From aa53dc37aacddbb9f61568b510668cdf04384366 Mon Sep 17 00:00:00 2001 From: humocs-man Date: Sun, 14 Jun 2026 20:21:22 +0000 Subject: [PATCH] .gitea/workflows/build.yml aktualisiert back to docker build --- .gitea/workflows/build.yml | 97 ++++++++++++++++++-------------------- 1 file changed, 47 insertions(+), 50 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 7de44a6..a94d8af 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -12,9 +12,6 @@ env: IMAGE_DESC: "Custom Fedora bootc image" IMAGE_NAME: "${{ github.event.repository.name }}" DEFAULT_TAG: "stable" - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" - BUILDAH_ISOLATION: chroot - STORAGE_DRIVER: vfs concurrency: group: ${{ github.workflow }}-${{ github.ref || github.run_id }} @@ -24,34 +21,24 @@ jobs: build_push: name: Build and push image runs-on: ubuntu-24.04 + permissions: contents: read packages: write id-token: write + steps: - name: Prepare environment run: | + # Extrahiert die reine Domain/Host aus der Gitea-URL REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}') OWNER_LOWER="${{ github.repository_owner }}" NAME_LOWER="${{ env.IMAGE_NAME }}" + echo "REGISTRY_HOST=${REGISTRY_HOST}" >> ${GITHUB_ENV} echo "IMAGE_REGISTRY=${REGISTRY_HOST}/${OWNER_LOWER,,}" >> ${GITHUB_ENV} echo "IMAGE_NAME=${NAME_LOWER,,}" >> ${GITHUB_ENV} - - name: Install Buildah - run: | - sudo apt-get update - sudo apt-get install -y buildah - - - name: Force vfs storage configuration - run: | - mkdir -p ~/.config/containers - echo '[storage]' > ~/.config/containers/storage.conf - echo 'driver = "vfs"' >> ~/.config/containers/storage.conf - - - name: Checkout - uses: actions/checkout@v4 - - name: Determine image tag run: | BRANCH="${GITHUB_REF_NAME}" @@ -64,24 +51,23 @@ jobs: echo "IS_TEST_BUILD=true" >> ${GITHUB_ENV} fi - - name: Generate Tags - id: generate_tags - run: | - TAGS="${{ env.IMAGE_TAG }}" - if [[ "${{ env.IS_TEST_BUILD }}" == "false" ]]; then - DATE_TAG=$(date +'%Y%m%d') - TAGS="${TAGS} ${{ env.IMAGE_TAG }}.${DATE_TAG} ${DATE_TAG}" - fi - if [[ "${{ github.event_name }}" == "pull_request" ]]; then - TAGS="pr-${{ github.event.pull_request.number }} sha-${GITHUB_SHA::7}" - fi - echo "tags=${TAGS}" >> $GITHUB_OUTPUT + - name: Checkout + uses: actions/checkout@v6 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v4 - name: Image Metadata id: metadata uses: docker/metadata-action@v6 with: images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=raw,value=${{ env.IMAGE_TAG }} + type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }} + type=raw,value={{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }} + type=sha,enable=${{ github.event_name == 'pull_request' }} + type=ref,event=pr labels: | org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}} org.opencontainers.image.description=${{ env.IMAGE_DESC }} @@ -94,28 +80,30 @@ jobs: containers.bootc=1 ostree.bootable=1 - - name: Build Image (Buildah) - id: build_image - uses: redhat-actions/buildah-build@v2 - with: - context: . - containerfiles: ./Containerfile - image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }} - tags: ${{ steps.generate_tags.outputs.tags }} - labels: ${{ steps.metadata.outputs.labels }} - oci: true - - - name: Push to Registry - id: push_image + - name: Login to Gitea Container Registry if: github.event_name != 'pull_request' - uses: redhat-actions/push-to-registry@v2 + uses: docker/login-action@v4 with: - image: ${{ steps.build_image.outputs.image }} - tags: ${{ steps.build_image.outputs.tags }} registry: ${{ env.REGISTRY_HOST }} username: ${{ github.repository_owner }} password: ${{ secrets.REGISTRY }} + - name: Build and Push Image (Docker Buildx) + uses: docker/build-push-action@v7 + id: build_image + with: + context: . + file: ./Containerfile + push: ${{ github.event_name != 'pull_request' }} + no-cache: true + tags: ${{ steps.metadata.outputs.tags }} + labels: ${{ steps.metadata.outputs.labels }} + + - name: Install envsubst dependencies + if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false' + run: | + sudo apt-get update && sudo apt-get install -y gettext + - name: Install Cosign if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false' uses: sigstore/cosign-installer@v4.1.2 @@ -126,9 +114,13 @@ jobs: COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} COSIGN_PASSWORD: "" run: | + # Cosign an der Gitea-Registry anmelden echo "${{ secrets.REGISTRY }}" | cosign login "${{ env.REGISTRY_HOST }}" -u "${{ github.repository_owner }}" --password-stdin - DIGEST="${{ steps.push_image.outputs.digest }}" + + # Den exakten Digest direkt aus dem Buildx-Output ziehen + DIGEST="${{ steps.build_image.outputs.digest }}" IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}" + echo "Signiere exklusiv via Digest: ${IMAGE_REF}" cosign sign -y \ --key env://COSIGN_PRIVATE_KEY \ @@ -141,7 +133,12 @@ jobs: - name: Post-Build Cleanup if: always() run: | - echo "Führe Smart Cleanup durch..." - buildah rm $(buildah containers -q) >/dev/null 2>&1 || true - buildah rmi $(buildah images -f "dangling=true" -q) >/dev/null 2>&1 || true - echo "Speicherplatz bereinigt." \ No newline at end of file + echo "Führe serverseitige Tiefenreinigung durch..." + + # 1. Löscht ungenutzte Zwischenschritte und temporäre Volumes + docker system prune -f --volumes + + # 2. Killt den BuildKit-Cache komplett (Verhindert das unbemerktes Zumüllen des VPS) + docker builder prune -af + + echo "VPS-Speicherplatz erfolgreich bereinigt!"