ci: finalize manual podman build pipeline for fluffy-pancake

.gitea/workflows/build.yml

@@ -1,16 +1,13 @@
 name: Build container image
 
 on:
-  pull_request:
-    branches:
-      - main
   schedule:
-    - cron: '05 12 * * 2,5'   
+    - cron: '05 12 * * 2,5'   # Baut automatisch Dienstags und Freitags um 12:05 Uhr
-  workflow_dispatch:
+  workflow_dispatch:         # Schaltet den "Run Workflow"-Button im Gitea-Dashboard frei
 
 env:
   IMAGE_DESC: "Custom Fedora bootc image"
-  IMAGE_NAME: "${{ github.event.repository.name }}"
+  IMAGE_NAME: "fluffy-pancake"
   IMAGE_REGISTRY: "humocs-man.duckdns.org/${{ github.repository_owner }}"
   DEFAULT_TAG: "stable"
 
@@ -22,6 +19,9 @@ jobs:
   build_push:
     name: Build and push image
     runs-on: ubuntu-24.04
+    container:
+      image: quay.io/podman/stable:latest
+      options: --privileged
 
     permissions:
       contents: read
@@ -29,6 +29,10 @@ jobs:
       id-token: write
 
     steps:
+      - name: Install CI Prerequisites
+        run: |
+          dnf install -y curl jq
+
       - name: Prepare environment
         run: |
           echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
@@ -57,8 +61,6 @@ jobs:
             type=raw,value=${{ env.IMAGE_TAG }}
             type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
             type=raw,value={{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
-            type=sha,enable=${{ github.event_name == 'pull_request' }}
-            type=ref,event=pr
           labels: |
             org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}}
             org.opencontainers.image.description=${{ env.IMAGE_DESC }}
@@ -70,27 +72,13 @@ jobs:
           sep-tags: " "
           sep-annotations: " "
 
-      - name: Cache buildah layers
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cache/buildah
-            /tmp/.buildah-cache
-          key: ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile', 'build/**', 'configs/**', 'scripts/**') }}-${{ github.ref }}
-          restore-keys: |
-            ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile', 'build/**', 'configs/**', 'scripts/**') }}-
-            ${{ runner.os }}-${{ github.workflow }}-
-
       - name: Build Image
-        id: build_image
+        run: |
-        uses: redhat-actions/buildah-build@v2
+          podman build \
-        with:
+            -f ./Containerfile \
-          containerfiles: |
+            -t "localhost/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" \
-            ./Containerfile
+            $(echo "${{ steps.metadata.outputs.labels }}" | sed 's/^/--label /') \
-          image: ${{ env.IMAGE_NAME }}
+            .
-          tags: ${{ env.IMAGE_TAG }}
-          labels: ${{ steps.metadata.outputs.labels }}
-          oci: true
 
       - name: Rechunk with chunkah
         run: |
@@ -99,13 +87,12 @@ jobs:
           IMG="localhost/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
           CHUNKED_IMG="localhost/${{ env.IMAGE_NAME }}-chunked:${{ env.IMAGE_TAG }}"
 
-          CONFIG=$(buildah inspect "$IMG" | jq -c .)
+          CONFIG=$(podman inspect "$IMG" | jq -c .[0])
-          sudo rm -rf /tmp/.buildah-cache/* 2>/dev/null || true
 
           CHUNKAH_CF=$(mktemp)
           curl -sL https://github.com/coreos/chunkah/releases/download/v0.5.0/Containerfile.splitter -o "$CHUNKAH_CF"
 
-          buildah build --skip-unused-stages=false \
+          podman build --skip-unused-stages=false \
             -f "$CHUNKAH_CF" \
             --from "$IMG" \
             --build-arg CHUNKAH_CONFIG_STR="$CONFIG" \
@@ -113,42 +100,40 @@ jobs:
             -t "$CHUNKED_IMG" \
             .
 
-          rm -f "$CHUNKAH_CF" out.ociarchive
+          rm -f "$CHUNKAH_CF"
-          buildah rmi "$IMG"
+          podman rmi "$IMG"
 
           for full_tag in ${{ steps.metadata.outputs.tags }}; do
             tag_only="${full_tag##*:}"
-            buildah tag "$CHUNKED_IMG" "localhost/${{ env.IMAGE_NAME }}:${tag_only}"
+            podman tag "$CHUNKED_IMG" "localhost/${{ env.IMAGE_NAME }}:${tag_only}"
           done
-          buildah rmi "$CHUNKED_IMG"
+          podman rmi "$CHUNKED_IMG"
 
       - name: Login to Gitea Container Registry
-        uses: docker/login-action@v3
+        run: |
-        if: github.event_name != 'pull_request'
+          podman login -u "${{ github.actor }}" -p "${{ secrets.GITHUB_TOKEN }}" humocs-man.duckdns.org
-        with:
-          registry: humocs-man.duckdns.org
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push to Gitea Registry
-        id: push
+        run: |
-        if: github.event_name != 'pull_request'
+          for full_tag in ${{ steps.metadata.outputs.tags }}; do
-        uses: redhat-actions/push-to-registry@v2
+            tag_only="${full_tag##*:}"
-        with:
+            LOCAL_TAG="localhost/${{ env.IMAGE_NAME }}:${tag_only}"
-          image: ${{ env.IMAGE_NAME }}
+            REMOTE_TAG="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${tag_only}"
-          tags: ${{ steps.metadata.outputs.tags }}
+
-          registry: ${{ env.IMAGE_REGISTRY }}
+            podman tag "$LOCAL_TAG" "$REMOTE_TAG"
-          username: ${{ github.actor }}
+            podman push "$REMOTE_TAG"
-          password: ${{ secrets.GITHUB_TOKEN }}
+          done
+
+          DIGEST=$(podman inspect "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" | jq -r '.[0].Digest')
+          echo "IMAGE_DIGEST=$DIGEST" >> $GITHUB_ENV
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@v3
-        if: github.event_name != 'pull_request'
 
       - name: Sign container image
-        if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
+        if: env.IS_TEST_BUILD == 'false'
         run: |
-          cosign sign -y --tlog-upload=false --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}"
+          cosign sign -y --tlog-upload=false --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}"
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}