chore: repo cleanup - pin actions, fix typos, improve gitignore

- build.yml: pin push-to-registry to SHA
- build-installer-iso.yml: pin checkout/upload-artifact to SHA,
  replace hardcoded registry with env vars, add env block
- Justfile: fix 'Virtal' typo (10x), fix shfmt error msg,
  quote $file in check/fix recipes
- .gitignore: add *.iso, *.qcow2, *.raw, .env, *.log
- iso/config.toml: remove leading space
- Containerfile: remove non-existent /tmp/build from cleanup
- build/50-prepare-flatpak-for-bazaar.sh: add executable permission
- build/README.md: update to reflect current script names

.github/workflows/build-installer-iso.yml

@@ -7,6 +7,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
 
+env:
+  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
+  IMAGE_NAME: "${{ github.event.repository.name }}"
+  DEFAULT_TAG: "stable"
+
 jobs:
   build-iso:
     runs-on: ubuntu-latest
@@ -15,8 +20,13 @@ jobs:
       packages: read
 
     steps:
+      - name: Prepare environment
+        run: |
+          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
+          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
+
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Free disk space
         run: |
@@ -37,7 +47,7 @@ jobs:
 
       - name: Pull base image
         run: |
-          sudo podman pull ghcr.io/humocs-man/fluffy-pancake:stable
+          sudo podman pull ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
 
       - name: Build ISO
         run: |
@@ -50,10 +60,10 @@ jobs:
             --rootfs btrfs \
             --config /config.toml \
             --output /output/ \
-            ghcr.io/humocs-man/fluffy-pancake:stable
+            ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
 
       - name: Upload ISO artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: installer-iso
           # Wir suchen rekursiv nach jeder .iso Datei im output Ordner

.github/workflows/build.yml

@@ -130,7 +130,7 @@ jobs:
       - name: Push to GHCR
         id: push
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
         with:
           image: ${{ env.IMAGE_NAME }}
           tags: ${{ steps.metadata.outputs.tags }}