ci: align workflows with native Woodpecker agents

.woodpecker/ci.yml

@@ -1,6 +1,10 @@
 when:
   - event: [push, manual]
 
+labels:
+  ci: domain-linux-native
+  platform: linux/amd64
+
 clone:
   - name: git
     image: woodpeckerci/plugin-git:2.9.3
@@ -11,14 +15,14 @@ clone:
 
 steps:
   api-contract:
-    image: node:24.21.0-alpine3.23
+    image: bash
     commands:
       - node scripts/check-api-contract.mjs
 
   core-and-web:
-    image: node:24.21.0-alpine3.23
-    directory: packages/core
+    image: bash
     commands:
+      - cd packages/core
       - npm ci
       - npm run typecheck
       - npm test
@@ -26,9 +30,9 @@ steps:
       - npm run build
 
   web:
-    image: node:24.21.0-alpine3.23
-    directory: web
+    image: bash
     commands:
+      - cd web
       - npm ci
       - npm run typecheck
       - npm run lint:css
@@ -36,11 +40,6 @@ steps:
       - npm run build
 
   server:
-    image: mcr.microsoft.com/dotnet/sdk:10.0
+    image: bash
     commands:
       - dotnet test server/WebDrop.slnx --configuration Release --verbosity minimal
-
-  compose-config:
-    image: docker:29.8.1-cli-alpine3.24
-    commands:
-      - docker compose --env-file .env.example config --quiet

.woodpecker/release-backend.yml

@@ -2,6 +2,10 @@ when:
   - event: tag
     ref: refs/tags/v*
 
+labels:
+  ci: domain-linux-native
+  platform: linux/amd64
+
 clone:
   - name: git
     image: woodpeckerci/plugin-git:2.9.3
@@ -12,26 +16,23 @@ clone:
 
 steps:
   release-checks:
-    image: mcr.microsoft.com/dotnet/sdk:10.0
-    commands:
-      - dotnet test server/WebDrop.slnx --configuration Release --verbosity minimal
-
-  validate-release:
-    image: node:24.21.0-alpine3.23
+    image: bash
     commands:
       - node scripts/check-api-contract.mjs "$CI_COMMIT_TAG"
+      - dotnet test server/WebDrop.slnx --configuration Release --verbosity minimal
 
   publish-backend:
-    image: woodpeckerci/plugin-docker-buildx:5.0.0
-    privileged: true
-    settings:
-      context: .
-      dockerfile: server/Dockerfile
-      platforms: linux/amd64
-      repo: zot.oeo.one/justme/webdrop-api
-      registry: zot.oeo.one
-      tags: ${CI_COMMIT_TAG}
-      username:
+    image: bash
+    environment:
+      ZOT_USERNAME:
         from_secret: registry_username
-      password:
+      ZOT_PASSWORD:
         from_secret: registry_password
+      ZOT_REGISTRY: zot.oeo.one
+    commands:
+      - set -euo pipefail
+      - printf '%s' "$ZOT_PASSWORD" | buildah login "$ZOT_REGISTRY" --username "$ZOT_USERNAME" --password-stdin
+      - trap 'buildah logout "$ZOT_REGISTRY" >/dev/null 2>&1 || true' EXIT
+      - image="$ZOT_REGISTRY/justme/webdrop-api:$CI_COMMIT_TAG"
+      - buildah bud --format docker --platform linux/amd64 --tag "$image" --file server/Dockerfile .
+      - buildah push "$image" "docker://$image"

docs/deployment.md

@@ -34,9 +34,9 @@ CAPTCHA_SECRET=<server-side-secret>
 
 ## Woodpecker CI
 
-`.woodpecker/ci.yml` 在 push 和手动运行时执行 API 契约、Core、Web、服务端检查，并解析后端 Compose 配置。每次 push 都会构建前端。`.woodpecker/release-backend.yml` 仅响应 `vMAJOR.MINOR.PATCH` SemVer tag；测试通过后构建并推送同名后端镜像 tag。两者都通过 Woodpecker secret `gitea_clone_webdrop` 从 `https://git.oeo.one` 克隆私有仓库。
+`.woodpecker/ci.yml` 在 push 和手动运行时执行 API 契约、Core、Web、服务端检查；每次 push 都会构建前端。`.woodpecker/release-backend.yml` 仅响应 `vMAJOR.MINOR.PATCH` SemVer tag；测试通过后用 Linux native agent 的 Buildah 构建并推送同名后端镜像 tag。两者都通过 Woodpecker secret `gitea_clone_webdrop` 从 `https://git.oeo.one` 克隆私有仓库。
 
-后端镜像发布到 `zot.oeo.one/justme/webdrop-api`。在 Woodpecker 仓库配置 tag 事件可用的 secrets `registry_username`、`registry_password`。Docker Buildx 发布步骤以特权模式运行；Woodpecker Agent 必须将仓库设为 security trusted，并把 `woodpeckerci/plugin-docker-buildx:5.0.0` 加入服务端的 `WOODPECKER_PLUGINS_PRIVILEGED`。使用已发布镜像时，在 `.env` 中设置 `WEBDROP_IMAGE_TAG`；仓库名已填入 `.env.example`。
+后端镜像发布到 `zot.oeo.one/justme/webdrop-api`。在 Woodpecker 仓库配置 tag 事件可用的 secrets `registry_username`、`registry_password`。发布步骤要求 Linux native agent 安装 Buildah；使用已发布镜像时，在 `.env` 中设置 `WEBDROP_IMAGE_TAG`，仓库名已填入 `.env.example`。
 
 API 契约版本以 `contracts/api-contract.json` 为准，并同步到 OpenAPI 与后端 `/api/v1/info`。加字段等向后兼容更新递增 minor，兼容性修复递增 patch，破坏性更新递增 major。前端声明支持的契约主版本；后端主版本变化时，前端 CI 契约检查和运行时连接检查都会失败，直到前端同步支持该主版本。