diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 4322804..2dc49bc 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -1,16 +1,13 @@ name: Build container image on: - pull_request: - branches: - - main schedule: - - cron: '05 12 * * 2,5' - workflow_dispatch: + - cron: '05 12 * * 2,5' # Baut automatisch Dienstags und Freitags um 12:05 Uhr + workflow_dispatch: # Schaltet den "Run Workflow"-Button im Gitea-Dashboard frei env: IMAGE_DESC: "Custom Fedora bootc image" - IMAGE_NAME: "${{ github.event.repository.name }}" + IMAGE_NAME: "fluffy-pancake" IMAGE_REGISTRY: "humocs-man.duckdns.org/${{ github.repository_owner }}" DEFAULT_TAG: "stable" @@ -22,6 +19,9 @@ jobs: build_push: name: Build and push image runs-on: ubuntu-24.04 + container: + image: quay.io/podman/stable:latest + options: --privileged permissions: contents: read @@ -29,6 +29,10 @@ jobs: id-token: write steps: + - name: Install CI Prerequisites + run: | + dnf install -y curl jq + - name: Prepare environment run: | echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} @@ -57,8 +61,6 @@ jobs: type=raw,value=${{ env.IMAGE_TAG }} type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }} type=raw,value={{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }} - type=sha,enable=${{ github.event_name == 'pull_request' }} - type=ref,event=pr labels: | org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}} org.opencontainers.image.description=${{ env.IMAGE_DESC }} @@ -70,27 +72,13 @@ jobs: sep-tags: " " sep-annotations: " " - - name: Cache buildah layers - uses: actions/cache@v4 - with: - path: | - ~/.cache/buildah - /tmp/.buildah-cache - key: ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile', 'build/**', 'configs/**', 'scripts/**') }}-${{ github.ref }} - restore-keys: | - ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile', 'build/**', 'configs/**', 'scripts/**') }}- - ${{ runner.os }}-${{ github.workflow }}- - - name: Build Image - id: build_image - uses: redhat-actions/buildah-build@v2 - with: - containerfiles: | - ./Containerfile - image: ${{ env.IMAGE_NAME }} - tags: ${{ env.IMAGE_TAG }} - labels: ${{ steps.metadata.outputs.labels }} - oci: true + run: | + podman build \ + -f ./Containerfile \ + -t "localhost/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" \ + $(echo "${{ steps.metadata.outputs.labels }}" | sed 's/^/--label /') \ + . - name: Rechunk with chunkah run: | @@ -99,13 +87,12 @@ jobs: IMG="localhost/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" CHUNKED_IMG="localhost/${{ env.IMAGE_NAME }}-chunked:${{ env.IMAGE_TAG }}" - CONFIG=$(buildah inspect "$IMG" | jq -c .) - sudo rm -rf /tmp/.buildah-cache/* 2>/dev/null || true + CONFIG=$(podman inspect "$IMG" | jq -c .[0]) CHUNKAH_CF=$(mktemp) curl -sL https://github.com/coreos/chunkah/releases/download/v0.5.0/Containerfile.splitter -o "$CHUNKAH_CF" - buildah build --skip-unused-stages=false \ + podman build --skip-unused-stages=false \ -f "$CHUNKAH_CF" \ --from "$IMG" \ --build-arg CHUNKAH_CONFIG_STR="$CONFIG" \ @@ -113,42 +100,40 @@ jobs: -t "$CHUNKED_IMG" \ . - rm -f "$CHUNKAH_CF" out.ociarchive - buildah rmi "$IMG" + rm -f "$CHUNKAH_CF" + podman rmi "$IMG" for full_tag in ${{ steps.metadata.outputs.tags }}; do tag_only="${full_tag##*:}" - buildah tag "$CHUNKED_IMG" "localhost/${{ env.IMAGE_NAME }}:${tag_only}" + podman tag "$CHUNKED_IMG" "localhost/${{ env.IMAGE_NAME }}:${tag_only}" done - buildah rmi "$CHUNKED_IMG" + podman rmi "$CHUNKED_IMG" - name: Login to Gitea Container Registry - uses: docker/login-action@v3 - if: github.event_name != 'pull_request' - with: - registry: humocs-man.duckdns.org - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + run: | + podman login -u "${{ github.actor }}" -p "${{ secrets.GITHUB_TOKEN }}" humocs-man.duckdns.org - name: Push to Gitea Registry - id: push - if: github.event_name != 'pull_request' - uses: redhat-actions/push-to-registry@v2 - with: - image: ${{ env.IMAGE_NAME }} - tags: ${{ steps.metadata.outputs.tags }} - registry: ${{ env.IMAGE_REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + run: | + for full_tag in ${{ steps.metadata.outputs.tags }}; do + tag_only="${full_tag##*:}" + LOCAL_TAG="localhost/${{ env.IMAGE_NAME }}:${tag_only}" + REMOTE_TAG="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${tag_only}" + + podman tag "$LOCAL_TAG" "$REMOTE_TAG" + podman push "$REMOTE_TAG" + done + + DIGEST=$(podman inspect "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" | jq -r '.[0].Digest') + echo "IMAGE_DIGEST=$DIGEST" >> $GITHUB_ENV - name: Install Cosign uses: sigstore/cosign-installer@v3 - if: github.event_name != 'pull_request' - name: Sign container image - if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false' + if: env.IS_TEST_BUILD == 'false' run: | - cosign sign -y --tlog-upload=false --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}" + cosign sign -y --tlog-upload=false --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}" env: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}