chore: repo cleanup - pin actions, fix typos, improve gitignore

- build.yml: pin push-to-registry to SHA
- build-installer-iso.yml: pin checkout/upload-artifact to SHA,
  replace hardcoded registry with env vars, add env block
- Justfile: fix 'Virtal' typo (10x), fix shfmt error msg,
  quote $file in check/fix recipes
- .gitignore: add *.iso, *.qcow2, *.raw, .env, *.log
- iso/config.toml: remove leading space
- Containerfile: remove non-existent /tmp/build from cleanup
- build/50-prepare-flatpak-for-bazaar.sh: add executable permission
- build/README.md: update to reflect current script names

.github/workflows/build-installer-iso.yml

@@ -7,6 +7,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
 
+env:
+  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
+  IMAGE_NAME: "${{ github.event.repository.name }}"
+  DEFAULT_TAG: "stable"
+
 jobs:
   build-iso:
     runs-on: ubuntu-latest
@@ -15,8 +20,13 @@ jobs:
       packages: read
 
     steps:
+      - name: Prepare environment
+        run: |
+          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
+          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
+
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Free disk space
         run: |
@@ -37,7 +47,7 @@ jobs:
 
       - name: Pull base image
         run: |
-          sudo podman pull ghcr.io/humocs-man/fluffy-pancake:stable
+          sudo podman pull ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
 
       - name: Build ISO
         run: |
@@ -50,10 +60,10 @@ jobs:
             --rootfs btrfs \
             --config /config.toml \
             --output /output/ \
-            ghcr.io/humocs-man/fluffy-pancake:stable
+            ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
 
       - name: Upload ISO artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: installer-iso
           # Wir suchen rekursiv nach jeder .iso Datei im output Ordner

.github/workflows/build.yml

@@ -130,7 +130,7 @@ jobs:
       - name: Push to GHCR
         id: push
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
         with:
           image: ${{ env.IMAGE_NAME }}
           tags: ${{ steps.metadata.outputs.tags }}

.gitignore

@@ -2,3 +2,9 @@ cosign.key
 _build_*
 output
 _build-*/**
+*.iso
+*.qcow2
+*.raw
+.env
+.env.*
+*.log

Containerfile

@@ -98,5 +98,5 @@ COPY configs/99-custom.preset /usr/lib/systemd/system-preset/99-custom.preset
 # LINTING 
 ###############################################################################
 # Wir räumen zuerst auf, validieren das System via bootc container lint
-RUN rm -rf /tmp/build /root/.cache/dnf/* && \
+RUN rm -rf /root/.cache/dnf/* && \
     bootc container lint

Justfile

@@ -16,7 +16,7 @@ check:
     #!/usr/bin/bash
     find . -type f -name "*.just" | while read -r file; do
     	echo "Checking syntax: $file"
-    	just --unstable --fmt --check -f $file
+    	just --unstable --fmt --check -f "$file"
     done
     echo "Checking syntax: Justfile"
     just --unstable --fmt --check -f Justfile
@@ -27,7 +27,7 @@ fix:
     #!/usr/bin/bash
     find . -type f -name "*.just" | while read -r file; do
     	echo "Checking syntax: $file"
-    	just --unstable --fmt -f $file
+    	just --unstable --fmt -f "$file"
     done
     echo "Checking syntax: Justfile"
     just --unstable --fmt -f Justfile || { exit 1; }
@@ -198,27 +198,27 @@ _build-bib $target_image $tag $type $config: (_rootful_load_image target_image t
 _rebuild-bib $target_image $tag $type $config: (build target_image tag) && (_build-bib target_image tag type config)
 
 # Build a QCOW2 virtual machine image
-[group('Build Virtal Machine Image')]
+[group('Build Virtual Machine Image')]
 build-qcow2 $target_image=("localhost/" + image_name) $tag=default_tag: && (_build-bib target_image tag "qcow2" "iso/disk.toml")
 
 # Build a RAW virtual machine image
-[group('Build Virtal Machine Image')]
+[group('Build Virtual Machine Image')]
 build-raw $target_image=("localhost/" + image_name) $tag=default_tag: && (_build-bib target_image tag "raw" "iso/disk.toml")
 
 # Build an ISO virtual machine image
-[group('Build Virtal Machine Image')]
+[group('Build Virtual Machine Image')]
 build-iso $target_image=("localhost/" + image_name) $tag=default_tag: && (_build-bib target_image tag "iso" "iso/iso.toml")
 
 # Rebuild a QCOW2 virtual machine image
-[group('Build Virtal Machine Image')]
+[group('Build Virtual Machine Image')]
 rebuild-qcow2 $target_image=("localhost/" + image_name) $tag=default_tag: && (_rebuild-bib target_image tag "qcow2" "iso/disk.toml")
 
 # Rebuild a RAW virtual machine image
-[group('Build Virtal Machine Image')]
+[group('Build Virtual Machine Image')]
 rebuild-raw $target_image=("localhost/" + image_name) $tag=default_tag: && (_rebuild-bib target_image tag "raw" "iso/disk.toml")
 
 # Rebuild an ISO virtual machine image
-[group('Build Virtal Machine Image')]
+[group('Build Virtual Machine Image')]
 rebuild-iso $target_image=("localhost/" + image_name) $tag=default_tag: && (_rebuild-bib target_image tag "iso" "iso/iso.toml")
 
 # Run a virtual machine with the specified image type and configuration
@@ -264,19 +264,19 @@ _run-vm $target_image $tag $type $config:
     podman run "${run_args[@]}"
 
 # Run a virtual machine from a QCOW2 image
-[group('Run Virtal Machine')]
+[group('Run Virtual Machine')]
 run-vm-qcow2 $target_image=("localhost/" + image_name) $tag=default_tag: && (_run-vm target_image tag "qcow2" "iso/disk.toml")
 
 # Run a virtual machine from a RAW image
-[group('Run Virtal Machine')]
+[group('Run Virtual Machine')]
 run-vm-raw $target_image=("localhost/" + image_name) $tag=default_tag: && (_run-vm target_image tag "raw" "iso/disk.toml")
 
 # Run a virtual machine from an ISO
-[group('Run Virtal Machine')]
+[group('Run Virtual Machine')]
 run-vm-iso $target_image=("localhost/" + image_name) $tag=default_tag: && (_run-vm target_image tag "iso" "iso/iso.toml")
 
 # Run a virtual machine using systemd-vmspawn
-[group('Run Virtal Machine')]
+[group('Run Virtual Machine')]
 spawn-vm rebuild="0" type="qcow2" ram="6G":
     #!/usr/bin/env bash
 
@@ -311,7 +311,7 @@ format:
     set -eoux pipefail
     # Check if shfmt is installed
     if ! command -v shfmt &> /dev/null; then
-        echo "shellcheck could not be found. Please install it."
+        echo "shfmt could not be found. Please install it."
         exit 1
     fi
     # Run shfmt on all Bash scripts

build/README.md

@@ -1,77 +1,63 @@
 # Build Scripts
 
-This directory contains build scripts that run during image creation. Scripts are executed in numerical order.
+This directory contains build scripts that run during image creation via bind mounts in the Containerfile.
 
 ## How It Works
 
-Scripts are named with a number prefix (e.g., `10-build.sh`, `20-onepassword.sh`) and run in ascending order during the container build process.
+Scripts are named with a number prefix and run in ascending order during the container build process. Each script is bind-mounted into the build container and executed individually.
 
 ## Included Scripts
 
-- **`10-build.sh`** - Main build script for base system modifications, package installation, and service configuration
+- **`10-repos.sh`** - RPM Fusion repositories einrichten (frei + nonfree)
+- **`20-multimedia.sh`** - Mesa Freeworld, Codecs, FFmpeg, GStreamer, Intel-Media-Treiber
+- **`30-virt.sh`** - Virtualisierung (libvirt, QEMU), Plasma-Setup, Distrobox, Micro, etc.
+- **`40-remove-packages.sh`** - Entfernt unerwuenschte Pakete (Firefox, Plasma Discover)
+- **`50-prepare-flatpak-for-bazaar.sh`** - Laedt Flathub-Repo-Definition fuer Bazaar
 
-## Example Scripts
+## Hilfsscript
 
-- **`20-onepassword.sh.example`** - Example showing how to install software from third-party RPM repositories (Google Chrome, 1Password)
+- **`copr-helpers.sh`** - Funktionen fuer sichere COPR-Repo-Installation (enable, install, disable)
 
-To use an example script:
-1. Remove the `.example` extension
-2. Make it executable: `chmod +x build/20-yourscript.sh`
-3. The build system will automatically run it in numerical order
-
-## Creating Your Own Scripts
-
-Create numbered scripts for different purposes:
+## Erstellung eigener Scripts
 
 ```bash
-# 10-build.sh - Base system (already exists)
-# 20-drivers.sh - Hardware drivers  
-# 30-development.sh - Development tools
-# 40-gaming.sh - Gaming software
-# 50-cleanup.sh - Final cleanup tasks
-```
+# Neues Script mit nummeriertem Prefix erstellen
+# Die Number bestimmt die Ausfuehrungsreihenfolge
 
-### Script Template
+#!/usr/bin/bash
+set -eoux pipefail
 
-```bash
-#!/usr/bin/env bash
-set -oue pipefail
-
-echo "Running custom setup..."
-# Your commands here
+echo "Installiere Pakete..."
+dnf5 install -y --allowerasing some-package
 ```
 
 ### Best Practices
 
-- **Use descriptive names**: `20-nvidia-drivers.sh` is better than `20-stuff.sh`
-- **One purpose per script**: Easier to debug and maintain
-- **Clean up after yourself**: Remove temporary files and disable temporary repos
-- **Test incrementally**: Add one script at a time and test builds
-- **Comment your code**: Future you will thank present you
+- **Beschreibende Namen**: `25-nvidia.sh` statt `25-stuff.sh`
+- **Ein Script pro Zweck**: Einfacher zu debuggen und zu warten
+- **Aufraeumen**: Temporaere Dateien entfernen, temporaere Repos deaktivieren
+- **Inkrementell testen**: Ein Script nach dem anderen hinzufuegen
+- **Kommentare**: Das zukuenftige Ich wird es schaetzen
 
-### Disabling Scripts
+### Script deaktivieren
 
-To temporarily disable a script without deleting it:
-- Rename it with `.disabled` extension: `20-script.sh.disabled`
-- Or remove execute permission: `chmod -x build/20-script.sh`
+Ohne Loeschen deaktivieren:
+- Umbenennen: `20-script.sh` → `20-script.sh.disabled`
+- Execute-Recht entfernen: `chmod -x build/20-script.sh`
 
-## Execution Order
-
-The Containerfile runs scripts like this:
+## Ausfuehrung im Containerfile
 
 ```dockerfile
-RUN /ctx/build/10-build.sh
+RUN --mount=type=bind,from=ctx,source=/build/10-repos.sh,target=/tmp/10-repos.sh \
+    --mount=type=cache,dst=/var/cache \
+    --mount=type=tmpfs,dst=/tmp \
+    bash /tmp/10-repos.sh && dnf5 clean all
 ```
 
-If you want to run multiple scripts, you can:
+## Hinweise
 
-1. **Modify Containerfile** to run each script explicitly
-2. **Create a runner script** that executes all numbered scripts
-3. **Use the default** and keep everything in `10-build.sh` (simplest)
-
-## Notes
-
-- Scripts run as root during build
-- Build context is available at `/ctx`
-- Use dnf5 for package management (not dnf or yum)
-- Always use `-y` flag for non-interactive installs
+- Scripts laufen als root waehrend des Builds
+- Build-Kontext ist ueber Bind-Mounts verfuegbar
+- Nutze `dnf5` fuer Paketverwaltung (nicht dnf oder yum)
+- Immer `-y` Flag fuer nicht-interaktive Installationen verwenden
+- Cache-Mounts (`--mount=type=cache`) verhindern Neudownload bei Aenderungen