From 54549c5b311be4e2c9c4db0b9e717073613e8b25 Mon Sep 17 00:00:00 2001
From: humocs-man <251756307+humocs-man@users.noreply.github.com>
Date: Sun, 17 May 2026 14:25:11 +0200
Subject: [PATCH] Refactor comments and clean up build.yml

Updated comments for clarity and removed unused variables in the build workflow.
---
 .github/workflows/build.yml | 25 ++++++++++---------------
 1 file changed, 10 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 823cc6f..09ca05f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -95,9 +95,8 @@ jobs:
           set -x
           BASE_IMAGE="${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}"
           
-          # 1. Das kritische ostree-Label im Runner sichern, bevor wir das Image zerlegen
+          # 1. Das ostree-Label im Runner sichern, bevor wir das Image zerlegen
           OSTREE_DIFFID=$(podman inspect $BASE_IMAGE --format '{{index .Config.Labels "ostree.final-diffid"}}' 2>/dev/null || echo "")
-          echo "OSTREE_DIFFID=$OSTREE_DIFFID" >> $GITHUB_ENV
 
           # Rootfs extrahieren
           CONTAINER_ID=$(podman create $BASE_IMAGE)
@@ -105,10 +104,16 @@ jobs:
           podman export $CONTAINER_ID | tar -xf - -C ./chunkah-in
           podman rm $CONTAINER_ID
 
-          # Die komplette Image-Config sichern
+          # Die originale Image-Config extrahieren
           podman inspect $BASE_IMAGE --format '{{json .Config}}' > ./chunkah-config.json
 
-          # Chunkah-Lauf
+          # LOKALER PATCH: Falls die DiffID existiert, schreiben wir sie via jq direkt in das JSON
+          if [ ! -z "$OSTREE_DIFFID" ]; then
+            jq --arg diffid "$OSTREE_DIFFID" '.Labels["ostree.final-diffid"] = $diffid' ./chunkah-config.json > ./chunkah-config-patched.json
+            mv ./chunkah-config-patched.json ./chunkah-config.json
+          fi
+
+          # Chunkah-Lauf (Übernimmt das lokal modifizierte JSON)
           podman run --rm \
             -v ./chunkah-in:/inputs:z \
             -v ./chunkah-out:/outputs:z \
@@ -135,21 +140,12 @@ jobs:
         run: |
           set -x
           
-          # Skopeo-Authentisierung über die Docker-Config des vorherigen Login-Schritts laden
           export REGISTRY_AUTH_FILE=$HOME/.docker/config.json
           REGISTRY_PATH="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
 
-          # Vorbereitung für das Injezieren des Labels in die OCI Config auf der Registry
-          PATCH_ARG=""
-          if [ ! -z "${{ env.OSTREE_DIFFID }}" ]; then
-            # Erstellt das exakte JSON-Fragment, das Skopeo in die Image-Config patcht
-            PATCH_ARG="--patch-config {\"config\":{\"Labels\":{\"ostree.final-diffid\":\"${{ env.OSTREE_DIFFID }}\"}}}"
-          fi
-
-          # Loop über alle von metadata-action generierten Tags
+          # Loop über alle Tags ohne das problematische --patch-config Flag
           for tag in ${{ steps.metadata.outputs.tags }}; do
             skopeo copy \
-              $PATCH_ARG \
               --dest-compress-format=zstd \
               --dest-compress-level=5 \
               oci-archive:./chunkah-out/image.ociarchive \
@@ -167,7 +163,6 @@ jobs:
       - name: Sign container image
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         run: |
-          # Nutzt den über Skopeo ermittelten Digest für das statische Signieren
           cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.FINAL_IMAGE_DIGEST }}"
         env:
           COSIGN_EXPERIMENTAL: false