quarkus-native-ci

Woodpecker plugin that builds a Quarkus native executable and writes a .tags file for woodpeckerci/plugin-docker-buildx. Replaces the restore-cache / build / rebuild-cache / tag steps with one image.

What it does on every run:

1. Writes .tags: commit SHA, latest (default branch or tag event) and version tags from any git tag pointing at the commit (v1.2.3 -> 1, 1.2, 1.2.3; v1.2.3-rc1 -> 1.2.3-rc1).
2. Runs ./mvnw package -Dnative. The Maven repository and wrapper live on the cache volume, so nothing is archived or re-downloaded between runs.

The image is based on the Quarkus Mandrel builder image, so native-image runs directly inside the step. No Docker-in-Docker, no extra builder image pull.

Usage

when:
  - event: push
    branch: main
  - event: tag
  - event: manual

clone:
  git:
    image: woodpeckerci/plugin-git
    settings:
      tags: true          # only needed for version tags on push/manual runs

steps:
  build:
    image: git.bivashy.dev/bivashy/quarkus-native-ci
    settings:
      module: app         # omit for single-module projects
    volumes:
      - /tmp/drone-cache:/cache

  push:
    image: woodpeckerci/plugin-docker-buildx
    settings:
      registry: git.bivashy.dev
      repo: git.bivashy.dev/${CI_REPO_OWNER}/${CI_REPO_NAME}
      tags_file: .tags
      dockerfile: app/src/main/docker/Dockerfile.native-micro
      context: app
      username:
        from_secret: gitea_username
      password:
        from_secret: gitea_token

Do not combine tags_file with auto_tag: true: the plugin already produces the same tags, and auto_tag fails the build on non-semver git tags.

Settings

Setting	Default	Description
module	(root project)	Maven module to build (-pl <module> -am). Binary is expected in <module>/target.
maven_args		Extra arguments appended to the Maven command.
skip_tests	false	Adds -DskipTests.
update_snapshots	true	Adds -U: re-check SNAPSHOT dependencies and plugins on every build instead of once a day. Releases are unaffected.
cache_dir	/cache	Mount point of the host cache volume.
cache_scope	shared	shared: one Maven repository for all repos on the agent. repo: a separate one per repository (maven-<owner>_<repo>).
tags_file	.tags	Where to write the docker tags.
latest_branch	repo default branch	Branch that gets the latest tag.

Cache volume

The plugin runs as uid 1001 (the quarkus user of the Mandrel image), not root. Docker creates the host directory as root:root on first use, so make it writable once per agent host:

sudo mkdir -p /tmp/drone-cache && sudo chown 1001:1001 /tmp/drone-cache

The plugin fails with a clear message if the directory is not writable.

/cache/maven/repository   Maven local repository
/cache/maven/wrapper      Maven wrapper distributions

Sharing is safe because release artifacts are immutable; Maven never re-downloads them. SNAPSHOTs are re-checked against the remote on every build (-U). The plugin only runs package, never install, so no project artifacts end up in the shared repository.

Building the image

docker build -t git.bivashy.dev/bivashy/quarkus-native-ci .

Build args: MANDREL_TAG (default jdk-25), MAVEN_VERSION (default 3.9.11, only used when a project has no mvnw).

Local test

docker run --rm -v "$PWD:/w" -w /w -v /tmp/qn-cache:/cache \
  -e CI_COMMIT_SHA=$(git rev-parse HEAD) -e CI_COMMIT_BRANCH=main \
  -e CI_REPO_DEFAULT_BRANCH=main -e CI_PIPELINE_EVENT=manual \
  git.bivashy.dev/bivashy/quarkus-native-ci