From a7673b537c837040718445124a35cc3e3d811e61 Mon Sep 17 00:00:00 2001
From: jenkins <brad@bstein.dev>
Date: Sun, 8 Nov 2026 15:43:31 -0600
Subject: [PATCH] jenkins: preserve default cloud and add Lesavka compiler lane

---
 services/jenkins/configmap-jcasc.yaml | 60 ++++++++++++++++++---------
 1 file changed, 41 insertions(+), 19 deletions(-)

diff --git a/services/jenkins/configmap-jcasc.yaml b/services/jenkins/configmap-jcasc.yaml
index e93f0743..25243207 100644
--- a/services/jenkins/configmap-jcasc.yaml
+++ b/services/jenkins/configmap-jcasc.yaml
@@ -220,6 +220,27 @@ data:
               }
             }
           }
+          pipelineJob('lesavka-compile') {
+            description('Exact-source native compilation on Atlas. Compiler evidence only; no signing, deployment or full gate claim.')
+            parameters {
+              stringParam('EXPECTED_SOURCE_REVISION', '', 'Exact reviewed Lesavka source commit.')
+              stringParam('CI_WORKER_IMAGE', '', 'Reviewed Lesavka CI image by sha256 digest.')
+            }
+            definition {
+              cpsScm {
+                scm {
+                  git {
+                    remote {
+                      url('https://scm.bstein.dev/bstein/lesavka.git')
+                      credentials('gitea-pat')
+                    }
+                    branches('*/dev-phone-companion-updates')
+                  }
+                }
+                scriptPath('docker/Jenkinsfile.compile')
+              }
+            }
+          }
           pipelineJob('lesavka') {
             // Re-enable after the pinned worker and current source are qualified.
             disabled(true)
@@ -827,25 +848,6 @@ data:
               - key: "GIT_CONFIG_VALUE_0"
                 value: "*"
       clouds:
-      - kubernetes:
-          # One bounded Lesavka worker must not wait behind unrelated stale jobs.
-          name: "lesavka"
-          containerCapStr: "1"
-          connectTimeout: "20"
-          readTimeout: "90"
-          jenkinsUrl: "http://jenkins.jenkins.svc.cluster.local:8080"
-          jenkinsTunnel: "jenkins.jenkins.svc.cluster.local:50000"
-          skipTlsVerify: false
-          maxRequestsPerHostStr: "8"
-          retentionTimeout: "5"
-          waitForPodSec: "300"
-          namespace: "jenkins"
-          restrictedPssSecurityContext: false
-          serverUrl: "https://kubernetes.default"
-          credentialsId: ""
-          podLabels:
-          - key: "jenkins/lesavka-agent"
-            value: "true"
       - kubernetes:
           # Stabilization: one build at a time leaves headroom for live services.
           containerCapStr: "1"
@@ -963,6 +965,26 @@ data:
                           jenkins/jenkins-jenkins-agent: "true"
               yamlMergeStrategy: override
               inheritYamlMergeStrategy: false
+      - kubernetes:
+          # One bounded Lesavka worker must not wait behind unrelated stale jobs.
+          # Keep this after the default cloud; older pipelines omit a cloud name.
+          name: "lesavka"
+          containerCapStr: "1"
+          connectTimeout: "20"
+          readTimeout: "90"
+          jenkinsUrl: "http://jenkins.jenkins.svc.cluster.local:8080"
+          jenkinsTunnel: "jenkins.jenkins.svc.cluster.local:50000"
+          skipTlsVerify: false
+          maxRequestsPerHostStr: "8"
+          retentionTimeout: "5"
+          waitForPodSec: "300"
+          namespace: "jenkins"
+          restrictedPssSecurityContext: false
+          serverUrl: "https://kubernetes.default"
+          credentialsId: ""
+          podLabels:
+          - key: "jenkins/lesavka-agent"
+            value: "true"
       slaveAgentPort: 50000
       crumbIssuer:
         standard: