ci-scripts/manifest.yaml

# Manifest for the "pypi-wheel-attic" Woodpecker template (template.yaml.py).
#
# Scope note (oleks/ci-scripts#1): only repos that share the SAME pipeline
# shape (single build-and-publish step, inline `attic watch-store` accelerator
# optional, PLUGIN_TAGS=false/PLUGIN_DEPTH=1) are templated here.
#
# A second family ("thin parity-lib publish": no inline attic, pure
# `nix run .#publish[-s390x]` front door) is templated separately below under
# `thin_repos:` — see oleks/ci-scripts#10 for the re-audit that found which of
# the originally-suspected 9 repos actually belong there, and which don't
# (scikit-learn-s390x/scipy-s390x turned out to be attic+redis shaped like
# THIS family, but their Redis setup writes to a file via heredoc rather than
# exporting directly — a real behavioral difference from tiktoken-s390x's
# style, not confirmed safe to normalize, so left hand-maintained rather than
# forced into either template).
#
# Fields:
#   dir            - path relative to ~/projects/building/
#   arch            - node-pinning label (oleks/ci-scripts#5): amd64 (cross-build
#                     host) or arm64 (native build host)
#   memory_request / memory_limit - k8s resource sizing
#   cores          - Nix `cores` setting written into /etc/nix/nix.conf
#   max_jobs       - whether to also cap `max-jobs = 1` (small/serial builds)
#   attic          - whether to run the inline `attic watch-store` accelerator

repos:
  - dir: s390x/lxml-s390x
    arch: amd64
    memory_request: 2Gi
    memory_limit: 6Gi
    cores: 2
    max_jobs: true
    attic: true
  - dir: s390x/pillow-s390x
    arch: amd64
    memory_request: 6Gi
    memory_limit: 6Gi
    cores: 2
    max_jobs: true
    attic: true
  - dir: s390x/psycopg-s390x
    arch: amd64
    memory_request: 6Gi
    memory_limit: 6Gi
    cores: 2
    max_jobs: true
    attic: true
  - dir: s390x/psycopg2-binary-s390x
    arch: amd64
    memory_request: 6Gi
    memory_limit: 6Gi
    cores: 2
    max_jobs: true
    attic: true
  - dir: s390x/tiktoken-s390x
    arch: amd64
    memory_request: 6Gi
    memory_limit: 6Gi
    cores: 2
    max_jobs: true
    attic: true
    redis_cache: true
  - dir: s390x/duckdb-s390x
    arch: amd64
    memory_request: 8Gi
    memory_limit: 32Gi
    cores: 4
    max_jobs: true
    attic: true
  - dir: s390x/faiss-cpu-s390x
    arch: amd64
    memory_request: 8Gi
    memory_limit: 32Gi
    cores: 4
    max_jobs: true
    attic: true
  - dir: s390x/numpy-s390x
    arch: amd64
    memory_request: 8Gi
    memory_limit: 32Gi
    cores: 4
    max_jobs: true
    attic: true
  - dir: s390x/pymupdf-s390x
    arch: amd64
    memory_request: 8Gi
    memory_limit: 50Gi
    cores: null
    max_jobs: false
    attic: true
  - dir: s390x/markupsafe-s390x
    arch: amd64
    memory_request: 2Gi
    memory_limit: 6Gi
    cores: 2
    max_jobs: true
    attic: false

# Second family (oleks/ci-scripts#10): "thin parity-lib publish" — no inline
# attic accelerator, publish is a pure `nix run .#publish[-s390x]` front door.
# Real variance across this family (verified per-repo, not assumed):
#   doctor        - whether a `pipeline-doctor --strict` gate step runs first
#   token_direct  - true: REGISTRY_TOKEN straight from secret
#                   false: CI_REGISTRY_TOKEN from secret + explicit
#                   `export REGISTRY_TOKEN="$CI_REGISTRY_TOKEN"` remap
#   publish_style - "publish1": `PUBLISH=1 nix run .#publish`
#                   "publish-arch": `nix run .#publish-s390x -- --publish`
#   tags_full     - true: PLUGIN_TAGS=true/PLUGIN_DEPTH=0 (full clone, tags)
#                   false: PLUGIN_TAGS=false/PLUGIN_DEPTH=1
#   dead_secrets  - ATTIC_TOKEN/REDIS_PASSWORD declared in `environment:` but
#                   never referenced in `commands:` on some repos (pre-existing
#                   dead config, preserved as-is here — not this issue's scope
#                   to clean up)
#
# Excluded after re-audit (documented, not forced):
#   - fastuuid-s390x: declares CI_REGISTRY_TOKEN but has NO
#     `export REGISTRY_TOKEN=...` remap before `PUBLISH=1 nix run .#publish`
#     (cryptography-s390x, the only other CI_REGISTRY_TOKEN user, DOES have
#     the remap). This looks like a real latent bug — publish would run with
#     REGISTRY_TOKEN unset. Not silently "fixed" via templating; flagged
#     separately, left untouched.
#   - onnxruntime-s390x: same CI_REGISTRY_TOKEN-without-remap pattern as
#     fastuuid, AND it's actually attic+redis shaped (single step) like the
#     family above, not this one — a template would have to either paper over
#     the missing remap or diverge from every other repo's shape. Left as a
#     bespoke hand-maintained file; flagged alongside fastuuid.
thin_repos:
  - dir: s390x/asyncpg-s390x
    arch: amd64
    memory_request: 8Gi
    memory_limit: 32Gi
    doctor: true
    token_direct: true
    publish_style: publish1
    tags_full: true
    dead_secrets: []
    gitea_clone_token: false
  - dir: s390x/cryptography-s390x
    arch: amd64
    memory_request: 8Gi
    memory_limit: 32Gi
    cores: 4
    max_jobs: true
    doctor: false
    token_direct: false
    publish_style: publish1
    tags_full: false
    dead_secrets: [attic_token, redis_password]
  - dir: s390x/lightningcss-s390x
    arch: amd64
    memory_request: 8Gi
    memory_limit: 32Gi
    doctor: false
    token_direct: true
    publish_style: publish-arch
    tags_full: true
    dead_secrets: [attic_token, redis_password]
  - dir: s390x/nextjs-swc-s390x
    arch: amd64
    memory_request: 8Gi
    memory_limit: 50Gi
    doctor: false
    token_direct: true
    publish_style: publish-arch
    tags_full: true
    dead_secrets: [attic_token, redis_password]
  - dir: s390x/rollup-s390x
    arch: amd64
    memory_request: 8Gi
    memory_limit: 32Gi
    doctor: false
    token_direct: true
    publish_style: publish-arch
    tags_full: true
    dead_secrets: [attic_token, redis_password]