - dir: s390x/rollup-s390x no_build: true arch: amd64 memory_request: 8Gi memory_limit: 32Gi doctor: false token_direct: true publish_style: publish-arch tags_full: true dead_secrets: [attic_token, redis_password]