humocs-man/fluffy-pancake
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

ci: finalize manual podman build pipeline for fluffy-pancake

Browse Source
This commit is contained in:
gunnar
2026-06-05 18:31:31 +02:00
parent b17af542be
commit 7ca5a3d68a
1 changed files with 38 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build.yml
+38 -53
View File
@@ -1,16 +1,13 @@
name: Build container image
on:
pull_request:
branches:
- main
schedule:
- cron: '05 12 * * 2,5'
workflow_dispatch:
- cron: '05 12 * * 2,5' # Baut automatisch Dienstags und Freitags um 12:05 Uhr
workflow_dispatch: # Schaltet den "Run Workflow"-Button im Gitea-Dashboard frei
env:
IMAGE_DESC: "Custom Fedora bootc image"
IMAGE_NAME: "${{ github.event.repository.name }}"
IMAGE_NAME: "fluffy-pancake"
IMAGE_REGISTRY: "humocs-man.duckdns.org/${{ github.repository_owner }}"
DEFAULT_TAG: "stable"
@@ -22,6 +19,9 @@ jobs:
build_push:
name: Build and push image
runs-on: ubuntu-24.04
container:
image: quay.io/podman/stable:latest
options: --privileged
permissions:
contents: read
@@ -29,6 +29,10 @@ jobs:
id-token: write
steps:
- name: Install CI Prerequisites
run: |
dnf install -y curl jq
- name: Prepare environment
run: |
echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
@@ -57,8 +61,6 @@ jobs:
type=raw,value=${{ env.IMAGE_TAG }}
type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
type=raw,value={{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
type=sha,enable=${{ github.event_name == 'pull_request' }}
type=ref,event=pr
labels: |
org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}}
org.opencontainers.image.description=${{ env.IMAGE_DESC }}
@@ -70,27 +72,13 @@ jobs:
sep-tags: " "
sep-annotations: " "
- name: Cache buildah layers
uses: actions/cache@v4
with:
path: |
~/.cache/buildah
/tmp/.buildah-cache
key: ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile', 'build/**', 'configs/**', 'scripts/**') }}-${{ github.ref }}
restore-keys: |
${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile', 'build/**', 'configs/**', 'scripts/**') }}-
${{ runner.os }}-${{ github.workflow }}-
- name: Build Image
id: build_image
uses: redhat-actions/buildah-build@v2
with:
containerfiles: |
./Containerfile
image: ${{ env.IMAGE_NAME }}
tags: ${{ env.IMAGE_TAG }}
labels: ${{ steps.metadata.outputs.labels }}
oci: true
run: |
podman build \
-f ./Containerfile \
-t "localhost/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" \
$(echo "${{ steps.metadata.outputs.labels }}" | sed 's/^/--label /') \
.
- name: Rechunk with chunkah
run: |
@@ -99,13 +87,12 @@ jobs:
IMG="localhost/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
CHUNKED_IMG="localhost/${{ env.IMAGE_NAME }}-chunked:${{ env.IMAGE_TAG }}"
CONFIG=$(buildah inspect "$IMG" | jq -c .)
sudo rm -rf /tmp/.buildah-cache/* 2>/dev/null || true
CONFIG=$(podman inspect "$IMG" | jq -c .[0])
CHUNKAH_CF=$(mktemp)
curl -sL https://github.com/coreos/chunkah/releases/download/v0.5.0/Containerfile.splitter -o "$CHUNKAH_CF"
buildah build --skip-unused-stages=false \
podman build --skip-unused-stages=false \
-f "$CHUNKAH_CF" \
--from "$IMG" \
--build-arg CHUNKAH_CONFIG_STR="$CONFIG" \
@@ -113,42 +100,40 @@ jobs:
-t "$CHUNKED_IMG" \
.
rm -f "$CHUNKAH_CF" out.ociarchive
buildah rmi "$IMG"
rm -f "$CHUNKAH_CF"
podman rmi "$IMG"
for full_tag in ${{ steps.metadata.outputs.tags }}; do
tag_only="${full_tag##*:}"
buildah tag "$CHUNKED_IMG" "localhost/${{ env.IMAGE_NAME }}:${tag_only}"
podman tag "$CHUNKED_IMG" "localhost/${{ env.IMAGE_NAME }}:${tag_only}"
done
buildah rmi "$CHUNKED_IMG"
podman rmi "$CHUNKED_IMG"
- name: Login to Gitea Container Registry
uses: docker/login-action@v3
if: github.event_name != 'pull_request'
with:
registry: humocs-man.duckdns.org
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
run: |
podman login -u "${{ github.actor }}" -p "${{ secrets.GITHUB_TOKEN }}" humocs-man.duckdns.org
- name: Push to Gitea Registry
id: push
if: github.event_name != 'pull_request'
uses: redhat-actions/push-to-registry@v2
with:
image: ${{ env.IMAGE_NAME }}
tags: ${{ steps.metadata.outputs.tags }}
registry: ${{ env.IMAGE_REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
run: |
for full_tag in ${{ steps.metadata.outputs.tags }}; do
tag_only="${full_tag##*:}"
LOCAL_TAG="localhost/${{ env.IMAGE_NAME }}:${tag_only}"
REMOTE_TAG="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${tag_only}"
podman tag "$LOCAL_TAG" "$REMOTE_TAG"
podman push "$REMOTE_TAG"
done
DIGEST=$(podman inspect "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" | jq -r '.[0].Digest')
echo "IMAGE_DIGEST=$DIGEST" >> $GITHUB_ENV
- name: Install Cosign
uses: sigstore/cosign-installer@v3
if: github.event_name != 'pull_request'
- name: Sign container image
if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
if: env.IS_TEST_BUILD == 'false'
run: |
cosign sign -y --tlog-upload=false --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}"
cosign sign -y --tlog-upload=false --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}"
env:
COSIGN_EXPERIMENTAL: false
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}