.gitea/workflows/redhat_build.yml aktualisiert

.gitea/workflows/redhat_build.yml

@@ -4,8 +4,8 @@ on:
  # pull_request:
    # branches:
     #  - main
- # schedule:
+  schedule:
-  #  - cron: '05 12 * * 2,5'
+    - cron: '05 12 * * 2,5'
   workflow_dispatch:
 
 env:
@@ -80,67 +80,37 @@ jobs:
             containers.bootc=1
             ostree.bootable=1
 
-      - name: Login to Gitea Container Registry
+      - name: Build Image (Docker Buildx OCI-Export)
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: ${{ env.REGISTRY_HOST }}
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.REGISTRY }}     
-
-      # 1. Buildx baut das Image mit Registry-Cache und exportiert ein lokaes OCI-Archiv
-      - name: Build Image to OCI Archive (Docker Buildx)
         uses: docker/build-push-action@v7.3.0
         id: build_image
         with:
           context: .
           file: ./Containerfile
+          push: false
+          pull: true # Zwingt Buildx, immer den neuesten Digest des Base-Images in der Registry zu prüfen
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}
-          outputs: type=oci,dest=./oci-image.tar
+          # 1. Build-Cache aus der Registry laden & schreiben
           cache-from: type=registry,ref=${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
           cache-to: type=registry,ref=${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+          # 2. Ausgabe als OCI-Archiv für Skopeo
+          outputs: type=oci,dest=/tmp/image.tar
 
-      # 2. OCI-Archiv entpacken
+      - name: Push Image via Skopeo (zstd:chunked)
-      - name: Extract OCI Layout
-        run: |
-          mkdir -p ./oci-image
-          tar -xf ./oci-image.tar -C ./oci-image
-          rm ./oci-image.tar
-
-    # 3. OCI-Image mit Chunkah verarbeiten (Binary via Docker-Container extrahieren)
-      - name: Process OCI Image with Chunkah
-        run: |
-          # 1. Fertiges Binary aus dem offiziellen Quay.io-Image auf den Runner kopieren
-          docker create --name temp-chunkah quay.io/coreos/chunkah:latest
-          docker cp temp-chunkah:/usr/bin/chunkah /tmp/chunkah
-          docker rm temp-chunkah
-          chmod +x /tmp/chunkah
-
-          # 2. Chunkah nativ auf dem OCI-Ordner ausführen (ohne Container-Layer)
-          /tmp/chunkah chunk --max-layers =128 ./oci-image
-
-      # 4. Skopeo nativ installieren
-      - name: Install Skopeo
         if: github.event_name != 'pull_request'
         run: |
-          sudo apt-get update && sudo apt-get install -y skopeo
+          TAGS="${{ steps.metadata.outputs.tags }}"
-
+          for TAG in $TAGS; do
-      # 5. Gechunketes Image mit Skopeo pushen & Digest erfassen
+            echo "Pushe ${TAG} via Skopeo mit zstd:chunked..."
-      - name: Push Chunked Image via Skopeo
+            docker run --rm \
-        if: github.event_name != 'pull_request'
+              -v /tmp/image.tar:/tmp/image.tar \
-        run: |
+              quay.io/skopeo/stable copy \
-          echo "${{ secrets.REGISTRY }}" | skopeo login "${{ env.REGISTRY_HOST }}" -u "${{ github.repository_owner }}" --password-stdin
+              --dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
-
-          for TAG_REF in ${{ steps.metadata.outputs.tags }}; do
-            echo "Pushe gechunketes Image nach: docker://${TAG_REF}"
-            skopeo copy \
               --dest-compress-format zstd:chunked \
-              --digestfile /tmp/digest.txt \
+              oci-archive:/tmp/image.tar \
-              oci:./oci-image "docker://${TAG_REF}"
+              "docker://${TAG}"
           done
 
-          echo "IMAGE_DIGEST=$(cat /tmp/digest.txt)" >> ${GITHUB_ENV}
-
       - name: Install envsubst dependencies
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         run: |
@@ -150,18 +120,24 @@ jobs:
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         uses: sigstore/cosign-installer@v4.1.2
 
-      # 6. Container Image signieren (nutzt direkt den von Skopeo erzeugten Digest)
+      - name: Sign container image (Recursive Digest)
-      - name: Sign container image
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         env:
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
           COSIGN_PASSWORD: ""
         run: |
+          # 1. Cosign an der Gitea-Registry anmelden
           echo "${{ secrets.REGISTRY }}" | cosign login "${{ env.REGISTRY_HOST }}" -u "${{ github.repository_owner }}" --password-stdin
           
-          IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}"
+          # 2. Skopeo als Docker-Container ausführen, um den Digest zu holen
-          echo "Signiere Manifest via Digest: ${IMAGE_REF}"
+          echo "Frage finalen Manifest-List-Digest via Skopeo-Container ab..."
+          OUTER_DIGEST=$(docker run --rm quay.io/skopeo/stable inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:stable | jq -r .Digest)
           
+          # 3. Die Referenz über den äußeren Digest bauen
+          IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${OUTER_DIGEST}"
+          echo "Signiere Manifest-List und alle Sub-Architekturen rekursiv via Digest: ${IMAGE_REF}"
+          
+          # 4. Signatur rekursiv auf Gitea pushen (ohne deprecated tlog-Flag)
           cosign sign -y \
             --key env://COSIGN_PRIVATE_KEY \
             --recursive \
@@ -174,5 +150,5 @@ jobs:
         if: always()
         run: |
           echo "Räume temporäre Dateien und Buildx-Cache auf..."
-          rm -rf ./oci-image /tmp/digest.txt || true
+          rm -f /tmp/image.tar
           docker buildx prune -a -f || true