Luci docs

Local wrapper

def ci [...args] { ssh -p 2223 root@ci.bugabinga.net ...$args }

CLI

ci status [--all]
ci repo <repo>
ci show <run-id>
ci log <run-id> <child-id>
ci run <repo> <job> --ref <ref>
ci run <repo> <job> --rev <commit>
ci docs

.ci/*.kdl

job "test" {
  image "docker.io/library/alpine:latest"
  cache "deps" {
    path ".cache"
    key {
      file "lockfile"
    }
  }
  secret "TOKEN" env="TOKEN"
  run "project-test-command"
  publish "site" {
    from "dist"
    to "docs/"
  }
}

Trigger behavior

Push jobs match branch/tag globs. Manual runs require the job to exist.

Secrets layout

$LUCI_DATA_DIR/secrets/<repo>/<job>/<secret-name>

Known values are masked from logs best-effort.

Publish targets

registry pushes an image with configured auth. pkg and site atomically replace configured local destinations. Missing adapter config fails the job.

Security model

Repositories, logs, and artifacts are public. Never rely on log masking as the only secret protection.