@yunuseon/kayra 0.7.0 → 0.8.0

package/scripts/platform/registry-gc.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# =============================================================================
+# registry-gc.sh — keep the images apps actually shipped, delete the rest.
+#
+# Keep set: every image referenced by the newest KEEP_RELEASES release records
+# of each app (the deployer writes one per deploy), plus every image any
+# container on this host uses. A registered app (its apps/<app>.json exists)
+# with no release record yet is not touched — it has not deployed for the first time. An app
+# that is no longer registered has all its images collected. A deleted image
+# is not lost for good: resolve-images.sh --ensure
+# rebuilds whatever a deploy asks for and the registry no longer has.
+#
+# Then: registry garbage-collect (blobs), BuildKit cache and host images older
+# than a week. Runs nightly in the deployer (`kayra job <server> gc` by hand).
+# =============================================================================
+set -euo pipefail
+
+KEEP_RELEASES="${KEEP_RELEASES:-10}"
+REGISTRY="${REGISTRY_PUSH_HOST:-registry:5000}"
+platform_dir="${PLATFORM_DIR:?}"
+releases="${platform_dir}/releases"
+
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+
+# ── Keep set (as repo:tag, registry host stripped) ──────────────────────────
+for dir in "$releases"/*/; do
+    [ -d "$dir" ] || continue
+    ls -1 "$dir" | sort | tail -n "$KEEP_RELEASES" | while read -r record; do
+        cut -d= -f2- "${dir}${record}"
+    done
+done > "$work/refs"
+docker ps -a --format '{{.Image}}' >> "$work/refs"
+sed -E 's#^[^/]+:[0-9]+/##' "$work/refs" | sort -u > "$work/keep"
+ls -1 "$releases" 2>/dev/null > "$work/released" || true
+ls -1 "${platform_dir}/apps" 2>/dev/null | sed -n 's/^\(.*\)\.json$/\1/p' > "$work/registered" || true
+
+digest() {
+    curl -sfI \
+        -H 'Accept: application/vnd.oci.image.index.v1+json' \
+        -H 'Accept: application/vnd.oci.image.manifest.v1+json' \
+        -H 'Accept: application/vnd.docker.distribution.manifest.list.v2+json' \
+        -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' \
+        "http://${REGISTRY}/v2/$1/manifests/$2" \
+        | tr -d '\r' | sed -n 's/^[Dd]ocker-[Cc]ontent-[Dd]igest: //p'
+}
+json_list() { jq -r ".$1 // [] | .[]"; }
+
+# ── Delete untracked manifests ──────────────────────────────────────────────
+# By digest, and never a digest a kept tag also points at: deleting a manifest
+# removes every tag on it.
+# Fetched into variables first: a failure inside `for x in $(...)` would not
+# trip set -e, and a GC that cannot list anything looks like one with nothing
+# to delete.
+repos=$(curl -sf "http://${REGISTRY}/v2/_catalog?n=1000" | json_list repositories)
+deleted=0
+for repo in $repos; do
+    app="${repo%%/*}"
+    if grep -qxF "$app" "$work/registered" && ! grep -qxF "$app" "$work/released"; then
+        echo "skip ${repo} (${app} has not deployed yet)"
+        continue
+    fi
+    : > "$work/kept-digests"; : > "$work/candidates"
+    tags=$(curl -sf "http://${REGISTRY}/v2/${repo}/tags/list" | json_list tags)
+    for tag in $tags; do
+        d=$(digest "$repo" "$tag")
+        [ -n "$d" ] || continue
+        if grep -qxF "${repo}:${tag}" "$work/keep"; then
+            echo "$d" >> "$work/kept-digests"
+        else
+            echo "$tag $d" >> "$work/candidates"
+        fi
+    done
+    while read -r tag d; do
+        grep -qxF "$d" "$work/kept-digests" && continue
+        curl -sf -X DELETE "http://${REGISTRY}/v2/${repo}/manifests/${d}" >/dev/null
+        echo "deleted ${repo}:${tag}"
+        deleted=$((deleted + 1))
+    done < "$work/candidates"
+done
+echo "Deleted ${deleted} manifest(s)."
+
+# ── Reclaim blobs ───────────────────────────────────────────────────────────
+# garbage-collect is only safe while nothing pushes, so the registry is stopped
+# for the few seconds it takes; the trap brings it back whatever happens.
+if [ "$deleted" -gt 0 ]; then
+    registry=$(docker ps -aq \
+        --filter label=com.docker.compose.project=platform \
+        --filter label=com.docker.compose.service=registry)
+    image=$(docker inspect -f '{{.Config.Image}}' "$registry")
+    docker stop "$registry" >/dev/null
+    trap 'docker start "$registry" >/dev/null; rm -rf "$work"' EXIT
+    docker run --rm --volumes-from "$registry" "$image" \
+        garbage-collect /etc/docker/registry/config.yml | tail -n 3
+fi
+
+# ── Build cache and host images ─────────────────────────────────────────────
+buildctl --addr tcp://buildkitd:1234 prune --keep-duration 168h | tail -n 1
+docker image prune -af --filter until=168h | tail -n 1

package/scripts/platform/resolve-images.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC2154  # read_manifest assigns its variables via printf -v
+# =============================================================================
+# resolve-images.sh <app> <app-root> --plan | --ensure <artifact>
+#
+# Content-addressed image plan and build for any app. Every
+# <app-root>/**/docker/image.json is an artifact, named after the directory
+# that holds docker/:
+#   { "image": "<app>/<name>", "dockerfile": "...", "context": "...",
+#     "inputs": ["...", ...] }        all paths relative to <app-root>
+#
+# Two modes, because the builder has to know what it is about to do before it can
+# show progress through it:
+#   --plan            One TSV row per artifact: name, env var, image ref.
+#                     Pure git — no registry, no daemon, no side effects.
+#   --ensure <name>   Build and push that artifact if its tag is missing from
+#                     the registry. Prints CACHED or BUILT.
+#
+# Tag = SHA of the last commit touching any declared input: same inputs, same
+# content, same tag, no rebuild — on any branch.
+#
+# Builds go through buildkitd (BUILDKIT_HOST), never a docker daemon. Two
+# registry names for the same storage:
+#   REGISTRY_PUSH_HOST  registry:5000   reachable from containers (buildkit)
+#   REGISTRY            localhost:5000  reachable from the host daemon (compose)
+#
+# Requires: git, jq; --ensure also curl and buildctl.
+# =============================================================================
+set -euo pipefail
+
+app="${1:?Usage: $0 <app> <app-root> --plan | --ensure <artifact>}"
+root="${2:?}"
+shift 2
+REGISTRY="${REGISTRY:-localhost:5000}"
+REGISTRY_PUSH_HOST="${REGISTRY_PUSH_HOST:-registry:5000}"
+
+manifests() {
+    find "$root" -path '*/node_modules' -prune -o -path '*/docker/image.json' -print | sort
+}
+
+# Sets: image dockerfile context tag ref push_ref var_name
+# (printf -v assigns them, which shellcheck cannot follow: see SC2154 above.)
+read_manifest() {
+    local manifest="$1" field
+    for field in image dockerfile context; do
+        printf -v "$field" '%s' "$(jq -er ".${field}" "$manifest")"
+    done
+    # The registry has one namespace per app; an app may only name images in its own.
+    case "$image" in
+        "${app}/"*) ;;
+        *) echo "ERROR: ${manifest}: image ${image} is outside the ${app}/ namespace" >&2; return 1 ;;
+    esac
+
+    local inputs=() input
+    while IFS= read -r input; do inputs+=("$input"); done < <(jq -r '.inputs[]' "$manifest")
+    tag=$(git -C "$root" rev-list -1 HEAD -- "${inputs[@]}" | cut -c1-12)
+    [ -n "$tag" ] || { echo "ERROR: ${manifest}: no commit touches its inputs" >&2; return 1; }
+
+    ref="${REGISTRY}/${image}:${tag}"
+    push_ref="${REGISTRY_PUSH_HOST}/${image}:${tag}"
+    # shop/storefront -> STOREFRONT_IMAGE
+    var_name="$(basename "$image" | tr '[:lower:]-' '[:upper:]_')_IMAGE"
+}
+
+artifact_name() { basename "$(dirname "$(dirname "$1")")"; }
+
+plan() {
+    local manifest
+    for manifest in $(manifests); do
+        read_manifest "$manifest"
+        printf '%s\t%s\t%s\n' "$(artifact_name "$manifest")" "$var_name" "$ref"
+    done
+}
+
+ensure() {
+    local manifest
+    # .../<artifact>/docker/image.json
+    manifest=$(manifests | awk -F/ -v name="$1" '$(NF-2) == name')
+    [ -n "$manifest" ] || { echo "ERROR: no artifact $1 under ${root}" >&2; return 1; }
+    read_manifest "$manifest"
+
+    local status
+    status=$(curl -s -o /dev/null -w '%{http_code}' \
+        -H 'Accept: application/vnd.oci.image.index.v1+json' \
+        -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' \
+        "http://${REGISTRY_PUSH_HOST}/v2/${image}/manifests/${tag}" || echo 000)
+    if [ "$status" = "200" ]; then
+        echo "CACHED ${ref}"
+        return 0
+    fi
+
+    : "${BUILDKIT_HOST:?BUILDKIT_HOST is required (e.g. tcp://buildkitd:1234)}"
+    echo "BUILDING ${image} -> ${push_ref}"
+    buildctl build \
+        --frontend dockerfile.v0 \
+        --local context="${root}/${context}" \
+        --local dockerfile="$(dirname "${root}/${dockerfile}")" \
+        --opt filename="$(basename "$dockerfile")" \
+        --output "type=image,name=${push_ref},push=true,registry.insecure=true"
+    echo "BUILT ${ref}"
+}
+
+case "${1:-}" in
+    --plan) plan ;;
+    --ensure) ensure "${2:?--ensure needs an artifact name}" ;;
+    *) echo "Usage: $0 <app> <app-root> --plan | --ensure <artifact>" >&2; exit 2 ;;
+esac

package/scripts/server/{jenkins-app-apply → app-apply}

@@ -1,18 +1,19 @@
 #!/usr/bin/env bash
 # =============================================================================
-# jenkins-app-apply <app> — the one way an app registers with Jenkins.
+# app-apply <app> — the one way an app's secrets reach the deployer.
 #
-# Reads the app's secrets as KEY=VALUE lines on stdin, writes each to
-# jenkins-secrets/<app>/<KEY> (where its 10-<app>.yaml reads them via
-# ${readFile:/run/app-secrets/<app>/<KEY>}), then runs jenkins-reload.
+# Reads the app's secrets as KEY=VALUE lines on stdin and writes each to
+# app-secrets/<app>/<KEY>, which the deployer reads (mounted read-only at
+# /run/app-secrets) into the environment of that app's compose commands, and
+# nowhere else. The next deploy uses them; nothing is reloaded.
 #
 # Installed by the platform role at <platform_dir>/bin. Run as root.
 # =============================================================================
 set -euo pipefail
 
-app="${1:?Usage: jenkins-app-apply <app> < secrets.env}"
+app="${1:?Usage: app-apply <app> < secrets.env}"
 platform_dir="$(cd "$(dirname "$0")/.." && pwd)"
-secrets_dir="${platform_dir}/jenkins-secrets/${app}"
+secrets_dir="${platform_dir}/app-secrets/${app}"
 
 # Staged next to the target and swapped in whole, so keys the app no longer
 # declares disappear instead of lingering.
@@ -27,10 +28,8 @@ done
 rm -rf "$secrets_dir"
 mv "$staging" "$secrets_dir"
 trap - EXIT
-# The controller runs as uid 1000 and reads these through a read-only mount.
+# The deployer runs as uid 1000 and reads these through a read-only mount.
 chown -R 1000:1000 "$secrets_dir"
 find "$secrets_dir" -type f -exec chmod 0400 {} +
 chmod 0500 "$secrets_dir"
-
-"${platform_dir}/bin/jenkins-reload"
-echo "Applied Jenkins config for ${app}."
+echo "Applied ${app}'s secrets."

package/scripts/server/app-purge

@@ -12,7 +12,7 @@ set -euo pipefail
 app="${1:?Usage: app-purge <app>}"
 platform_dir="$(cd "$(dirname "$0")/.." && pwd)"
 
-if [ -e "${platform_dir}/jenkins/casc/10-${app}.yaml" ]; then
+if [ -e "${platform_dir}/apps/${app}.json" ]; then
     echo "ERROR: ${app} is still registered on this server — remove it from server.yml and run \`kayra apps <server>\` first." >&2
     exit 1
 fi

package/scripts/server/app-remove

@@ -3,9 +3,9 @@
 # app-remove <app> — take an app off this server, keeping its data.
 #
 # Stops its containers and removes everything the platform set up for it:
-# JCasC fragment, secret files, .env, the Jenkins folder with its jobs and
-# history, the release records (so Rollback no longer offers it). Its images
-# are collected by the next registry GC, since the app is no longer registered.
+# its registration, secret files, .env, runs and release records (so rollback
+# no longer offers it). Its images are collected by the next registry GC,
+# since the app is no longer registered.
 #
 # Volumes stay: dropping a line from server.yml must never silently destroy a
 # database. `app-purge <app>` deletes them deliberately.
@@ -19,12 +19,11 @@ app="${1:?Usage: app-remove <app>}"
 platform_dir="$(cd "$(dirname "$0")/.." && pwd)"
 apps_dir="$(sed -n 's/^APPS_DIR=//p' "${platform_dir}/.env")"
 
+# Unregistered first: from here on no push, poll or rollback starts a run.
+rm -f "${platform_dir}/apps/${app}.json"
 docker compose -p "$app" down --remove-orphans
-rm -rf "${platform_dir}/jenkins/casc/10-${app}.yaml" \
-       "${platform_dir}/jenkins-secrets/${app}" \
+rm -rf "${platform_dir}/app-secrets/${app}" \
+       "${platform_dir}/runs/${app}" \
+       "${platform_dir}/releases/${app}" \
        "${apps_dir:?}/${app}"
-# Without its fragment the reload drops the app's credentials.
-"${platform_dir}/bin/jenkins-reload"
-"${platform_dir}/bin/jenkins-api" POST "/job/${app}/doDelete" -o /dev/null || true
-(cd "$platform_dir" && docker compose exec -T jenkins-controller rm -rf "/var/jenkins_home/releases/${app}")
 echo "Removed ${app}. Its volumes are kept — app-purge ${app} deletes them."

package/ansible/roles/app/templates/casc-app.yaml.j2

@@ -1,68 +0,0 @@
-{#- Rendered once per app by the platform app role. The jobs run the platform
-    library's pipelines; the app's repo is only ever checked out as data. -#}
-{% set coords = {
-  'name': app.name, 'repo': app_repo, 'ref': app_ref, 'path': app.path | default('.'),
-  'hosts': manifest.subdomains | map('regex_replace', '$', '.' ~ domain) | list,
-  'secrets': manifest.secrets | default([]),
-} -%}
-{% set literal = coords | to_json | regex_replace('^\\{', '[') | regex_replace('\\}$', ']') | regex_replace('"(\\w+)": ', '\\1: ') %}
-# =============================================================================
-# {{ app.name }} — generated by the platform app role. Do not edit on the server.
-# =============================================================================
-
-credentials:
-  system:
-    domainCredentials:
-      - credentials:
-{% for key in manifest.secrets | default([]) %}
-          - string:
-              scope: GLOBAL
-              id: "{{ app.name }}-{{ key | lower | replace('_', '-') }}"
-              description: "{{ app.name }}: {{ key }}"
-              secret: "${readFile:/run/app-secrets/{{ app.name }}/{{ key }}}"
-{% endfor %}
-
-jobs:
-  - script: |
-      folder("{{ app.name }}") {
-        displayName("{{ app.name }}")
-      }
-
-      pipelineJob("{{ app.name }}/build") {
-        displayName("Build")
-        description("Builds {{ app.name }}'s images from {{ app_ref }} on every push (GitHub webhook, hourly poll as fallback); any other branch on demand. A green {{ app_ref }} build deploys that exact commit.")
-        logRotator { numToKeep(20) }
-        // Declared here as well as in the pipeline: a JCasC reload regenerates
-        // the job from this DSL, and parameters only the pipeline declared
-        // would be gone — Jenkins then silently drops the ones passed in.
-        parameters {
-          stringParam("BRANCH", "{{ app_ref }}", "Branch, tag or commit to build")
-        }
-        definition {
-          cps {
-            script('''@Library('platform') _
-      appBuild({{ literal }})''')
-            sandbox(true)
-          }
-        }
-        triggers {
-          githubPush()
-          scm("H * * * *")
-        }
-      }
-
-      pipelineJob("{{ app.name }}/deploy") {
-        displayName("Deploy")
-        description("Deploys any branch, tag or commit of {{ app.name }}: builds missing images, admits the compose config against the platform policy, runs it, records the release. Rollback starts it with an older SHA.")
-        logRotator { numToKeep(50) }
-        parameters {
-          stringParam("REF", "{{ app_ref }}", "Branch, tag or commit SHA to deploy")
-        }
-        definition {
-          cps {
-            script('''@Library('platform') _
-      appDeploy({{ literal }})''')
-            sandbox(true)
-          }
-        }
-      }

package/compose/jenkins/Dockerfile

@@ -1,40 +0,0 @@
-# =============================================================================
-# Jenkins Controller — LTS with Docker CLI, Compose, buildctl and JCasC
-# =============================================================================
-
-FROM jenkins/jenkins:2.580.1-lts-jdk21
-
-USER root
-
-# renovate: datasource=github-releases depName=moby/buildkit
-ARG BUILDKIT_VERSION=v0.34.0
-
-# Install Docker CLI + Compose plugin
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-      ca-certificates curl gnupg jq && \
-    install -m 0755 -d /etc/apt/keyrings && \
-    curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg && \
-    chmod a+r /etc/apt/keyrings/docker.gpg && \
-    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
-      https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
-      > /etc/apt/sources.list.d/docker.list && \
-    apt-get update && \
-    apt-get install -y --no-install-recommends \
-      docker-ce-cli docker-compose-plugin && \
-    arch="$(dpkg --print-architecture)" && \
-    curl -fsSL "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-${arch}.tar.gz" \
-      | tar -xz -C /usr/local bin/buildctl && \
-    rm -rf /var/lib/apt/lists/*
-
-USER jenkins
-
-# Install plugins
-COPY plugins.txt /usr/share/jenkins/ref/plugins.txt
-RUN jenkins-plugin-cli --plugin-file /usr/share/jenkins/ref/plugins.txt
-
-# JCasC fragments are bind-mounted, not baked in; CASC_JENKINS_CONFIG is set in
-# compose. That keeps config out of the image and out of the jenkins-home volume.
-# notifyCommit without a token, but only to trigger polling: how Forgejo tells
-# Jenkins about a push, over platform-internal (Traefik does not route it).
-ENV JAVA_OPTS="-Djenkins.install.runSetupWizard=false -Dhudson.plugins.git.GitStatus.NOTIFY_COMMIT_ACCESS_CONTROL=disabled-for-polling"

package/compose/jenkins/casc/00-platform.yaml

@@ -1,158 +0,0 @@
-# =============================================================================
-# Jenkins Configuration as Code — platform fragment (app-agnostic).
-#
-# Owns:
-#   - Jenkins setup, security realm, authorization
-#   - The agent node
-#   - Git credentials (for cloning the app repo)
-#   - GitHub: push-webhook secret + API token for commit statuses
-#   - Jenkins URL
-#
-# Also owns the app-agnostic jobs: platform-registry-gc and rollback work off
-# the release records every app's <app>/deploy job writes (the platform
-# library's appDeploy) and start that job with a REF. platform-renovate exists
-# only where the server has repos to keep up to date (PLATFORM_RENOVATE).
-#
-# Does NOT own any app-specific credentials (Postgres, ...) or app pipelines.
-# Each app renders its own 10-<app>.yaml next to this file and applies it with
-# bin/jenkins-app-apply. JCasC merges every YAML in this directory.
-#
-# Git remote comes from the platform .env (rendered by Ansible).
-# =============================================================================
-
-jenkins:
-  systemMessage: "Platform CI/CD — Managed by JCasC"
-  numExecutors: 1
-
-  securityRealm:
-    local:
-      allowsSignup: false
-      users:
-        - id: "${JENKINS_ADMIN_USER:-admin}"
-          password: "${JENKINS_ADMIN_PASSWORD:-admin}"
-
-  authorizationStrategy:
-    loggedInUsersCanDoAnything:
-      allowAnonymousRead: false
-
-  nodes:
-    - permanent:
-        name: "builder"
-        labelString: "buildkit linux"
-        numExecutors: 2
-        remoteFS: "/home/jenkins/agent"
-        launcher:
-          inbound:
-            workDirSettings:
-              disabled: false
-              internalDir: "remoting"
-        retentionStrategy: "always"
-
-credentials:
-  system:
-    domainCredentials:
-      - credentials:
-          - usernamePassword:
-              scope: GLOBAL
-              id: "git-credentials"
-              description: "Git credentials for cloning repositories"
-              username: "git"
-              password: "${readFile:/run/platform-secrets/GIT_TOKEN}"
-          - string:
-              scope: GLOBAL
-              id: "github-token"
-              description: "Same PAT as git-credentials; needs Commit statuses: write"
-              secret: "${readFile:/run/platform-secrets/GIT_TOKEN}"
-          - string:
-              scope: GLOBAL
-              id: "renovate-token"
-              description: "PAT for Renovate: Contents + Pull requests read & write"
-              secret: "${readFile:/run/platform-secrets/RENOVATE_TOKEN}"
-          - string:
-              scope: GLOBAL
-              id: "github-webhook-secret"
-              description: "HMAC secret GitHub signs push webhooks with"
-              secret: "${GITHUB_WEBHOOK_SECRET:-}"
-
-unclassified:
-  # The pipeline every app runs. Trusted (outside the sandbox), loaded from
-  # PLATFORM_REF (the release tag, v<version>; a test server may set a branch) and jobs cannot
-  # pick another version, so a pushed app branch never changes what a pipeline
-  # does. See ci/jenkins-lib/.
-  globalLibraries:
-    libraries:
-      - name: "platform"
-        defaultVersion: "${PLATFORM_REF}"
-        allowVersionOverride: false
-        implicit: false
-        retriever:
-          modernSCM:
-            libraryPath: "ci/jenkins-lib/"
-            scm:
-              git:
-                remote: "${JENKINS_GIT_REPO}"
-                credentialsId: "git-credentials"
-  location:
-    url: "https://jenkins.${DOMAIN:-localhost}/"
-  # Webhook lands on /github-webhook/. Hooks are registered by hand in the
-  # repo settings, not managed from here.
-  gitHubPluginConfig:
-    configs:
-      - name: "GitHub"
-        apiUrl: "https://api.github.com"
-        credentialsId: "github-token"
-        manageHooks: false
-    hookSecretConfigs:
-      - credentialsId: "github-webhook-secret"
-
-# Platform jobs run pipelines from PLATFORM_REF of this repo, never from a pushed branch.
-jobs:
-  - script: |
-      def fromPlatform = { String path ->
-        return {
-          cpsScm {
-            scm {
-              git {
-                remote {
-                  url("${JENKINS_GIT_REPO}")
-                  credentials("git-credentials")
-                }
-                branch("${PLATFORM_REF}")
-              }
-            }
-            scriptPath(path)
-            lightweight(false)
-          }
-        }
-      }
-
-      pipelineJob("platform-registry-gc") {
-        displayName("Platform Registry GC")
-        description("Nightly: deletes registry images no recent release of any app references, then prunes the BuildKit cache and host images. See ci/registry-gc.sh.")
-        definition(fromPlatform("ci/registry-gc.Jenkinsfile"))
-        triggers {
-          cron("H 3 * * *")
-        }
-      }
-
-      pipelineJob("rollback") {
-        displayName("Rollback")
-        description("Redeploys an earlier release of an app: pick the app, pick a release, done. Hands the SHA to <app>/deploy.")
-        definition(fromPlatform("ci/rollback.Jenkinsfile"))
-      }
-
-      if ("${PLATFORM_RENOVATE:-false}" == "true") {
-        pipelineJob("platform-renovate") {
-          displayName("Platform Renovate")
-          description("On renovate_schedule (weekly by default): opens PRs that bump pinned versions. Config: renovate.json. See ci/renovate.Jenkinsfile.")
-          // Declared here as well: a JCasC reload regenerates the job and drops
-          // parameters only the pipeline declares.
-          parameters {
-            booleanParam("DRY_RUN", false, "Log what would change, open no PRs")
-          }
-          definition(fromPlatform("ci/renovate.Jenkinsfile"))
-          triggers {
-            cron("${RENOVATE_SCHEDULE:-H 4 * * 1}")
-          }
-        }
-      }

package/compose/jenkins/plugins.txt

@@ -1,97 +0,0 @@
-# Every plugin, dependencies included, at the version prod runs: without the
-# dependencies pinned, jenkins-plugin-cli resolves them to whatever is newest
-# on the day the image is built. Renovate proposes updates.
-antisamy-markup-formatter:173.v680e3a_b_69ff3
-apache-httpcomponents-client-4-api:4.5.14-269.vfa_2321039a_83
-apache-httpcomponents-client-5-api:5.6.4-207.vd5b_a_c15e4de5
-asm-api:9.10.1-216.va_9256d3b_844b_
-authentication-tokens:1.144.v5ff4a_5ec5c33
-bootstrap5-api:5.3.8-1048.va_c299057e35c
-bouncycastle-api:2.30.1.86.1-306.vfc711fa_36d5f
-branch-api:2.1303.v9f3b_95dc329d
-caffeine-api:3.3.0-210.v71b_2985ce530
-checks-api:422.vc7e8b_51488c6
-cloud-stats:423.v63f017a_f582c
-cloudbees-folder:6.1106.v3a_d9a_6d2465e
-commons-compress-api:1.28.0-95.vb_e5e24f83645
-commons-lang3-api:3.21.0-122.v6a_ea_4fd34049
-commons-text-api:1.15.0-218.va_61573470393
-configuration-as-code:2133.ve570217cdb_cd
-credentials-binding:728.v902a_273b_8947
-credentials:1511.v2e3cb_0008ef0
-display-url-api:2.217.va_6b_de84cc74b_
-docker-commons:477.v289085a_b_6896
-docker-java-api:3.7.1-136.v5d70f77a_c3d6
-docker-plugin:1331.v2c036a_dc63fc
-docker-workflow:653.v2f2c08eff0ec
-durable-task:686.v80ff80875b_82
-echarts-api:6.1.0-1321.v86c4c5114494
-eddsa-api:0.3.0.1-29.v67e9a_1c969b_b_
-font-awesome-api:7.3.1-1013.v0835a_879ec6d
-git-client:6.6.1
-git:5.10.1
-github-api:1.330-492.v3941a_032db_2a_
-github:1.47.0
-gson-api:2.14.0-201.v8eefe5515533
-instance-identity:203.v15e81a_1b_7a_38
-ionicons-api:94.vcc3065403257
-jackson-annotations2-api:2.22-19.v10a_a_582ea_26e
-jackson2-api:2.22.3-447.v6a_93ce7d2c82
-jackson3-api:3.2.3-101.v69fc84453a_8e
-jakarta-activation-api:2.1.4-1
-jakarta-mail-api:2.1.5-1
-jakarta-xml-bind-api:4.0.9-19.v2b_a_5b_44d9a_1c
-javax-activation-api:1.2.0-8
-jaxb:2.3.9-143.v5979df3304e6
-job-dsl:3732.v9a_c49a_61a_313
-joda-time-api:2.15.0-208.v6b_084e7a_d9f0
-jquery3-api:3.7.1-687.v68d468e40b_30
-json-api:20260814-226.v20f9685d642c
-json-path-api:3.0.0-218.vcd4dd1355de2
-junit:1434.vde2d24df0c4c
-mailer:534.v1b_36f5864073
-matrix-project:928.v1effc3f3a_236
-mina-sshd-api-common:2.19.0-192.v2b_a_7b_2c1dc71
-mina-sshd-api-core:2.19.0-192.v2b_a_7b_2c1dc71
-okhttp-api:5.3.2-200.vedb_720a_cf1f8
-pipeline-build-step:601.v6d4c6d1a_9dc7
-pipeline-graph-analysis:254.v0f63a_a_447dca_
-pipeline-graph-view:1053.v9df19e6ceed2
-pipeline-groovy-lib:806.v408277b_33d1d
-pipeline-input-step:560.v56198a_642157
-pipeline-milestone-step:152.v6e22b_8cfc66c
-pipeline-model-api:2.2293.v6e7193cec599
-pipeline-model-definition:2.2293.v6e7193cec599
-pipeline-model-extensions:2.2293.v6e7193cec599
-pipeline-rest-api:2.41
-pipeline-stage-step:345.va_96187909426
-pipeline-stage-tags-metadata:2.2293.v6e7193cec599
-pipeline-stage-view:2.41
-pipeline-utility-steps:3.810.va_7672d206740
-plain-credentials:199.v9f8e1f741799
-plugin-util-api:7.1341.v039f146993d9
-prism-api:1.30.0-741.v034eb_0b_0a_a_fa_
-resource-disposer:0.25
-scm-api:728.vc30dcf7a_0df5
-script-security:1433.v17c58a_e45cc1
-snakeyaml-api:2.7-152.vc672728cf536
-snakeyaml-engine-api:3.2-18.v885ed7ff698f
-ssh-credentials:372.va_250881b_08cd
-ssh-slaves:3.1097.v868116049892
-structs:362.va_b_695ef4fdf9
-timestamper:1.30
-token-macro:477.vd4f0dc3cb_cf1
-trilead-api:2.284.v1974ea_324382
-variant:70.va_d9f17f859e0
-woodstox-core-api:7.3.0-16.v017f30ed004c
-workflow-aggregator:608.v67378e9d3db_1
-workflow-api:1413.v2ff1a_5e720fa_
-workflow-basic-steps:1098.v808b_fd7f8cf4
-workflow-cps:4391.v652b_b_b_1b_7c00
-workflow-durable-task-step:1479.v56e587f413a_7
-workflow-job:1609.v8926e7962024
-workflow-multibranch:842.v3a_b_59b_57b_e6e
-workflow-scm-step:487.v41313a_96b_65d
-workflow-step-api:724.v538c2362b_dfb_
-workflow-support:1015.v785e5a_b_b_8b_22
-ws-cleanup:0.49