rewrote woodpecker.yml again

.woodpecker.yml

@@ -1,36 +1,32 @@
-# .woodpecker.yml  ── dev1 ➜ staging
+# .woodpecker.yml   dev1  ➜  aptiva‑staging
 kind: pipeline
 type: docker
 name: build-and-deploy
 
 workspace:
   base: /woodpecker
-  path: src
+  path: src               # repo will be /woodpecker/src
 
 clone:
   depth: 50
 
 ############################################################
-# 1. Build & push the images
+# 1. Build & push the four images to Artifact Registry
 ############################################################
 steps:
 - name: build-and-push
-  image: docker:24.0.9-dind
+  image: docker:24.0-cli          # uses host’s Docker socket
-  privileged: true
+  privileged: true                # required for buildx
   volumes:
-  - name: docker-sock
+  - name: docker-sock             # mount the host socket
     path: /var/run/docker.sock
-  settings:
+  commands: |
-    registry: us-central1-docker.pkg.dev
+    set -euo pipefail
-    username: _json_key
-    password:
-      from_secret: GCP_SA_JSON
-  commands:
-  - |
-    set -e
     REG=us-central1-docker.pkg.dev/aptivaai-dev/aptiva-repo
-    TAG=$${CI_COMMIT_SHA::8}
+    TAG=$(echo "$CI_COMMIT_SHA" | head -c 8)
+
     docker buildx create --use --name woodpecker || true
+
     for svc in server1 server2 server3 nginx ; do
       docker buildx build \
         --file Dockerfile.${svc} \
@@ -38,19 +34,16 @@ steps:
         --push .
     done
   when:
-    event:
+    event:  [push, manual]
-      - push
+    branch: [master]
-      - manual
-    branch:
-      - master
 
 ############################################################
-# 2. Rolling update on staging
+# 2. Rolling update on the *staging* VM
 ############################################################
 - name: deploy-staging
   image: appleboy/drone-ssh
   settings:
-    host: 10.128.0.12            # internal IP of staging VM
+    host: 10.128.0.12              # internal IP of aptiva‑staging
     port: 22
     username: jcoakley
     key:
@@ -59,12 +52,18 @@ steps:
       from_secret: STAGING_KNOWN_HOSTS
     script:
     - cd /opt/aptiva-staging-app
-      - ./refresh_secrets.sh
+    - ./refresh_secrets.sh         # pulls latest Secret‑Manager values
-      - IMG_TAG=${CI_COMMIT_SHA::8} docker compose pull
+    - TAG=$(echo "$CI_COMMIT_SHA" | head -c 8)
-      - IMG_TAG=${CI_COMMIT_SHA::8} docker compose up -d --remove-orphans
+    - IMG_TAG=$TAG docker compose pull
+    - IMG_TAG=$TAG docker compose up -d --remove-orphans
   when:
-    event:
+    event:  [push, manual]
-      - push
+    branch: [master]
-      - manual
+
-    branch:
+############################################################
-      - master
+# 3. Volumes (declared once, referenced by name)
+############################################################
+volumes:
+- name: docker-sock
+  host:
+    path: /var/run/docker.sock