switched to push by skopeo for OCI

.gitea/workflows/build.yml

@@ -58,8 +58,8 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Image Metadata
-        uses: docker/metadata-action@v5
         id: metadata
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY_HOST }}/${{ github.repository }}
           tags: |
@@ -80,6 +80,11 @@ jobs:
             containers.bootc=1
             ostree.bootable=1
 
+      - name: Install Skopeo
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y skopeo
+
       - name: Login to Gitea Container Registry
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
@@ -88,16 +93,30 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.REGISTRY }}
 
-      - name: Build and Push Image
+      - name: Build Image Locally
         uses: docker/build-push-action@v6
         id: build_image
         with:
           context: .
           file: ./Containerfile
-          push: ${{ github.event_name != 'pull_request' }}
+          push: false  # Docker baut nur, schiebt aber nichts hoch
+          load: true   # Lädt das Image direkt in den lokalen Docker-Daemon des Runners
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}
 
+      - name: Push Image via Skopeo (Convert to OCI)
+        if: github.event_name != 'pull_request'
+        run: |
+          # Loop über alle von metadata-action generierten Tags
+          for tag in ${{ steps.metadata.outputs.tags }}; do
+            echo "Pushing and converting $tag to clean OCI format..."
+            skopeo copy \
+              --format oci \
+              --dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
+              docker-daemon:$tag \
+              docker://$tag
+          done
+
       - name: Install envsubst dependencies
         if: github.event_name != 'pull_request'
         run: |
@@ -107,19 +126,20 @@ jobs:
         if: github.event_name != 'pull_request'
         uses: sigstore/cosign-installer@v4.1.2
 
-      - name: Install skopeo
-        run: sudo apt-get update && sudo apt-get install -y skopeo
-
       - name: Sign container image
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         run: |
-          DIGEST=$(skopeo inspect docker://humocs-man.duckdns.org/humocs-man/fluffy-pancake:stable --format '{{.Digest}}')
+          # Dynamische Ziel-URL zusammenbauen
+          IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
 
-          # Flag und Wert korrekt kombiniert:
+          echo "Fetching digest for $IMAGE_REF..."
+          DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}')
+
+          echo "Signing OCI reference..."
           cosign sign -y \
             --key env://COSIGN_PRIVATE_KEY \
             --registry-referrers-mode=oci-1-1 \
-            "humocs-man.duckdns.org/humocs-man/fluffy-pancake@${DIGEST}"
+            "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"
         env:
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
           COSIGN_PASSWORD: ""