.gitea/workflows/redhat_build.yml hinzugefügt

.gitea/workflows/redhat_build.yml

@@ -0,0 +1,148 @@
+name: Build container image
+
+on:
+  # pull_request:
+  #   branches:
+  #     - main
+  schedule:
+    - cron: '05 12 * * 2,5'
+  workflow_dispatch:
+
+env:
+  IMAGE_DESC: "Custom Fedora bootc image"
+  DEFAULT_TAG: "stable"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build_push:
+    name: Build and push image
+    runs-on: ubuntu-24.04
+
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+      - name: Prepare environment
+        run: |
+          # Extrahiert den Domain-Host aus der Gitea/GitHub-URL
+          REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}')
+          OWNER_LOWER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          
+          # Extrahiert den Repository-Namen sicher aus github.repository (owner/repo)
+          REPO_NAME=$(echo "${{ github.repository }}" | cut -d'/' -f2 | tr '[:upper:]' '[:lower:]')
+
+          echo "REGISTRY_HOST=${REGISTRY_HOST}" >> ${GITHUB_ENV}
+          echo "IMAGE_REGISTRY=${REGISTRY_HOST}/${OWNER_LOWER}" >> ${GITHUB_ENV}
+          echo "IMAGE_NAME=${REPO_NAME}" >> ${GITHUB_ENV}
+
+      - name: Determine image tag
+        run: |
+          BRANCH="${GITHUB_REF_NAME}"
+          if [[ "$BRANCH" == "main" ]]; then
+            echo "IMAGE_TAG=${DEFAULT_TAG}" >> ${GITHUB_ENV}
+            echo "IS_TEST_BUILD=false" >> ${GITHUB_ENV}
+          else
+            SANITIZED=$(echo "$BRANCH" | sed 's/[^a-zA-Z0-9._-]/-/g' | head -c 50)
+            echo "IMAGE_TAG=test-${SANITIZED}" >> ${GITHUB_ENV}
+            echo "IS_TEST_BUILD=true" >> ${GITHUB_ENV}
+          fi
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Image Metadata
+        id: metadata
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ env.IMAGE_TAG }}
+            type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
+            type=raw,value={{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
+            type=sha,enable=${{ github.event_name == 'pull_request' }}
+            type=ref,event=pr
+          labels: |
+            org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}}
+            org.opencontainers.image.description=${{ env.IMAGE_DESC }}
+            org.opencontainers.image.documentation=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
+            org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.vendor=${{ github.repository_owner }}
+            org.opencontainers.image.version=${{ env.IMAGE_TAG }}
+            containers.bootc=1
+            ostree.bootable=1
+
+      # 1. Image mit Buildah bauen
+      - name: Build Image with Buildah
+        id: build_image
+        uses: redhat-actions/buildah-build@v2
+        with:
+          image: ${{ env.IMAGE_NAME }}
+          tags: ${{ env.IMAGE_TAG }}
+          containerfiles: ./Containerfile
+          labels: ${{ steps.metadata.outputs.labels }}
+          oci: true
+
+      # 2. In lokales OCI-Verzeichnis exportieren
+      - name: Export Image to OCI Layout
+        run: |
+          buildah push ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} oci:./oci-image
+
+      # 3. Chunkah via Action auf das OCI-Verzeichnis anwenden
+      - name: Process OCI Image with Chunkah
+        uses: coreos/chunkah-action@v1
+        with:
+          target: ./oci-image
+
+      # 4. Gechunketes Image für ALLE generierten Tags in die Registry pushen
+      - name: Push Chunked Image to Registry
+        run: |
+          echo "${{ secrets.REGISTRY }}" | skopeo login "${{ env.REGISTRY_HOST }}" -u "${{ github.repository_owner }}" --password-stdin
+          
+          for TAG_REF in ${{ steps.metadata.outputs.tags }}; do
+            echo "Pushe gechunketes Image nach: docker://${TAG_REF}"
+            skopeo copy \
+              --dest-compress-format zstd:chunked \
+              --digestfile /tmp/digest.txt \
+              oci:./oci-image "docker://${TAG_REF}"
+          done
+          
+          # Speichere den erzeugten Manifest-Digest für den Cosign-Schritt
+          echo "IMAGE_DIGEST=$(cat /tmp/digest.txt)" >> ${GITHUB_ENV}
+
+      # 5. Cosign installieren
+      - name: Install Cosign
+        if: env.IS_TEST_BUILD == 'false'
+        uses: sigstore/cosign-installer@v3
+
+      # 6. Container Image signieren
+      - name: Sign container image
+        if: env.IS_TEST_BUILD == 'false'
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+          COSIGN_PASSWORD: ""
+        run: |
+          echo "${{ secrets.REGISTRY }}" | cosign login "${{ env.REGISTRY_HOST }}" -u "${{ github.repository_owner }}" --password-stdin
+          
+          IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}"
+          echo "Signiere Manifest via Digest: ${IMAGE_REF}"
+          
+          cosign sign -y \
+            --key env://COSIGN_PRIVATE_KEY \
+            --recursive \
+            --registry-referrers-mode=legacy \
+            "${IMAGE_REF}"
+
+      # 7. Lokalen OCI-Ordner und Buildah-Storage aufräumen
+      - name: Post-Build Cleanup
+        if: always()
+        run: |
+          echo "Bereinige temporären OCI-Ordner und Buildah-Storage..."
+          rm -rf ./oci-image /tmp/digest.txt || true
+          buildah rmi --all --force || true