From 34e13a0bbef83f2d50348f23ea0e2d24e4f3ddd8 Mon Sep 17 00:00:00 2001
From: gunnar <gunnar@users.noreply.github.com>
Date: Fri, 12 Jun 2026 20:12:27 +0200
Subject: [PATCH] changed build to buildah

---
 .gitea/workflows/build.yml | 94 +++++++++++++++++++++++++++++---------
 1 file changed, 73 insertions(+), 21 deletions(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index f3ac4f2..e30f17a 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -53,9 +53,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4.2.2
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.10.0
-
       - name: Image Metadata
         id: metadata
         uses: docker/metadata-action@v5.7.0
@@ -79,25 +76,81 @@ jobs:
             containers.bootc=1
             ostree.bootable=1
 
-      - name: Login to Gitea Container Registry
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3.3.0
-        with:
-          registry: ${{ env.REGISTRY_HOST }}
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.REGISTRY }}
-
-      - name: Build and Push Image (Native OCI via Buildx)
-        uses: docker/build-push-action@v6.2.0
+      - name: Build and Push Image (Buildah unprivileged)
         id: build_image
-        with:
-          context: .
-          file: ./Containerfile
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.metadata.outputs.tags }}
-          labels: ${{ steps.metadata.outputs.labels }}
+        run: |
+          # Metadaten in Dateien schreiben, damit sie im Tar-Stream landen
+          cat << 'EOF' > labels.txt
+          ${{ steps.metadata.outputs.labels }}
+          EOF
 
-      - name: Install Cosign
+          cat << 'EOF' > tags.txt
+          ${{ steps.metadata.outputs.tags }}
+          EOF
+
+          # Buildah-Container starten und Image im RAM-Dateisystem bauen
+          BUILD_OUTPUT=$(tar -cf - . | docker run -i --rm \
+            --cap-add=SYS_ADMIN \
+            --security-opt seccomp=unconfined \
+            --security-opt apparmor=unconfined \
+            --security-opt label=disable \
+            --tmpfs /var/lib/containers:exec \
+            --ulimit nofile=1048576:1048576 \
+            quay.io/buildah/stable:latest \
+            bash -c '
+              mkdir /src && tar -xf - -C /src
+
+              # Labels sauber in ein Bash-Array einlesen (verhindert Escaping-Fehler)
+              declare -a LABEL_ARGS
+              while IFS= read -r line || [ -n "$line" ]; do
+                [ -z "$line" ] && continue
+                LABEL_ARGS+=("--label" "$line")
+              done < /src/labels.txt
+
+              FIRST_TAG=$(head -n 1 /src/tags.txt)
+
+              # 1. Image mit den dynamischen OCI-Labels bauen
+              buildah --storage-driver=vfs --isolation=chroot bud \
+                "${LABEL_ARGS[@]}" \
+                -t "$FIRST_TAG" \
+                -f /src/Containerfile /src
+
+              # 2. Wenn kein PR, direkt aus Buildah in die Gitea-Registry pushen
+              if [ "${{ github.event_name }}" != "pull_request" ]; then
+                PUSH_OUT=$(buildah --storage-driver=vfs push --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" "$FIRST_TAG" "docker://$FIRST_TAG")
+                echo "$PUSH_OUT"
+
+                # Alle weiteren von metadata-action generierten Tags pushen
+                while IFS= read -r tag || [ -n "$tag" ]; do
+                  [ -z "$tag" ] && continue
+                  if [ "$tag" != "$FIRST_TAG" ]; then
+                    buildah --storage-driver=vfs tag "$FIRST_TAG" "$tag"
+                    buildah --storage-driver=vfs push --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" "$tag" "docker://$tag"
+                  fi
+                done < /src/tags.txt
+
+                # Den echten Image-Digest aus den Push-Logs für Cosign extrahieren
+                DIGEST=$(echo "$PUSH_OUT" | grep -oE "sha256:[a-f0-9]{64}" | tail -n 1)
+                echo "CONTAINER_DIGEST=${DIGEST}"
+              fi
+            ')
+
+          # Log-Ausgabe für das Gitea Actions UI
+          echo "$BUILD_OUTPUT"
+
+          # Digest an den Runner-Schritt übergeben, falls gepusht wurde
+          if [ "${{ github.event_name }}" != "pull_request" ]; then
+            IMAGE_DIGEST=$(echo "$BUILD_OUTPUT" | grep "CONTAINER_DIGEST=" | cut -d= -f2)
+            echo "digest=${IMAGE_DIGEST}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Install gettext (provides envsubst)
+        if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gettext
+
+      - name: Install Cosign via official Action
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         uses: sigstore/cosign-installer@v4.1.2
 
@@ -107,7 +160,6 @@ jobs:
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
           COSIGN_PASSWORD: ""
         run: |
-          # Extrahiert den eindeutigen Digest direkt aus dem Buildx-Schritt
           IMAGE_DIGEST="${{ steps.build_image.outputs.digest }}"
           IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${IMAGE_DIGEST}"