Refactor build workflow and optimize chunkah process

Removed commented-out code and unnecessary steps from the build workflow. Updated chunkah optimization process and added image-archive parameter for registry push.

.github/workflows/build.yml

@@ -5,11 +5,6 @@ on:
       - main
   schedule:
     - cron: '05 12 * * 2,5'   
- # push:
-    #branches:
-      #- main
-    #paths-ignore:
-     # - '**/README.md'
   workflow_dispatch:
 
 env:
@@ -35,11 +30,9 @@ jobs:
     steps:
       - name: Prepare environment
         run: |
-          # Lowercase the image uri
           echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
           echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
 
-      # These stage versions are pinned by https://github.com/renovatebot/renovate
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
 
@@ -96,7 +89,6 @@ jobs:
           labels: ${{ steps.metadata.outputs.labels }}
           oci: true
 
-      # --- CHUNKAH OPTIMIERUNG ---
       - name: Apply chunkah optimization
         id: chunkah
         run: |
@@ -109,10 +101,18 @@ jobs:
           podman export $CONTAINER_ID | tar -xf - -C ./chunkah-in
           podman rm $CONTAINER_ID
 
-          # Original-Konfiguration sichern
+          # Die komplette Image-Config sichern
           podman inspect $BASE_IMAGE --format '{{json .Config}}' > ./chunkah-config.json
           
-          # Chunkah-Lauf (Jetzt mit korrektem --rootfs Flag)
+          # Das kritische ostree-Label explizit auslesen, falls vorhanden
+          OSTREE_DIFFID=$(podman inspect $BASE_IMAGE --format '{{index .Config.Labels "ostree.final-diffid"}}' 2>/dev/null || echo "")
+
+          # Chunkah-Lauf: Annotation explizit übergeben, falls vorhanden
+          ANNOTATION_ARG=""
+          if [ ! -z "$OSTREE_DIFFID" ]; then
+            ANNOTATION_ARG="--annotation ostree.final-diffid=$OSTREE_DIFFID"
+          fi
+
           podman run --rm \
             -v ./chunkah-in:/inputs:z \
             -v ./chunkah-out:/outputs:z \
@@ -120,31 +120,13 @@ jobs:
             quay.io/coreos/chunkah:latest \
             build \
             --config /config.json \
+            $ANNOTATION_ARG \
             --prune /sysroot/ \
             --max-layers 128 \
             --compressed \
             --output /outputs/image.ociarchive \
             --rootfs /inputs
 
-          # Altes Image löschen, um Platz zu machen und Eindeutigkeit beim Laden zu sichern
-          podman rmi $BASE_IMAGE
-          podman load -i ./chunkah-out/image.ociarchive
-          
-          # Eindeutige ID-Zuweisung des frisch geladenen Images (schließt das Chunkah-Image aus)
-          IMAGE_ID=$(podman images --filter "dangling=true" --format "{{.ID}}" | head -n 1)
-          if [ -z "$IMAGE_ID" ]; then
-            IMAGE_ID=$(podman images --format "{{.ID}} {{.Repository}}" | grep -v "chunkah" | head -n 1 | awk '{print $1}')
-          fi
-          podman tag $IMAGE_ID $BASE_IMAGE
-
-          
-      - name: Tag for registry
-        run: |
-          for tag in ${{ steps.metadata.outputs.tags }}; do
-            podman tag ${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} ${{ env.IMAGE_NAME }}:$tag
-          done
-
-      # Login to GitHub Container Registry
       - name: Login to GitHub Container Registry
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v3
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
@@ -166,7 +148,7 @@ jobs:
           tags: ${{ steps.metadata.outputs.tags }}
           username: ${{ env.REGISTRY_USER }}
           password: ${{ env.REGISTRY_PASSWORD }}
-          # Erzwingt die Beibehaltung und Kompression der Layer als ZSTD beim Push in die Registry
+          image-archive: ./chunkah-out/image.ociarchive
           extra-args: --compression-format=zstd --compression-level=5
 
       - name: Install Cosign
@@ -176,7 +158,6 @@ jobs:
       - name: Sign container image
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         run: |
-          # Statisches Signing basierend auf dem unveränderlichen SHA256-Digest des Push-Schritts
           cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}"
         env:
           COSIGN_EXPERIMENTAL: false