.gitea/workflows/redhat_build.yml aktualisiert
This commit is contained in:
@@ -32,9 +32,7 @@ jobs:
|
||||
|
||||
- name: Prepare environment
|
||||
run: |
|
||||
# Extrahiert die reine Domain/Host aus der Gitea-URL
|
||||
REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}')
|
||||
|
||||
OWNER_LOWER="${{ github.repository_owner }}"
|
||||
NAME_LOWER="${{ env.IMAGE_NAME }}"
|
||||
|
||||
@@ -42,6 +40,10 @@ jobs:
|
||||
echo "IMAGE_REGISTRY=${REGISTRY_HOST}/${OWNER_LOWER,,}" >> "${GITHUB_ENV}"
|
||||
echo "IMAGE_NAME=${NAME_LOWER,,}" >> "${GITHUB_ENV}"
|
||||
|
||||
# ------------------------------------------------------------
|
||||
# Image tag
|
||||
# ------------------------------------------------------------
|
||||
|
||||
- name: Determine image tag
|
||||
run: |
|
||||
BRANCH="${GITHUB_REF_NAME}"
|
||||
@@ -59,7 +61,7 @@ jobs:
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------
|
||||
# Source
|
||||
# Checkout
|
||||
# ------------------------------------------------------------
|
||||
|
||||
- name: Checkout
|
||||
@@ -114,21 +116,15 @@ jobs:
|
||||
password: ${{ secrets.REGISTRY }}
|
||||
|
||||
# ------------------------------------------------------------
|
||||
# Prepare OCI archive destination
|
||||
# Prepare OCI output
|
||||
# ------------------------------------------------------------
|
||||
|
||||
- name: Prepare OCI archive
|
||||
run: |
|
||||
# Wichtig:
|
||||
# Falls aus einem vorherigen Lauf / Schritt ein Verzeichnis
|
||||
# namens oci-layout.tar existiert, muss es weg.
|
||||
rm -rf "${{ github.workspace }}/oci-layout.tar"
|
||||
|
||||
echo "OCI output path:"
|
||||
echo "${{ github.workspace }}/oci-layout.tar"
|
||||
|
||||
# ------------------------------------------------------------
|
||||
# Build
|
||||
# Build image
|
||||
# ------------------------------------------------------------
|
||||
|
||||
- name: Build Image (Docker Buildx OCI-Export)
|
||||
@@ -147,13 +143,20 @@ jobs:
|
||||
cache-from: type=registry,ref=${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
|
||||
cache-to: type=registry,ref=${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
|
||||
|
||||
# Explizit ein OCI-TAR-Archiv erzeugen.
|
||||
#
|
||||
# tar=true ist absichtlich explizit gesetzt.
|
||||
outputs: type=oci,dest=${{ github.workspace }}/oci-layout.tar,tar=true
|
||||
|
||||
# ------------------------------------------------------------
|
||||
# Push using Skopeo
|
||||
# Install Skopeo
|
||||
# ------------------------------------------------------------
|
||||
|
||||
- name: Install Skopeo
|
||||
if: github.event_name != 'pull_request'
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y skopeo
|
||||
|
||||
# ------------------------------------------------------------
|
||||
# Push image via Skopeo
|
||||
# ------------------------------------------------------------
|
||||
|
||||
- name: Push Image via Skopeo (zstd:chunked)
|
||||
@@ -166,17 +169,15 @@ jobs:
|
||||
for TAG in $TAGS; do
|
||||
echo "Pushe ${TAG} via Skopeo mit zstd:chunked..."
|
||||
|
||||
docker run --rm \
|
||||
-v "${{ github.workspace }}:/workspace:ro" \
|
||||
quay.io/skopeo/stable copy \
|
||||
skopeo copy \
|
||||
--dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
|
||||
--dest-compress-format zstd:chunked \
|
||||
oci-archive:/workspace/oci-layout.tar \
|
||||
"oci-archive:${{ github.workspace }}/oci-layout.tar" \
|
||||
"docker://${TAG}"
|
||||
done
|
||||
|
||||
# ------------------------------------------------------------
|
||||
# Install dependencies for signing
|
||||
# Install envsubst
|
||||
# ------------------------------------------------------------
|
||||
|
||||
- name: Install envsubst dependencies
|
||||
@@ -186,34 +187,34 @@ jobs:
|
||||
sudo apt-get install -y gettext
|
||||
|
||||
# ------------------------------------------------------------
|
||||
# Cosign
|
||||
# Install Cosign
|
||||
# ------------------------------------------------------------
|
||||
|
||||
- name: Install Cosign
|
||||
if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
|
||||
uses: sigstore/cosign-installer@v4.1.2
|
||||
|
||||
# ------------------------------------------------------------
|
||||
# Sign image
|
||||
# ------------------------------------------------------------
|
||||
|
||||
- name: Sign container image (Recursive Digest)
|
||||
if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
|
||||
env:
|
||||
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
|
||||
COSIGN_PASSWORD: ""
|
||||
|
||||
run: |
|
||||
set -e
|
||||
|
||||
# 1. Cosign an der Gitea-Registry anmelden
|
||||
echo "${{ secrets.REGISTRY }}" \
|
||||
| cosign login "${{ env.REGISTRY_HOST }}" \
|
||||
-u "${{ github.repository_owner }}" \
|
||||
--password-stdin
|
||||
|
||||
# 2. Finalen Digest via Skopeo abfragen
|
||||
echo "Frage finalen Registry-Digest via Skopeo ab..."
|
||||
|
||||
OUTER_DIGEST=$(
|
||||
docker run --rm \
|
||||
quay.io/skopeo/stable inspect \
|
||||
skopeo inspect \
|
||||
--creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
|
||||
"docker://${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:stable" \
|
||||
| jq -r .Digest
|
||||
@@ -221,13 +222,11 @@ jobs:
|
||||
|
||||
echo "Registry digest: ${OUTER_DIGEST}"
|
||||
|
||||
# 3. Digest-basierte Referenz bauen
|
||||
IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${OUTER_DIGEST}"
|
||||
|
||||
echo "Signiere Image rekursiv:"
|
||||
echo "${IMAGE_REF}"
|
||||
|
||||
# 4. Rekursive Signatur
|
||||
cosign sign -y \
|
||||
--key env://COSIGN_PRIVATE_KEY \
|
||||
--recursive \
|
||||
@@ -245,6 +244,6 @@ jobs:
|
||||
run: |
|
||||
echo "Räume temporäre Dateien und Buildx-Cache auf..."
|
||||
|
||||
rm -rf "${{ github.workspace }}/oci-layout.tar"
|
||||
rm -f "${{ github.workspace }}/oci-layout.tar"
|
||||
|
||||
docker buildx prune -a -f || true
|
||||
Reference in New Issue
Block a user