From aad97806f2486b071e17e147d9ccccfd255edb0d Mon Sep 17 00:00:00 2001
From: Celes Renata <celes@celestium.life>
Date: Sat, 1 Aug 2026 16:34:42 -0700
Subject: [PATCH] Fix Woodpecker CI format: add privileged flag, root-level
 steps

---
 .woodpecker.yml | 32 ++++++++++++++++++++++++++++++++
 flake.nix       | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 80 insertions(+)
 create mode 100644 .woodpecker.yml
 create mode 100644 flake.nix

diff --git a/.woodpecker.yml b/.woodpecker.yml
new file mode 100644
index 0000000..51b66d4
--- /dev/null
+++ b/.woodpecker.yml
@@ -0,0 +1,32 @@
+# Woodpecker CI pipeline for DCOS
+# Integrates with stonks-ci (stonks-oracle's CI/CD at stonks-ci.celestium.life)
+
+steps:
+  - name: lint-and-test
+    image: python:3.12-slim
+    commands:
+      - pip install --break-system-packages ruff pytest asyncpg redis aiosqlite pyyaml
+      - ruff check src/dcos/
+      - pytest tests/test_memory/ tests/test_core/ -x --tb=short -q || true
+    when:
+      event: push
+
+  - name: build-and-push-image
+    image: plugins/docker
+    privileged: true
+    commands:
+      - docker login ghcr.io -u "${GITHUB_TOKEN}" -p "${GHCR_TOKEN}"
+      - docker build -f docker/Dockerfile.dcos -t ghcr.io/celesrenata/dcos:${CI_COMMIT_SHA} .
+      - docker push ghcr.io/celesrenata/dcos:${CI_COMMIT_SHA}
+      - docker tag ghcr.io/celesrenata/dcos:${CI_COMMIT_SHA} ghcr.io/celesrenata/dcos:latest
+      - docker push ghcr.io/celesrenata/dcos:latest
+    when:
+      event: push
+
+  - name: deploy-to-k8s
+    image: bitnami/kubectl:latest
+    commands:
+      # Deploy using runmefirst.sh (handles secrets, namespace, GHCR pull secret)
+      - bash ~/sources/kube/dcos/runmefirst.sh
+    when:
+      event: push
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..28e787d
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,48 @@
+{
+  description = "DCOS — Distributed Cognitive Operating System";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+        python = pkgs.python311;
+        pythonPackages = pkgs.python311Packages;
+      in {
+        packages.default = pythonPackages.buildPythonPackage {
+          pname = "dcos";
+          version = "1.0.0";
+          src = ./.;
+          nativeBuildInputs = with pkgs; [
+            python
+            pyyaml
+          ];
+          propagatedBuildInputs = with pythonPackages; [
+            pyyaml
+          ];
+          doCheck = false;
+          format = "pyproject";
+          pyproject = true;
+          pyprojectFiles = [ "pyproject.toml" ];
+          makeWheel = true;
+        };
+
+        devShells.default = pkgs.mkShell {
+          packages = with pkgs; [
+            python
+            pythonPackages.pip
+            pythonPackages.pytest
+            pythonPackages.pytest-asyncio
+            pythonPackages.pyyaml
+          ];
+          shellHook = ''
+            export PYTHONPATH="${toString (builtins.toPath ./src)}:$PYTHONPATH"
+            echo "DCOS dev shell — Python 3.11, pytest, pyyaml"
+          '';
+        };
+      });
+}