diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 10e725c..0917b10 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -80,57 +80,26 @@ jobs: restore-keys: | ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile') }}- - - name: Build Monolithic Image + - name: Build Image id: build_image uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2 with: containerfiles: | ./Containerfile image: ${{ env.IMAGE_NAME }} - tags: monolith + tags: ${{ env.DEFAULT_TAG }} labels: ${{ steps.metadata.outputs.labels }} oci: true - name: Login to GitHub Container Registry uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v3 + if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - # Wir pushen den Monolithen temporär unkomprimiert hoch, damit rpm-ostree darauf zugreifen kann - - name: Push temporary monolith to GHCR - run: | - set -x - podman push localhost/${{ env.IMAGE_NAME }}:monolith ghcr.io/${{ github.repository }}:monolith - - # JETZT GARANTIERT FEHLERFREI: rpm-ostree liest standardisiert direkt aus der Registry - # FIX: Wir mounten an einen sicheren Pfad und setzen REGISTRY_AUTH_FILE - - name: Apply native bootc rechunking - id: rechunk - run: | - set -x - mkdir -p ./chunkah-out - - # Wir mounten die config.json direkt nach /auth.json (das klappt immer) - # und übergeben die Variable via -e REGISTRY_AUTH_FILE - sudo podman run --rm --privileged \ - -v /home/runner/.docker/config.json:/auth.json:ro \ - -e REGISTRY_AUTH_FILE=/auth.json \ - -v .:/workspace:z \ - -w /workspace \ - quay.io/fedora/fedora-bootc:44 \ - rpm-ostree compose build-chunked-oci \ - --bootc \ - --format-version=2 \ - --max-layers 128 \ - --from=docker:ghcr.io/${{ github.repository }}:monolith \ - --output=oci-archive:/workspace/chunkah-out/image.ociarchive - - # Besitzrechte wieder an den normalen GHA-User übergeben - sudo chown -R runner:docker ./chunkah-out - - - name: Push final 128-Layer Image via Skopeo (with ZSTD Compression) + - name: Push to GHCR via Skopeo (with ZSTD Compression) if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) run: | set -x @@ -138,22 +107,21 @@ jobs: export REGISTRY_AUTH_FILE=$HOME/.docker/config.json REGISTRY_PATH="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}" - # Pushe das optimierte 128-Layer Archiv als echtes ':stable' - for tag in ${{ steps.metadata.outputs.tags }}; do - skopeo copy \ - --dest-compress-format=zstd \ - --dest-compress-level=5 \ - oci-archive:./chunkah-out/image.ociarchive \ - docker://$REGISTRY_PATH:$tag - done + # Nutzt das bewährte podman unshare, um den lokalen Storage fehlerfrei auszulesen + podman unshare bash -c " + for tag in ${{ steps.metadata.outputs.tags }}; do + skopeo copy \ + --dest-compress-format=zstd \ + --dest-compress-level=5 \ + containers-storage:localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} \ + docker://$REGISTRY_PATH:\$tag + done + " # Den echten, finalen Registry-Digest abfragen FINAL_REGISTRY_DIGEST=$(skopeo inspect docker://$REGISTRY_PATH:${{ env.DEFAULT_TAG }} --format '{{.Digest}}') echo "REGISTRY_DIGEST=$FINAL_REGISTRY_DIGEST" >> $GITHUB_ENV - # Den temporären Monolithen von der Registry löschen, um Müll zu vermeiden - skopeo delete docker://ghcr.io/${{ github.repository }}:monolith || true - - name: Install Cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)