Build images with kaniko instead of privileged buildx

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.woodpecker/ci.yaml

@@ -2,12 +2,11 @@
 #
 # Required secrets (Repository settings -> Secrets):
 #   registry_username, registry_password
-# The repo must be marked "Trusted" (docker-buildx plugin runs privileged),
-# or switch the publish steps to woodpeckerci/plugin-kaniko.
+# Images are built with kaniko: no privileged mode / Trusted flag needed.
 #
 variables:
   - &node_image 'node:22-alpine'
-  - &buildx 'woodpeckerci/plugin-docker-buildx:latest'
+  - &kaniko 'woodpeckerci/plugin-kaniko:latest'
   - &registry 'git.aggtaa.com'
   - &publish_when
     - event: push
@@ -25,11 +24,11 @@ steps:
       - event: [push, pull_request]
 
   - name: image-server-be
-    image: *buildx
+    image: *kaniko
     depends_on: [check]
     settings:
       registry: *registry
-      repo: git.aggtaa.com/${CI_REPO_OWNER}/cardy-server-be
+      repo: ${CI_REPO_OWNER}/cardy-server-be
       dockerfile: docker/server-be.Dockerfile
       context: .
       tags: ['${CI_COMMIT_SHA:0:8}', '${CI_COMMIT_BRANCH}']
@@ -40,11 +39,11 @@ steps:
     when: *publish_when
 
   - name: image-server-fe
-    image: *buildx
+    image: *kaniko
     depends_on: [check]
     settings:
       registry: *registry
-      repo: git.aggtaa.com/${CI_REPO_OWNER}/cardy-server-fe
+      repo: ${CI_REPO_OWNER}/cardy-server-fe
       dockerfile: docker/server-fe.Dockerfile
       context: .
       tags: ['${CI_COMMIT_SHA:0:8}', '${CI_COMMIT_BRANCH}']
@@ -55,11 +54,11 @@ steps:
     when: *publish_when
 
   - name: image-mobile-client
-    image: *buildx
+    image: *kaniko
     depends_on: [check]
     settings:
       registry: *registry
-      repo: git.aggtaa.com/${CI_REPO_OWNER}/cardy-mobile-client
+      repo: ${CI_REPO_OWNER}/cardy-mobile-client
       dockerfile: docker/mobile-client.Dockerfile
       context: .
       tags: ['${CI_COMMIT_SHA:0:8}', '${CI_COMMIT_BRANCH}']