brand-master/CI_IMAGE_SETUP.md

Air-Gapped CI/CD Image Requirements\n\n## Problem\nYour Woodpecker CI pipeline needs git and yq but cannot install them via apk add because:\n- ❌ Alpine repositories (dl-cdn.alpinelinux.org) are blocked\n- ❌ SSL/TLS handshake failures\n- ❌ Permission denied errors\n\n## Solution\nUse a pre-built Alpine image with git and yq already installed.\n\n## Steps to Fix\n\n### 1. Build Custom Image (on a machine WITH internet)\n\nRequirements:\n- Machine with internet access\n- Docker installed\n- Access to Docker Hub (to pull alpine:3.19)\n- Access to push to Harbor\n\nWindows:\nbash\n.\\build-alpine-ci-image.bat\n\n\nLinux/Mac:\nbash\nchmod +x build-alpine-ci-image.sh\n./build-alpine-ci-image.sh\n\n\n### 2. Verify Image in Harbor\n\nCheck that the image exists:\nbash\ncurl -u "username:password" https://harbor.dvirlabs.com/api/v2.0/projects/base-images/repositories/alpine-git-yq/artifacts\n\n\nOr visit: https://harbor.dvirlabs.com → base-images → alpine-git-yq\n\n### 3. Update CI Config (Already Done)\n\nThe .woodpecker.yaml has been updated to use:\nyaml\nimage: harbor.dvirlabs.com/base-images/alpine-git-yq:3.19\n\n\nInstead of:\nyaml\nimage: harbor.dvirlabs.com/base-images/alpine:3.19\ncommands:\n - apk add --no-cache git yq # ❌ This fails in air-gapped\n\n\n### 4. Push Updated Config\n\nbash\ngit add .\ngit commit -m \"Use custom Alpine image with git and yq for CI\"\ngit push\n\n\n## What's Included\n\nThe custom alpine-git-yq image includes:\n- ✅ git\n- ✅ yq (YAML processor)\n- ✅ curl\n- ✅ bash\n\nAll pre-installed and ready to use in your air-gapped cluster!\n\n## If Build Fails\n\n### Error: "Cannot connect to Docker Hub"\nCause: No internet access on the build machine.\nSolution: Build on a different machine that has internet access.\n\n### Error: "apk: network error"\nCause: Building inside the air-gapped cluster.\nSolution: Build on a machine outside the cluster with internet access.\n\n### Alternative: Manual Build\n\nIf scripts don't work, build manually:\n\nbash\ncd base-images/alpine-git-yq\ndocker build -t harbor.dvirlabs.com/base-images/alpine-git-yq:3.19 .\ndocker login harbor.dvirlabs.com\ndocker push harbor.dvirlabs.com/base-images/alpine-git-yq:3.19\n\n\n## Result\n\nOnce the image is in Harbor, your CI pipeline will:\n1. ✅ Pull alpine-git-yq from Harbor (no external access needed)\n2. ✅ Use git and yq commands directly (already installed)\n3. ✅ Update values.yaml successfully\n4. ✅ Push changes to Git\n\nNo more package installation failures!\n