Description

The woodpecker crawler looks for Woodpecker CI workflow files and updates the container images used by their steps and services.

The following file patterns are scanned by default:

  • .woodpecker.yml and .woodpecker.yaml

  • .woodpecker/.yml and .woodpecker/.yaml

  • .woodpecker//.yml and .woodpecker//.yaml

Override them with the filematch parameter.

This crawler is enabled by default, so it can be used either automatically by running updatecli diff from a directory containing the files to update, or by providing a manifest. The automatic discovery behavior can be tuned by providing a YAML manifest with a woodpecker crawler in top-level directive autodiscovery as explained in the "Autodiscovery" page.

Important
Only the list form of steps and services is understood. A workflow using the map form is skipped, and the reason is only visible with --debug.
# Supported
steps:
  - name: build
    image: golang:1.21

# Not supported, this file yields no manifest
steps:
  build:
    image: golang:1.21

Generated manifests

Each image produces a dockerimage source for the latest tag and a yaml target that rewrites the image reference in place. When digest pinning is enabled, a dockerdigest source is added and the digest is written alongside the tag.

digest defaults to true. Set digest: false to track the tag only.

Authentication

Use auths to reach private registries, keyed by registry URL without a scheme, accepting either a token or a username/password pair. When it is empty Updatecli falls back to the ambient OCI credentials, such as those written by docker login.

Manifest

Parameters

NameTypeDescriptionRequired
authsobject

“auths” defines the registry credentials, keyed by registry host without scheme.

remark:

  • when empty, Updatecli uses the local OCI credentials, such as the Docker ones.

example:

auths:
  "ghcr.io":
    token: "xxx"
  "index.docker.io":
    username: "admin"
    password: "password"
    passwordstring

“password” defines the container registry password used for authentication.

default: credentials are retrieved from the local environment, such as ~/.docker/config.json.

remark:

  • “password” requires “username”.
  • “token” cannot be combined with both “username” and “password”.
    tokenstring

“token” defines the container registry bearer token used for authentication.

default: credentials are retrieved from the local environment, such as ~/.docker/config.json.

remark:

  • “token” cannot be combined with both “username” and “password”.
    usernamestring

“username” defines the container registry username used for authentication.

default: credentials are retrieved from the local environment, such as ~/.docker/config.json.

remark:

  • “username” requires “password”.
  • “token” cannot be combined with both “username” and “password”.
digestboolean

“digest” defines whether the generated manifests pin the image digest in addition to the tag.

default: true

filematcharray

“filematch” defines the file path patterns the crawler searches for.

default:

- ".woodpecker.yml"
- ".woodpecker.yaml"
- ".woodpecker/*.yml"
- ".woodpecker/*.yaml"
- ".woodpecker/**/*.yml"
- ".woodpecker/**/*.yaml"

remark:

  • a pattern is matched against the file path relative to “rootdir”, then against the file name.
  • the pattern follows the Go filepath.Match syntax, such as “*” or “?”.
  • “**” is not recursive. It behaves like “*” and matches a single directory level, so the default patterns find files directly under “.woodpecker” or one directory below it.
ignorearray

“ignore” defines rules to exclude matching container images from the autodiscovery.

remark:

  • a container image is ignored when it matches at least one rule.
    imagesarray

“images” defines the container images to match.

remark:

  • an image matches when its name starts with one of the values.
    pathstring

“path” defines a Woodpecker workflow file path pattern.

remark:

  • the pattern must match the whole path, not just a substring.
  • the pattern follows the Go filepath.Match syntax, such as “*” or “?”.
onlyarray

“only” defines rules to restrict the autodiscovery to matching container images.

remark:

  • a container image is kept only when it matches at least one rule.
    imagesarray

“images” defines the container images to match.

remark:

  • an image matches when its name starts with one of the values.
    pathstring

“path” defines a Woodpecker workflow file path pattern.

remark:

  • the pattern must match the whole path, not just a substring.
  • the pattern follows the Go filepath.Match syntax, such as “*” or “?”.
rootdirstring

“rootdir” defines the directory where the crawler starts searching for Woodpecker workflow files.

default: the scm directory when “scmid” is set, otherwise the directory relative paths resolve from, by default the working directory.

remark:

  • a relative path is resolved from the default directory.
  • an absolute path is used as is, instead of the scm directory.
versionfilterobject

“versionfilter” defines the version filter used by the generated manifests.

default: kind “semver” with pattern “>=”, combined with a tag filter derived from the current tag.

remark:

  • with kind “semver”, “pattern” accepts:
    • “prerelease”: the latest prerelease of the current version.
    • “patch”: patch updates only.
    • “minor”: patch and minor updates.
    • “minoronly”: minor updates only.
    • “major”: patch, minor and major updates.
    • “majoronly”: major updates only.
    • a version constraint, such as “>= 1.0.0”.
  • with kind “regex”, “pattern” accepts a regular expression.
  • more examples at https://www.updatecli.io/docs/core/versionfilter/

example:

versionfilter:
  kind: semver
  pattern: minor
    kindstring

“kind” defines the versioning scheme used to select a version.

default: latest

remark:

  • accepted values are “latest”, “semver”, “regex”, “regex/semver”, “time”, “regex/time”, “lex” and “pep440”.
  • “latest” returns the last version of the list.
  • “lex” sorts the versions lexicographically and returns the last one.
  • “pep440” follows https://peps.python.org/pep-0440/

example:

  • kind: semver
    patternstring

“pattern” defines the version pattern, according to “kind”.

default:

  • latest: “latest”
  • semver and pep440: “*”
  • regex: “.*”
  • time and regex/time: “2006-01-02”

remark:

  • for “latest”, “latest” returns the last version, any other value must match a version exactly.
  • for “semver” and “regex/semver”, it is a semantic versioning constraint.
  • for “pep440”, it is a pep440 version specifier.
  • for “regex”, it is a regular expression.
  • for “time” and “regex/time”, it is a Go date layout.
  • ignored by “lex”.

example:

  • pattern: ~1.2
  • pattern: “>=1.0.0 <2.0.0”
  • pattern: ^v\d+.\d+.\d+$
    regexstring

“regex” defines the regular expression extracting the version from each entry.

remark:

  • only used by the kinds “regex/semver” and “regex/time”.
  • the value of the first capture group is used as the version.

example:

  • regex: ^v(\d+.\d+.\d+)$
    replaceallobject

“replaceall” applies a regular expression replacement to each version before filtering.

remark:

  • only used by the kinds “regex”, “regex/semver” and “regex/time”.
  • the replacement runs before “pattern” or “regex” is evaluated.

example:

replaceall:
  pattern: "_"
  replacement: "."

turns “curl-8_15_0” into “curl-8.15.0”.

        patternstring

“pattern” defines the regular expression matching the text to replace.

example:

  • pattern: “_”
        replacementstring

“replacement” defines the text replacing each match of “pattern”.

remark:

  • capture groups can be referenced with $1, $2, and so on.

example:

  • replacement: “.”
    strictboolean

“strict” enforces strict semantic versioning rules when parsing versions.

default: false

remark:

  • only used by the kinds “semver” and “regex/semver”.
⚠ This table is generated from the Updatecli codebase and may contain inaccurate data. Feel free to report them on github.com/updatecli/updatecli

Example

autodiscovery:
  crawlers:
    woodpecker: {}