v1.4.2

Two bug fixes. No new features, no breaking changes.

rake scan now works where trivy has no container runtime socket

Trivy was handed a bare image reference. It resolves local images through a runtime socket, and there is none inside the woodpecker-crucible container — on rootless podman it also probes a relative podman/podman.sock and so misses $XDG_RUNTIME_DIR/podman/podman.sock. With no socket it fell through to its remote resolver and tried to pull the digest from Docker Hub:

unable to find the specified image "sha256:..." in [docker containerd podman remote]
remote error: GET https://index.docker.io/v2/library/sha256/manifests/...
UNAUTHORIZED: authentication required

The task now exports the image with podman save --format docker-archive and scans it with --input. No socket, no registry, no auth. Passing a tag instead of the digest does not help — the problem is the missing socket, not the reference format.

This went unnoticed because the older hand-written pipelines never ran rake scan; the rake woodpecker generator added the step and exposed it.

A VERSION/VARIANT filter matching no image now fails

$images.select! silently emptied the list, and every task then iterated nothing and exited 0: rake build built none, rake tag tagged none, rake push pushed none. A completely green pipeline that produced no artifact.

This was hit after renaming a version key in metadata.yaml while the committed .woodpecker/build.yaml still passed the old VERSION. The pipeline went green in six seconds and the problem only surfaced when a downstream deploy could not pull an image that had never been published.

An empty filter result now aborts, listing the versions and variants that do exist and pointing at rake woodpecker to regenerate a stale pipeline. The guard sits at the filter, so it covers every task at once.

Upgrading

rake update && rake template

Repos carrying a local/tasks/scan.rake override for the first bug can drop it after upgrading.