From 11ee636988529a0c2c9d306b4b7373b67f546aea Mon Sep 17 00:00:00 2001
From: garrettmills <shout@garrettmills.dev>
Date: Mon, 21 Sep 2026 23:39:58 -0500
Subject: [PATCH] Update CI config

---
 .woodpecker.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.woodpecker.yaml b/.woodpecker.yaml
index 4db6daf..c689282 100644
--- a/.woodpecker.yaml
+++ b/.woodpecker.yaml
@@ -7,8 +7,13 @@ steps:
   - name: build-and-push
     # Pinned: WOODPECKER_PLUGINS_PRIVILEGED on the server must allow this exact
     # image:tag, so a floating tag here would silently break the build.
+    #
+    # Deliberately NO `privileged: true` here -- that flag requires repo-level
+    # "security" trust and is rejected without it. The server-side allowlist
+    # escalates this step instead, but only while it stays a *plugin*: adding
+    # `commands`, `entrypoint`, or `environment` to this step silently drops
+    # the escalation and buildx's inner daemon will fail to start.
     image: woodpeckerci/plugin-docker-buildx:6.1.1
-    privileged: true
     settings:
       registry: registry.apps.millslan.net
       repo: registry.apps.millslan.net/starship/coreid