feat: support manual builds from feature branches

- build.yml: determine image tag from branch (main=stable, other=test-<branch>)
- build.yml: allow push on workflow_dispatch from any branch
- build.yml: only sign images from main branch
- build-installer-iso.yml: add image_tag input (default: stable)

.github/workflows/build-installer-iso.yml

@@ -10,7 +10,6 @@ concurrency:
 env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
   IMAGE_NAME: "${{ github.event.repository.name }}"
-  DEFAULT_TAG: "stable"
 
 jobs:
   build-iso:
@@ -25,6 +24,17 @@ jobs:
           echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
           echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
 
+      - name: Determine image tag
+        run: |
+          BRANCH="${GITHUB_REF_NAME}"
+          if [[ "$BRANCH" == "main" ]]; then
+            echo "IMAGE_TAG=stable" >> ${GITHUB_ENV}
+          else
+            SANITIZED=$(echo "$BRANCH" | sed 's/[^a-zA-Z0-9._-]/-/g' | head -c 50)
+            echo "IMAGE_TAG=test-${SANITIZED}" >> ${GITHUB_ENV}
+          fi
+          echo "Building from tag: ${IMAGE_TAG}"
+
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
@@ -47,7 +57,7 @@ jobs:
 
       - name: Pull base image
         run: |
-          sudo podman pull ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
+          sudo podman pull ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
 
       - name: Build ISO
         run: |
@@ -60,7 +70,7 @@ jobs:
             --rootfs btrfs \
             --config /config.toml \
             --output /output/ \
-            ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
+            ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
 
       - name: Upload ISO artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

.github/workflows/build.yml

@@ -33,6 +33,18 @@ jobs:
           echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
           echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
 
+      - name: Determine image tag
+        run: |
+          BRANCH="${GITHUB_REF_NAME}"
+          if [[ "$BRANCH" == "main" ]]; then
+            echo "IMAGE_TAG=${DEFAULT_TAG}" >> ${GITHUB_ENV}
+            echo "IS_TEST_BUILD=false" >> ${GITHUB_ENV}
+          else
+            SANITIZED=$(echo "$BRANCH" | sed 's/[^a-zA-Z0-9._-]/-/g' | head -c 50)
+            echo "IMAGE_TAG=test-${SANITIZED}" >> ${GITHUB_ENV}
+            echo "IS_TEST_BUILD=true" >> ${GITHUB_ENV}
+          fi
+
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
 
@@ -48,9 +60,9 @@ jobs:
         id: metadata
         with:
           tags: |
-            type=raw,value=${{ env.DEFAULT_TAG }}
+            type=raw,value=${{ env.IMAGE_TAG }}
-            type=raw,value=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
+            type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
-            type=raw,value={{date 'YYYYMMDD'}}
+            type=raw,value={{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
             type=sha,enable=${{ github.event_name == 'pull_request' }}
             type=ref,event=pr
           labels: |
@@ -61,7 +73,7 @@ jobs:
             org.opencontainers.image.title=${{ env.IMAGE_NAME }}
             org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/tree/${{ github.sha }}
             org.opencontainers.image.vendor=${{ github.repository_owner }}
-            org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
+            org.opencontainers.image.version=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}}
             containers.bootc=1
             ostree.bootable=1
           sep-tags: " "
@@ -87,7 +99,7 @@ jobs:
           containerfiles: |
             ./Containerfile
           image: ${{ env.IMAGE_NAME }}
-          tags: ${{ env.DEFAULT_TAG }}
+          tags: ${{ env.IMAGE_TAG }}
           labels: ${{ steps.metadata.outputs.labels }}
           oci: true
 
@@ -95,8 +107,8 @@ jobs:
         run: |
           set -euo pipefail
 
-          IMG="localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}"
+          IMG="localhost/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
-          CHUNKED_IMG="localhost/${{ env.IMAGE_NAME }}-chunked:${{ env.DEFAULT_TAG }}"
+          CHUNKED_IMG="localhost/${{ env.IMAGE_NAME }}-chunked:${{ env.IMAGE_TAG }}"
 
           # Image-Config fuer chunkah sichern (Labels, Annotations, etc.)
           CONFIG=$(buildah inspect "$IMG" | jq -c .)
@@ -115,7 +127,7 @@ jobs:
             -f "$CHUNKAH_CF" \
             --from "$IMG" \
             --build-arg CHUNKAH_CONFIG_STR="$CONFIG" \
-            --build-arg "CHUNKAH_ARGS=--prune /sysroot/ --max-layers 128 --compressed --label ostree.commit- --label ostree.final-diffid- --label ostree.bootable=true" \
+            --build-arg "CHUNKAH_ARGS=--prune /sysroot/ --max-layers 128 --compressed --label ostree.commit- --label ostree.final-diffid- --label ostree.bootable=true --label containers.bootc=1" \
             -t "$CHUNKED_IMG" \
             .
 
@@ -131,7 +143,7 @@ jobs:
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v3
-        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        if: github.event_name != 'pull_request'
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -139,7 +151,7 @@ jobs:
 
       - name: Push to GHCR
         id: push
-        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        if: github.event_name != 'pull_request'
         uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
         with:
           image: ${{ env.IMAGE_NAME }}
@@ -150,10 +162,10 @@ jobs:
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        if: github.event_name != 'pull_request'
       
       - name: Sign container image
-        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+        if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         run: |
           cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}"
         env: