fix(hermes): push the Hermes image as registry-bot

registry-bot is the konairius registry identity: write:package PAT, konairius org secret registry_bot_token, rotated by openbao/rotation/registry-bot.yaml. That rotation syncs the secret for the push, tag, release and manual events, so the manual trigger is `event: manual` instead of a deployment target. registry_bot_token is a konairius org secret. Woodpecker resolves org secrets through the repo's org link, so this pipeline gets it only once homelab has moved to konairius/homelab (docs/superpowers/plans/2026-10-18-homelab-konairius-main.md, cut-over 1).
2026-10-19 08:17:23 +00:00
1 changed files with 4 additions and 5 deletions
@@ -6,20 +6,19 @@ when:
    path:
      - "ci/images/hermes/**"
      - ".woodpecker/hermes-image.yml"
-  - event: deployment
-    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "hermes-image"'
+  - event: manual

 steps:
  - name: build
    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.19-debug@sha256:7795cec509a50a71378cc2c365f55c555ee3a05834d8eb1cd2552df5e66d44d8
    directory: ci/images/hermes
    environment:
-      GITEA_USER: gitea_admin
+      # registry-bot write:package PAT (konairius org secret).
      GITEA_TOKEN:
-        from_secret: ci_images_token
+        from_secret: registry_bot_token
    commands:
      - mkdir -p /kaniko/.docker
-      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
+      - AUTH=$(printf '%s:%s' registry-bot "$GITEA_TOKEN" | base64 | tr -d '\n')
      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
      - TAG="build.$(date +%s)"
      - |