.gitea/workflows/redhat_build.yml aktualisiert

.gitea/workflows/redhat_build.yml

@@ -32,9 +32,7 @@ jobs:
 
       - name: Prepare environment
         run: |
-          # Extrahiert die reine Domain/Host aus der Gitea-URL
           REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}')
-
           OWNER_LOWER="${{ github.repository_owner }}"
           NAME_LOWER="${{ env.IMAGE_NAME }}"
 
@@ -42,6 +40,10 @@ jobs:
           echo "IMAGE_REGISTRY=${REGISTRY_HOST}/${OWNER_LOWER,,}" >> "${GITHUB_ENV}"
           echo "IMAGE_NAME=${NAME_LOWER,,}" >> "${GITHUB_ENV}"
 
+      # ------------------------------------------------------------
+      # Image tag
+      # ------------------------------------------------------------
+
       - name: Determine image tag
         run: |
           BRANCH="${GITHUB_REF_NAME}"
@@ -59,7 +61,7 @@ jobs:
           fi
 
       # ------------------------------------------------------------
-      # Source
+      # Checkout
       # ------------------------------------------------------------
 
       - name: Checkout
@@ -114,21 +116,15 @@ jobs:
           password: ${{ secrets.REGISTRY }}
 
       # ------------------------------------------------------------
-      # Prepare OCI archive destination
+      # Prepare OCI output
       # ------------------------------------------------------------
 
       - name: Prepare OCI archive
         run: |
-          # Wichtig:
-          # Falls aus einem vorherigen Lauf / Schritt ein Verzeichnis
-          # namens oci-layout.tar existiert, muss es weg.
           rm -rf "${{ github.workspace }}/oci-layout.tar"
 
-          echo "OCI output path:"
-          echo "${{ github.workspace }}/oci-layout.tar"
-
       # ------------------------------------------------------------
-      # Build
+      # Build image
       # ------------------------------------------------------------
 
       - name: Build Image (Docker Buildx OCI-Export)
@@ -147,13 +143,20 @@ jobs:
           cache-from: type=registry,ref=${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
           cache-to: type=registry,ref=${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
 
-          # Explizit ein OCI-TAR-Archiv erzeugen.
-          #
-          # tar=true ist absichtlich explizit gesetzt.
           outputs: type=oci,dest=${{ github.workspace }}/oci-layout.tar,tar=true
 
       # ------------------------------------------------------------
-      # Push using Skopeo
+      # Install Skopeo
+      # ------------------------------------------------------------
+
+      - name: Install Skopeo
+        if: github.event_name != 'pull_request'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y skopeo
+
+      # ------------------------------------------------------------
+      # Push image via Skopeo
       # ------------------------------------------------------------
 
       - name: Push Image via Skopeo (zstd:chunked)
@@ -163,20 +166,18 @@ jobs:
 
           TAGS="${{ steps.metadata.outputs.tags }}"
 
-            for TAG in $TAGS; do
+          for TAG in $TAGS; do
             echo "Pushe ${TAG} via Skopeo mit zstd:chunked..."
 
-            docker run --rm \
+            skopeo copy \
-            -v "${{ github.workspace }}:/workspace:ro" \
+              --dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
-            quay.io/skopeo/stable copy \
+              --dest-compress-format zstd:chunked \
-            --dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
+              "oci-archive:${{ github.workspace }}/oci-layout.tar" \
-            --dest-compress-format zstd:chunked \
+              "docker://${TAG}"
-            oci-archive:/workspace/oci-layout.tar \
-            "docker://${TAG}"
           done
 
       # ------------------------------------------------------------
-      # Install dependencies for signing
+      # Install envsubst
       # ------------------------------------------------------------
 
       - name: Install envsubst dependencies
@@ -186,34 +187,34 @@ jobs:
           sudo apt-get install -y gettext
 
       # ------------------------------------------------------------
-      # Cosign
+      # Install Cosign
       # ------------------------------------------------------------
 
       - name: Install Cosign
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         uses: sigstore/cosign-installer@v4.1.2
 
+      # ------------------------------------------------------------
+      # Sign image
+      # ------------------------------------------------------------
+
       - name: Sign container image (Recursive Digest)
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         env:
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
           COSIGN_PASSWORD: ""
-
         run: |
           set -e
 
-          # 1. Cosign an der Gitea-Registry anmelden
           echo "${{ secrets.REGISTRY }}" \
             | cosign login "${{ env.REGISTRY_HOST }}" \
                 -u "${{ github.repository_owner }}" \
                 --password-stdin
 
-          # 2. Finalen Digest via Skopeo abfragen
           echo "Frage finalen Registry-Digest via Skopeo ab..."
 
           OUTER_DIGEST=$(
-            docker run --rm \
+            skopeo inspect \
-              quay.io/skopeo/stable inspect \
               --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
               "docker://${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:stable" \
               | jq -r .Digest
@@ -221,13 +222,11 @@ jobs:
 
           echo "Registry digest: ${OUTER_DIGEST}"
 
-          # 3. Digest-basierte Referenz bauen
           IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${OUTER_DIGEST}"
 
           echo "Signiere Image rekursiv:"
           echo "${IMAGE_REF}"
 
-          # 4. Rekursive Signatur
           cosign sign -y \
             --key env://COSIGN_PRIVATE_KEY \
             --recursive \
@@ -245,6 +244,6 @@ jobs:
         run: |
           echo "Räume temporäre Dateien und Buildx-Cache auf..."
 
-          rm -rf "${{ github.workspace }}/oci-layout.tar"
+          rm -f "${{ github.workspace }}/oci-layout.tar"
 
           docker buildx prune -a -f || true