Refactor GitHub Actions workflow for image build and push

.github/workflows/build.yml

@@ -80,57 +80,26 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile') }}-
 
-      - name: Build Monolithic Image
+      - name: Build Image
         id: build_image
         uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
         with:
           containerfiles: |
             ./Containerfile
           image: ${{ env.IMAGE_NAME }}
-          tags: monolith
+          tags: ${{ env.DEFAULT_TAG }}
           labels: ${{ steps.metadata.outputs.labels }}
           oci: true
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v3
+        if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Wir pushen den Monolithen temporär unkomprimiert hoch, damit rpm-ostree darauf zugreifen kann
+      - name: Push to GHCR via Skopeo (with ZSTD Compression)
-      - name: Push temporary monolith to GHCR
-        run: |
-          set -x
-          podman push localhost/${{ env.IMAGE_NAME }}:monolith ghcr.io/${{ github.repository }}:monolith
-
-      # JETZT GARANTIERT FEHLERFREI: rpm-ostree liest standardisiert direkt aus der Registry
-      # FIX: Wir mounten an einen sicheren Pfad und setzen REGISTRY_AUTH_FILE
-      - name: Apply native bootc rechunking
-        id: rechunk
-        run: |
-          set -x
-          mkdir -p ./chunkah-out
-          
-          # Wir mounten die config.json direkt nach /auth.json (das klappt immer)
-          # und übergeben die Variable via -e REGISTRY_AUTH_FILE
-          sudo podman run --rm --privileged \
-            -v /home/runner/.docker/config.json:/auth.json:ro \
-            -e REGISTRY_AUTH_FILE=/auth.json \
-            -v .:/workspace:z \
-            -w /workspace \
-            quay.io/fedora/fedora-bootc:44 \
-            rpm-ostree compose build-chunked-oci \
-              --bootc \
-              --format-version=2 \
-              --max-layers 128 \
-              --from=docker:ghcr.io/${{ github.repository }}:monolith \
-              --output=oci-archive:/workspace/chunkah-out/image.ociarchive
-
-          # Besitzrechte wieder an den normalen GHA-User übergeben
-          sudo chown -R runner:docker ./chunkah-out
-
-      - name: Push final 128-Layer Image via Skopeo (with ZSTD Compression)
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         run: |
           set -x
@@ -138,22 +107,21 @@ jobs:
           export REGISTRY_AUTH_FILE=$HOME/.docker/config.json
           REGISTRY_PATH="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
 
-          # Pushe das optimierte 128-Layer Archiv als echtes ':stable'
+          # Nutzt das bewährte podman unshare, um den lokalen Storage fehlerfrei auszulesen
-          for tag in ${{ steps.metadata.outputs.tags }}; do
+          podman unshare bash -c "
-            skopeo copy \
+            for tag in ${{ steps.metadata.outputs.tags }}; do
-              --dest-compress-format=zstd \
+              skopeo copy \
-              --dest-compress-level=5 \
+                --dest-compress-format=zstd \
-              oci-archive:./chunkah-out/image.ociarchive \
+                --dest-compress-level=5 \
-              docker://$REGISTRY_PATH:$tag
+                containers-storage:localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} \
-          done
+                docker://$REGISTRY_PATH:\$tag
+            done
+          "
 
           # Den echten, finalen Registry-Digest abfragen
           FINAL_REGISTRY_DIGEST=$(skopeo inspect docker://$REGISTRY_PATH:${{ env.DEFAULT_TAG }} --format '{{.Digest}}')
           echo "REGISTRY_DIGEST=$FINAL_REGISTRY_DIGEST" >> $GITHUB_ENV
 
-          # Den temporären Monolithen von der Registry löschen, um Müll zu vermeiden
-          skopeo delete docker://ghcr.io/${{ github.repository }}:monolith || true
-
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)