From 825cc3795d29477852d6301fb8d60a7a9308b8eb Mon Sep 17 00:00:00 2001 From: humocs-man Date: Sun, 14 Jun 2026 19:30:05 +0000 Subject: [PATCH] .gitea/workflows/build.yml aktualisiert buildah-refactoring --- .gitea/workflows/build.yml | 83 +++++++++++++++++--------------------- 1 file changed, 37 insertions(+), 46 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 17212f4..9a4f237 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -12,6 +12,8 @@ env: IMAGE_DESC: "Custom Fedora bootc image" IMAGE_NAME: "${{ github.event.repository.name }}" DEFAULT_TAG: "stable" + # Erzwingt die Verwendung von Node 24 für alle JavaScript-Actions + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" concurrency: group: ${{ github.workflow }}-${{ github.ref || github.run_id }} @@ -21,20 +23,16 @@ jobs: build_push: name: Build and push image runs-on: ubuntu-24.04 - permissions: contents: read packages: write id-token: write - steps: - name: Prepare environment run: | - # Extrahiert die reine Domain/Host aus der Gitea-URL REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}') OWNER_LOWER="${{ github.repository_owner }}" NAME_LOWER="${{ env.IMAGE_NAME }}" - echo "REGISTRY_HOST=${REGISTRY_HOST}" >> ${GITHUB_ENV} echo "IMAGE_REGISTRY=${REGISTRY_HOST}/${OWNER_LOWER,,}" >> ${GITHUB_ENV} echo "IMAGE_NAME=${NAME_LOWER,,}" >> ${GITHUB_ENV} @@ -52,22 +50,26 @@ jobs: fi - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v4 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + - name: Generate Tags + id: generate_tags + run: | + TAGS="${{ env.IMAGE_TAG }}" + if [[ "${{ env.IS_TEST_BUILD }}" == "false" ]]; then + DATE_TAG=$(date +'%Y%m%d') + TAGS="${TAGS} ${{ env.IMAGE_TAG }}.${DATE_TAG} ${DATE_TAG}" + fi + if [[ "${{ github.event_name }}" == "pull_request" ]]; then + TAGS="pr-${{ github.event.pull_request.number }} sha-${GITHUB_SHA::7}" + fi + echo "tags=${TAGS}" >> $GITHUB_OUTPUT - name: Image Metadata id: metadata uses: docker/metadata-action@v6 with: images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }} - tags: | - type=raw,value=${{ env.IMAGE_TAG }} - type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }} - type=raw,value={{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }} - type=sha,enable=${{ github.event_name == 'pull_request' }} - type=ref,event=pr labels: | org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}} org.opencontainers.image.description=${{ env.IMAGE_DESC }} @@ -80,30 +82,28 @@ jobs: containers.bootc=1 ostree.bootable=1 - - name: Login to Gitea Container Registry - if: github.event_name != 'pull_request' - uses: docker/login-action@v4 + - name: Build Image (Buildah) + id: build_image + uses: redhat-actions/buildah-build@v2 with: + context: . + containerfiles: ./Containerfile + image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }} + tags: ${{ steps.generate_tags.outputs.tags }} + labels: ${{ steps.metadata.outputs.labels }} + oci: true + + - name: Push to Registry + id: push_image + if: github.event_name != 'pull_request' + uses: redhat-actions/push-to-registry@v2 + with: + image: ${{ steps.build_image.outputs.image }} + tags: ${{ steps.build_image.outputs.tags }} registry: ${{ env.REGISTRY_HOST }} username: ${{ github.repository_owner }} password: ${{ secrets.REGISTRY }} - - name: Build and Push Image (Docker Buildx) - uses: docker/build-push-action@v7 - id: build_image - with: - context: . - file: ./Containerfile - push: ${{ github.event_name != 'pull_request' }} - no-cache: true - tags: ${{ steps.metadata.outputs.tags }} - labels: ${{ steps.metadata.outputs.labels }} - - - name: Install envsubst dependencies - if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false' - run: | - sudo apt-get update && sudo apt-get install -y gettext - - name: Install Cosign if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false' uses: sigstore/cosign-installer@v4.1.2 @@ -114,13 +114,9 @@ jobs: COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} COSIGN_PASSWORD: "" run: | - # Cosign an der Gitea-Registry anmelden echo "${{ secrets.REGISTRY }}" | cosign login "${{ env.REGISTRY_HOST }}" -u "${{ github.repository_owner }}" --password-stdin - - # Den exakten Digest direkt aus dem Buildx-Output ziehen - DIGEST="${{ steps.build_image.outputs.digest }}" + DIGEST="${{ steps.push_image.outputs.digest }}" IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}" - echo "Signiere exklusiv via Digest: ${IMAGE_REF}" cosign sign -y \ --key env://COSIGN_PRIVATE_KEY \ @@ -133,12 +129,7 @@ jobs: - name: Post-Build Cleanup if: always() run: | - echo "Führe serverseitige Tiefenreinigung durch..." - - # 1. Löscht ungenutzte Zwischenschritte und temporäre Volumes - docker system prune -f --volumes - - # 2. Killt den BuildKit-Cache komplett (Verhindert das unbemerktes Zumüllen des VPS) - docker builder prune -af - - echo "VPS-Speicherplatz erfolgreich bereinigt!" + echo "Führe Smart Cleanup durch..." + buildah rm $(buildah containers -q) >/dev/null 2>&1 || true + buildah rmi $(buildah images -f "dangling=true" -q) >/dev/null 2>&1 || true + echo "Speicherplatz bereinigt." \ No newline at end of file