when:
  - event: push
    branch: master
  - event: [tag, manual]

steps:
  - name: build-and-push
    # Pinned: WOODPECKER_PLUGINS_PRIVILEGED on the server must allow this exact
    # image:tag, so a floating tag here would silently break the build.
    #
    # Deliberately NO `privileged: true` here -- that flag requires repo-level
    # "security" trust and is rejected without it. The server-side allowlist
    # escalates this step instead, but only while it stays a *plugin*: adding
    # `commands`, `entrypoint`, or `environment` to this step silently drops
    # the escalation and buildx's inner daemon will fail to start.
    image: woodpeckerci/plugin-docker-buildx:6.1.1
    settings:
      registry: registry.apps.millslan.net
      repo: registry.apps.millslan.net/starship/coreid
      tags: latest
      platforms: linux/amd64
      dockerfile: Dockerfile
      username:
        from_secret: registry_username
      password:
        from_secret: registry_password