From b17af542be7a6e258fb5ac9a6f0eedb1ae366823 Mon Sep 17 00:00:00 2001 From: gunnar Date: Fri, 5 Jun 2026 18:18:19 +0200 Subject: [PATCH] podman build --- {.github => .gitea}/dependabot.yml | 0 {.github => .gitea}/renovate.json5 | 0 .github/workflows/build-installer-iso.yml | 81 ---------- .github/workflows/build.yml | 172 ---------------------- .github/workflows/clean.yml | 27 ---- .github/workflows/renovate.yml | 31 ---- .github/workflows/validate-renovate.yml | 35 ----- 7 files changed, 346 deletions(-) rename {.github => .gitea}/dependabot.yml (100%) rename {.github => .gitea}/renovate.json5 (100%) delete mode 100644 .github/workflows/build-installer-iso.yml delete mode 100644 .github/workflows/build.yml delete mode 100644 .github/workflows/clean.yml delete mode 100644 .github/workflows/renovate.yml delete mode 100644 .github/workflows/validate-renovate.yml diff --git a/.github/dependabot.yml b/.gitea/dependabot.yml similarity index 100% rename from .github/dependabot.yml rename to .gitea/dependabot.yml diff --git a/.github/renovate.json5 b/.gitea/renovate.json5 similarity index 100% rename from .github/renovate.json5 rename to .gitea/renovate.json5 diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml deleted file mode 100644 index ff1e5ed..0000000 --- a/.github/workflows/build-installer-iso.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Build Installer ISO - -on: - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref || github.run_id }} - cancel-in-progress: true - -env: - IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" - IMAGE_NAME: "${{ github.event.repository.name }}" - -jobs: - build-iso: - runs-on: ubuntu-latest - permissions: - contents: read - packages: read - - steps: - - name: Prepare environment - run: | - echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} - echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} - - - name: Determine image tag - run: | - BRANCH="${GITHUB_REF_NAME}" - if [[ "$BRANCH" == "main" ]]; then - echo "IMAGE_TAG=stable" >> ${GITHUB_ENV} - else - SANITIZED=$(echo "$BRANCH" | sed 's/[^a-zA-Z0-9._-]/-/g' | head -c 50) - echo "IMAGE_TAG=test-${SANITIZED}" >> ${GITHUB_ENV} - fi - echo "Building from tag: ${IMAGE_TAG}" - - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - - name: Free disk space - run: | - sudo rm -rf /usr/share/dotnet - sudo rm -rf /usr/local/lib/android - sudo rm -rf /opt/ghc - sudo rm -rf /opt/hostedtoolcache - sudo docker image prune -af - df -h - - - name: Prepare output directory - run: mkdir -p output - - - name: Login to GHCR - run: | - echo "${{ secrets.GITHUB_TOKEN }}" | sudo podman login ghcr.io \ - -u ${{ github.actor }} --password-stdin - - - name: Pull base image - run: | - sudo podman pull ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} - - - name: Build ISO - run: | - sudo podman run --rm --privileged \ - -v ${{ github.workspace }}/iso/config.toml:/config.toml:ro \ - -v ${{ github.workspace }}/output:/output \ - -v /var/lib/containers/storage:/var/lib/containers/storage \ - ghcr.io/osbuild/bootc-image-builder:latest \ - --type anaconda-iso \ - --rootfs btrfs \ - --config /config.toml \ - --output /output/ \ - ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} - - - name: Upload ISO artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 - with: - name: installer-iso - # Wir suchen rekursiv nach jeder .iso Datei im output Ordner - path: output/**/*.iso - if-no-files-found: error diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml deleted file mode 100644 index 85161ec..0000000 --- a/.github/workflows/build.yml +++ /dev/null @@ -1,172 +0,0 @@ -name: Build container image -on: - pull_request: - branches: - - main - schedule: - - cron: '05 12 * * 2,5' - workflow_dispatch: - -env: - IMAGE_DESC: "Custom Fedora bootc image" - IMAGE_NAME: "${{ github.event.repository.name }}" - IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" - DEFAULT_TAG: "stable" - -concurrency: - group: ${{ github.workflow }}-${{ github.ref || github.run_id }} - cancel-in-progress: true - -jobs: - build_push: - name: Build and push image - runs-on: ubuntu-24.04 - - permissions: - contents: read - packages: write - id-token: write - - steps: - - name: Prepare environment - run: | - echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} - echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} - - - name: Determine image tag - run: | - BRANCH="${GITHUB_REF_NAME}" - if [[ "$BRANCH" == "main" ]]; then - echo "IMAGE_TAG=${DEFAULT_TAG}" >> ${GITHUB_ENV} - echo "IS_TEST_BUILD=false" >> ${GITHUB_ENV} - else - SANITIZED=$(echo "$BRANCH" | sed 's/[^a-zA-Z0-9._-]/-/g' | head -c 50) - echo "IMAGE_TAG=test-${SANITIZED}" >> ${GITHUB_ENV} - echo "IS_TEST_BUILD=true" >> ${GITHUB_ENV} - fi - - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 - - - name: Mount BTRFS for podman storage - id: container-storage-action - uses: ublue-os/container-storage-action@911baca08baf30c8654933e9e9723cb399892140 # main - with: - target-dir: /var/lib/containers - mount-opts: compress-force=zstd:2 - - - name: Image Metadata - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v5 - id: metadata - with: - tags: | - type=raw,value=${{ env.IMAGE_TAG }} - type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }} - type=raw,value={{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }} - type=sha,enable=${{ github.event_name == 'pull_request' }} - type=ref,event=pr - labels: | - org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}} - org.opencontainers.image.description=${{ env.IMAGE_DESC }} - org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md - org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/${{ github.sha }}/Containerfile - org.opencontainers.image.title=${{ env.IMAGE_NAME }} - org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/tree/${{ github.sha }} - org.opencontainers.image.vendor=${{ github.repository_owner }} - org.opencontainers.image.version=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}} - containers.bootc=1 - ostree.bootable=1 - sep-tags: " " - sep-annotations: " " - - # OPTIMIERUNG 1: Der Cache lauscht jetzt auf Containerfile UND alle Skripte/Configs - - name: Cache buildah layers - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 - with: - path: | - ~/.cache/buildah - /tmp/.buildah-cache - key: ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile', 'build/**', 'configs/**', 'scripts/**') }}-${{ github.ref }} - restore-keys: | - ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile', 'build/**', 'configs/**', 'scripts/**') }}- - ${{ runner.os }}-${{ github.workflow }}- - - - name: Build Image - id: build_image - uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2 - with: - containerfiles: | - ./Containerfile - image: ${{ env.IMAGE_NAME }} - tags: ${{ env.IMAGE_TAG }} - labels: ${{ steps.metadata.outputs.labels }} - oci: true - - - name: Rechunk with chunkah - run: | - set -euo pipefail - - IMG="localhost/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" - CHUNKED_IMG="localhost/${{ env.IMAGE_NAME }}-chunked:${{ env.IMAGE_TAG }}" - - # Image-Config fuer chunkah sichern (Labels, Annotations, etc.) - CONFIG=$(buildah inspect "$IMG" | jq -c .) - - # Platz schaffen fuer den Rechunk (OCI-Archive + Original passen nicht beide) - sudo rm -rf /tmp/.buildah-cache/* 2>/dev/null || true - - # chunkah: content-based Layer-Splitting - # --max-layers 128: Desktop-Images brauchen mehr als Default (64) - # --prune /sysroot/: entfernt OSTree-Metadaten (optional seit bootc 1.1.3) - # --label ostree.*: entfernt gueltigkeitsfaehige ostree-Labels - CHUNKAH_CF=$(mktemp) - curl -sL https://github.com/coreos/chunkah/releases/download/v0.5.0/Containerfile.splitter -o "$CHUNKAH_CF" - - buildah build --skip-unused-stages=false \ - -f "$CHUNKAH_CF" \ - --from "$IMG" \ - --build-arg CHUNKAH_CONFIG_STR="$CONFIG" \ - --build-arg "CHUNKAH_ARGS=--prune /sysroot/ --max-layers 128 --compressed --label ostree.commit- --label ostree.final-diffid- --label ostree.bootable=true --label containers.bootc=1" \ - -t "$CHUNKED_IMG" \ - . - - rm -f "$CHUNKAH_CF" out.ociarchive - - # Platz freigeben: Original und Zwischenprodukt entfernen - buildah rmi "$IMG" - for full_tag in ${{ steps.metadata.outputs.tags }}; do - tag_only="${full_tag##*:}" - buildah tag "$CHUNKED_IMG" "localhost/${{ env.IMAGE_NAME }}:${tag_only}" - done - buildah rmi "$CHUNKED_IMG" - - - name: Login to GitHub Container Registry - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v3 - if: github.event_name != 'pull_request' - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Push to GHCR - id: push - if: github.event_name != 'pull_request' - uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 - with: - image: ${{ env.IMAGE_NAME }} - tags: ${{ steps.metadata.outputs.tags }} - registry: ${{ env.IMAGE_REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Install Cosign - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - if: github.event_name != 'pull_request' - - - name: Sign container image - if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false' - run: | - cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}" - env: - COSIGN_EXPERIMENTAL: false - COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} diff --git a/.github/workflows/clean.yml b/.github/workflows/clean.yml deleted file mode 100644 index e1eb5d5..0000000 --- a/.github/workflows/clean.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: Cleanup Old Images -on: - schedule: - - cron: "0 0 * * 0" # Weekly on Sunday at midnight UTC - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref || github.run_id }} - -jobs: - delete-older-than-90: - runs-on: ubuntu-latest - permissions: - packages: write - steps: - - name: Delete Images Older Than 90 Days - uses: dataaxiom/ghcr-cleanup-action@f092b48ba3b604b2a83690dc4b2bbb3392e1045f # v1.2.1 - with: - token: ${{ secrets.GITHUB_TOKEN }} - # IMPORTANT: Update this to match your image name from Containerfile (line 9) - # This should match the "# Name: your-repo-name" comment in your Containerfile - # Example: If your Containerfile has "# Name: my-custom-os", use "my-custom-os" here - packages: fluffy-pancake - older-than: 45 days - delete-orphaned-images: true - keep-n-tagged: 5 - keep-n-untagged: 5 diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml deleted file mode 100644 index 7af7a8a..0000000 --- a/.github/workflows/renovate.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: Renovate -on: - schedule: - # Run every 6 hours - - cron: '0 */6 * * *' - workflow_dispatch: - push: - branches: - - main - paths: - - '.github/renovate.json5' - - '.github/workflows/renovate.yml' - -jobs: - renovate: - name: Run Renovate - runs-on: ubuntu-latest - permissions: - contents: write - pull-requests: write - steps: - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 - - - name: Self-hosted Renovate - uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14 - with: - configurationFile: .github/renovate.json5 - token: ${{ secrets.GITHUB_TOKEN }} - env: - LOG_LEVEL: 'debug' diff --git a/.github/workflows/validate-renovate.yml b/.github/workflows/validate-renovate.yml deleted file mode 100644 index cf6e3e4..0000000 --- a/.github/workflows/validate-renovate.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: Validate Renovate Config - -on: - pull_request: - paths: - - ".github/renovate.json5" - - ".github/workflows/renovate.yml" - push: - branches: - - main - paths: - - ".github/renovate.json5" - - ".github/workflows/renovate.yml" - -jobs: - validate: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 - - - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 - with: - node-version: latest - - - name: Install dependencies - shell: bash - env: - RENOVATE_VERSION: latest - run: npm install -g renovate@${RENOVATE_VERSION} - - - name: Validate Renovate config - shell: bash - run: renovate-config-validator --strict