.gitea/workflows/build.yml aktualisiert

back to docker build

.gitea/workflows/build.yml

@@ -12,9 +12,6 @@ env:
   IMAGE_DESC: "Custom Fedora bootc image"
   IMAGE_NAME: "${{ github.event.repository.name }}"
   DEFAULT_TAG: "stable"
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  BUILDAH_ISOLATION: chroot
-  STORAGE_DRIVER: vfs
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
@@ -24,34 +21,24 @@ jobs:
   build_push:
     name: Build and push image
     runs-on: ubuntu-24.04
+
     permissions:
       contents: read
       packages: write
       id-token: write
+
     steps:
       - name: Prepare environment
         run: |
+          # Extrahiert die reine Domain/Host aus der Gitea-URL
           REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}')
           OWNER_LOWER="${{ github.repository_owner }}"
           NAME_LOWER="${{ env.IMAGE_NAME }}"
+
           echo "REGISTRY_HOST=${REGISTRY_HOST}" >> ${GITHUB_ENV}
           echo "IMAGE_REGISTRY=${REGISTRY_HOST}/${OWNER_LOWER,,}" >> ${GITHUB_ENV}
           echo "IMAGE_NAME=${NAME_LOWER,,}" >> ${GITHUB_ENV}
 
-      - name: Install Buildah
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y buildah
-
-      - name: Force vfs storage configuration
-        run: |
-          mkdir -p ~/.config/containers
-          echo '[storage]' > ~/.config/containers/storage.conf
-          echo 'driver = "vfs"' >> ~/.config/containers/storage.conf
-
-      - name: Checkout
-        uses: actions/checkout@v4
-
       - name: Determine image tag
         run: |
           BRANCH="${GITHUB_REF_NAME}"
@@ -64,24 +51,23 @@ jobs:
             echo "IS_TEST_BUILD=true" >> ${GITHUB_ENV}
           fi
 
-      - name: Generate Tags
+      - name: Checkout
-        id: generate_tags
+        uses: actions/checkout@v6
-        run: |
+
-          TAGS="${{ env.IMAGE_TAG }}"
+      - name: Set up Docker Buildx
-          if [[ "${{ env.IS_TEST_BUILD }}" == "false" ]]; then
+        uses: docker/setup-buildx-action@v4
-            DATE_TAG=$(date +'%Y%m%d')
-            TAGS="${TAGS} ${{ env.IMAGE_TAG }}.${DATE_TAG} ${DATE_TAG}"
-          fi
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            TAGS="pr-${{ github.event.pull_request.number }} sha-${GITHUB_SHA::7}"
-          fi
-          echo "tags=${TAGS}" >> $GITHUB_OUTPUT
 
       - name: Image Metadata
         id: metadata
         uses: docker/metadata-action@v6
         with:
           images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ env.IMAGE_TAG }}
+            type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
+            type=raw,value={{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
+            type=sha,enable=${{ github.event_name == 'pull_request' }}
+            type=ref,event=pr
           labels: |
             org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}}
             org.opencontainers.image.description=${{ env.IMAGE_DESC }}
@@ -94,28 +80,30 @@ jobs:
             containers.bootc=1
             ostree.bootable=1
 
-      - name: Build Image (Buildah)
+      - name: Login to Gitea Container Registry
-        id: build_image
-        uses: redhat-actions/buildah-build@v2
-        with:
-          context: .
-          containerfiles: ./Containerfile
-          image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: ${{ steps.generate_tags.outputs.tags }}
-          labels: ${{ steps.metadata.outputs.labels }}
-          oci: true
-
-      - name: Push to Registry
-        id: push_image
         if: github.event_name != 'pull_request'
-        uses: redhat-actions/push-to-registry@v2
+        uses: docker/login-action@v4
         with:
-          image: ${{ steps.build_image.outputs.image }}
-          tags: ${{ steps.build_image.outputs.tags }}
           registry: ${{ env.REGISTRY_HOST }}
           username: ${{ github.repository_owner }}
           password: ${{ secrets.REGISTRY }}
 
+      - name: Build and Push Image (Docker Buildx)
+        uses: docker/build-push-action@v7
+        id: build_image
+        with:
+          context: .
+          file: ./Containerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          no-cache: true
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}
+
+      - name: Install envsubst dependencies
+        if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
+        run: |
+          sudo apt-get update && sudo apt-get install -y gettext
+
       - name: Install Cosign
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         uses: sigstore/cosign-installer@v4.1.2
@@ -126,9 +114,13 @@ jobs:
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
           COSIGN_PASSWORD: ""
         run: |
+          # Cosign an der Gitea-Registry anmelden
           echo "${{ secrets.REGISTRY }}" | cosign login "${{ env.REGISTRY_HOST }}" -u "${{ github.repository_owner }}" --password-stdin
-          DIGEST="${{ steps.push_image.outputs.digest }}"
+
+          # Den exakten Digest direkt aus dem Buildx-Output ziehen
+          DIGEST="${{ steps.build_image.outputs.digest }}"
           IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"
+
           echo "Signiere exklusiv via Digest: ${IMAGE_REF}"
           cosign sign -y \
             --key env://COSIGN_PRIVATE_KEY \
@@ -141,7 +133,12 @@ jobs:
       - name: Post-Build Cleanup
         if: always()
         run: |
-          echo "Führe Smart Cleanup durch..."
+          echo "Führe serverseitige Tiefenreinigung durch..."
-          buildah rm $(buildah containers -q) >/dev/null 2>&1 || true
+
-          buildah rmi $(buildah images -f "dangling=true" -q) >/dev/null 2>&1 || true
+          # 1. Löscht ungenutzte Zwischenschritte und temporäre Volumes
-          echo "Speicherplatz bereinigt."
+          docker system prune -f --volumes
+
+          # 2. Killt den BuildKit-Cache komplett (Verhindert das unbemerktes Zumüllen des VPS)
+          docker builder prune -af
+
+          echo "VPS-Speicherplatz erfolgreich bereinigt!"