switch to buildah/chunkah
This commit is contained in:
gunnar
+82
-55
@@ -1,9 +1,9 @@
|
||||
name: Build container image
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
#pull_request:
|
||||
#branches:
|
||||
#- main
|
||||
schedule:
|
||||
- cron: '05 12 * * 2,5'
|
||||
workflow_dispatch:
|
||||
@@ -30,7 +30,6 @@ jobs:
|
||||
steps:
|
||||
- name: Prepare environment
|
||||
run: |
|
||||
# Extrahiert die reine Domain/Host (inkl. Port, falls vorhanden) aus der Gitea-URL
|
||||
REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}')
|
||||
OWNER_LOWER="${{ github.repository_owner }}"
|
||||
NAME_LOWER="${{ env.IMAGE_NAME }}"
|
||||
@@ -41,7 +40,7 @@ jobs:
|
||||
|
||||
- name: Determine image tag
|
||||
run: |
|
||||
BRANCH="${GITHUB_REF_NAME}"
|
||||
BRANCH="$GITHUB_REF_NAME"
|
||||
if [[ "$BRANCH" == "main" ]]; then
|
||||
echo "IMAGE_TAG=${DEFAULT_TAG}" >> ${GITHUB_ENV}
|
||||
echo "IS_TEST_BUILD=false" >> ${GITHUB_ENV}
|
||||
@@ -52,16 +51,15 @@ jobs:
|
||||
fi
|
||||
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v5
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
# Abgesichert: entspricht actions/checkout@v5.0.0 (oder aktuellste v5-Commit)
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5.0.0
|
||||
|
||||
- name: Image Metadata
|
||||
id: metadata
|
||||
uses: docker/metadata-action@v5
|
||||
# Abgesichert: entspricht docker/metadata-action@v5.7.0
|
||||
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
|
||||
with:
|
||||
images: ${{ env.REGISTRY_HOST }}/${{ github.repository }}
|
||||
images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
tags: |
|
||||
type=raw,value=${{ env.IMAGE_TAG }}
|
||||
type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
|
||||
@@ -80,63 +78,91 @@ jobs:
|
||||
containers.bootc=1
|
||||
ostree.bootable=1
|
||||
|
||||
- name: Install Skopeo
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y skopeo
|
||||
|
||||
- name: Login to Gitea Container Registry
|
||||
- name: Login to Gitea Container Registry (Buildah)
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY_HOST }}
|
||||
username: ${{ github.repository_owner }}
|
||||
password: ${{ secrets.REGISTRY }}
|
||||
run: |
|
||||
echo "${{ secrets.REGISTRY }}" | buildah login -u "${{ github.repository_owner }}" --password-stdin ${{ env.REGISTRY_HOST }}
|
||||
|
||||
- name: Build Image Locally
|
||||
uses: docker/build-push-action@v6
|
||||
id: build_image
|
||||
with:
|
||||
context: .
|
||||
file: ./Containerfile
|
||||
push: false # Docker baut nur, schiebt aber nichts hoch
|
||||
load: true # Lädt das Image direkt in den lokalen Docker-Daemon des Runners
|
||||
tags: ${{ steps.metadata.outputs.tags }}
|
||||
labels: ${{ steps.metadata.outputs.labels }}
|
||||
- name: 1. Build Base OS Image (Rootless)
|
||||
run: |
|
||||
LABEL_ARGS=()
|
||||
while IFS= read -r line; do
|
||||
if [[ -n "$line" ]]; then
|
||||
LABEL_ARGS+=("--label" "$line")
|
||||
fi
|
||||
done <<< "${{ steps.metadata.outputs.labels }}"
|
||||
|
||||
- name: Push Image via Skopeo (Optimized Archive)
|
||||
buildah bud \
|
||||
--storage-driver=overlay \
|
||||
--storage-opt=overlay.mount_program=/usr/bin/fuse-overlayfs \
|
||||
--format=oci \
|
||||
"${LABEL_ARGS[@]}" \
|
||||
-t localhost/fluffy-pancake:base \
|
||||
-f ./Containerfile \
|
||||
.
|
||||
|
||||
- name: 2. Rechunk via Chunkah (Rootless)
|
||||
if: github.event_name != 'pull_request'
|
||||
env:
|
||||
GENERATED_TAGS: ${{ steps.metadata.outputs.tags }}
|
||||
run: |
|
||||
# Die mehrzeiligen Tags in ein Bash-Array umwandeln
|
||||
CHUNKAH_CONFIG_STR="$(podman inspect localhost/fluffy-pancake:base)"
|
||||
# Chunkah ist hier bereits vorbildlich über seinen immutable SHA-256 Digest gepinnt!
|
||||
CHUNKAH_REF="quay.io/coreos/chunkah:v0.6.0@sha256:ff8b8b466a942ec6000445d4001fc661e2fc5a952ad9ee29b4de9ab09d1d1708"
|
||||
|
||||
TAG_LIST=($GENERATED_TAGS)
|
||||
FIRST_TAG=${TAG_LIST[0]}
|
||||
|
||||
echo "Saving image ONCE via $FIRST_TAG to temporary tarball..."
|
||||
docker save "$FIRST_TAG" -o image.tar
|
||||
echo "Starte Re-Chunking für Haupt-Tag: $FIRST_TAG"
|
||||
buildah build \
|
||||
--storage-driver=overlay \
|
||||
--storage-opt=overlay.mount_program=/usr/bin/fuse-overlayfs \
|
||||
--skip-unused-stages=false \
|
||||
--from localhost/fluffy-pancake:base \
|
||||
--build-arg "CHUNKAH=${CHUNKAH_REF}" \
|
||||
--build-arg "CHUNKAH_CONFIG_STR=${CHUNKAH_CONFIG_STR}" \
|
||||
--build-arg "CHUNKAH_ARGS=--max-layers 128 --prune /sysroot/ --label ostree.commit- --label ostree.final-diffid-" \
|
||||
-t "$FIRST_TAG" \
|
||||
-v "$(pwd):/run/src" \
|
||||
--security-opt=label=disable \
|
||||
./Containerfile.splitter
|
||||
|
||||
# Jetzt loopen wir NUR den Upload-Schritt über dieselbe Datei
|
||||
for tag in "${TAG_LIST[@]}"; do
|
||||
echo "Pushing and converting $tag to clean OCI format..."
|
||||
skopeo copy \
|
||||
--format oci \
|
||||
--dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
|
||||
docker-archive:image.tar \
|
||||
docker://$tag
|
||||
if [[ "$tag" != "$FIRST_TAG" ]]; then
|
||||
echo "Zusätzliches Tag setzen: $tag"
|
||||
buildah tag --storage-driver=overlay "$FIRST_TAG" "$tag"
|
||||
fi
|
||||
done
|
||||
|
||||
# Am Ende sauber aufräumen
|
||||
rm -f image.tar
|
||||
rm -rf out
|
||||
|
||||
- name: Install envsubst dependencies
|
||||
- name: 3. Push OCI Images directly
|
||||
if: github.event_name != 'pull_request'
|
||||
env:
|
||||
GENERATED_TAGS: ${{ steps.metadata.outputs.tags }}
|
||||
run: |
|
||||
sudo apt-get update && sudo apt-get install -y gettext
|
||||
TAG_LIST=($GENERATED_TAGS)
|
||||
FIRST_TAG=${TAG_LIST[0]}
|
||||
|
||||
echo "Pushe primäres Image und extrahiere Digest für Cosign..."
|
||||
buildah push \
|
||||
--storage-driver=overlay \
|
||||
--digestfile primary_digest.txt \
|
||||
"$FIRST_TAG"
|
||||
|
||||
echo "IMAGE_DIGEST=$(cat primary_digest.txt)" >> ${GITHUB_ENV}
|
||||
|
||||
for tag in "${TAG_LIST[@]}"; do
|
||||
if [[ "$tag" != "$FIRST_TAG" ]]; then
|
||||
echo "Pushe zusätzliches Tag: $tag"
|
||||
buildah push --storage-driver=overlay "$tag"
|
||||
fi
|
||||
done
|
||||
|
||||
- name: Install Cosign
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: sigstore/cosign-installer@v4.1.2
|
||||
# Abgesichert: entspricht sigstore/cosign-installer@v3.8.1 (Stabile v3/v4-Basis)
|
||||
uses: sigstore/cosign-installer@dc267600647854ebb7c40d274a033735887d9e44 # v3.8.1
|
||||
|
||||
- name: Sign container image
|
||||
if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
|
||||
@@ -144,16 +170,17 @@ jobs:
|
||||
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
|
||||
COSIGN_PASSWORD: ""
|
||||
run: |
|
||||
IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
|
||||
|
||||
echo "Fetching digest for $IMAGE_REF..."
|
||||
DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}')
|
||||
|
||||
echo "Signing image with explicit Cosign v3 legacy bypass..."
|
||||
echo "Signing image mit lokal extrahiertem Digest: ${{ env.IMAGE_DIGEST }}"
|
||||
cosign sign -y \
|
||||
--key env://COSIGN_PRIVATE_KEY \
|
||||
--use-signing-config=false \
|
||||
--new-bundle-format=false \
|
||||
--tlog-upload=false \
|
||||
--registry-referrers-mode=legacy \
|
||||
"${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"
|
||||
"${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}"
|
||||
|
||||
- name: Post-Build Cleanup
|
||||
if: always()
|
||||
run: |
|
||||
echo "Bereinige unprivilegierten Buildah-Storage..."
|
||||
buildah prune --storage-driver=overlay --force
|
||||
|
||||
Reference in New Issue
Block a user