podman build

.github/workflows/build-installer-iso.yml

@@ -1,81 +0,0 @@
-name: Build Installer ISO
-
-on:
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
-  cancel-in-progress: true
-
-env:
-  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
-  IMAGE_NAME: "${{ github.event.repository.name }}"
-
-jobs:
-  build-iso:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: read
-
-    steps:
-      - name: Prepare environment
-        run: |
-          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
-          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
-
-      - name: Determine image tag
-        run: |
-          BRANCH="${GITHUB_REF_NAME}"
-          if [[ "$BRANCH" == "main" ]]; then
-            echo "IMAGE_TAG=stable" >> ${GITHUB_ENV}
-          else
-            SANITIZED=$(echo "$BRANCH" | sed 's/[^a-zA-Z0-9._-]/-/g' | head -c 50)
-            echo "IMAGE_TAG=test-${SANITIZED}" >> ${GITHUB_ENV}
-          fi
-          echo "Building from tag: ${IMAGE_TAG}"
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Free disk space
-        run: |
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /opt/hostedtoolcache
-          sudo docker image prune -af
-          df -h
-
-      - name: Prepare output directory
-        run: mkdir -p output
-
-      - name: Login to GHCR
-        run: |
-          echo "${{ secrets.GITHUB_TOKEN }}" | sudo podman login ghcr.io \
-            -u ${{ github.actor }} --password-stdin
-
-      - name: Pull base image
-        run: |
-          sudo podman pull ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
-
-      - name: Build ISO
-        run: |
-          sudo podman run --rm --privileged \
-            -v ${{ github.workspace }}/iso/config.toml:/config.toml:ro \
-            -v ${{ github.workspace }}/output:/output \
-            -v /var/lib/containers/storage:/var/lib/containers/storage \
-            ghcr.io/osbuild/bootc-image-builder:latest \
-            --type anaconda-iso \
-            --rootfs btrfs \
-            --config /config.toml \
-            --output /output/ \
-            ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
-
-      - name: Upload ISO artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: installer-iso
-          # Wir suchen rekursiv nach jeder .iso Datei im output Ordner
-          path: output/**/*.iso
-          if-no-files-found: error

.github/workflows/build.yml

@@ -1,172 +0,0 @@
-name: Build container image
-on:
-  pull_request:
-    branches:
-      - main
-  schedule:
-    - cron: '05 12 * * 2,5'   
-  workflow_dispatch:
-
-env:
-  IMAGE_DESC: "Custom Fedora bootc image"
-  IMAGE_NAME: "${{ github.event.repository.name }}"
-  IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
-  DEFAULT_TAG: "stable"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  build_push:
-    name: Build and push image
-    runs-on: ubuntu-24.04
-
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-
-    steps:
-      - name: Prepare environment
-        run: |
-          echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
-          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
-
-      - name: Determine image tag
-        run: |
-          BRANCH="${GITHUB_REF_NAME}"
-          if [[ "$BRANCH" == "main" ]]; then
-            echo "IMAGE_TAG=${DEFAULT_TAG}" >> ${GITHUB_ENV}
-            echo "IS_TEST_BUILD=false" >> ${GITHUB_ENV}
-          else
-            SANITIZED=$(echo "$BRANCH" | sed 's/[^a-zA-Z0-9._-]/-/g' | head -c 50)
-            echo "IMAGE_TAG=test-${SANITIZED}" >> ${GITHUB_ENV}
-            echo "IS_TEST_BUILD=true" >> ${GITHUB_ENV}
-          fi
-
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-
-      - name: Mount BTRFS for podman storage
-        id: container-storage-action
-        uses: ublue-os/container-storage-action@911baca08baf30c8654933e9e9723cb399892140 # main
-        with:
-          target-dir: /var/lib/containers
-          mount-opts: compress-force=zstd:2
-
-      - name: Image Metadata
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v5
-        id: metadata
-        with:
-          tags: |
-            type=raw,value=${{ env.IMAGE_TAG }}
-            type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
-            type=raw,value={{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
-            type=sha,enable=${{ github.event_name == 'pull_request' }}
-            type=ref,event=pr
-          labels: |
-            org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}}
-            org.opencontainers.image.description=${{ env.IMAGE_DESC }}
-            org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md
-            org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/${{ github.sha }}/Containerfile
-            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
-            org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/tree/${{ github.sha }}
-            org.opencontainers.image.vendor=${{ github.repository_owner }}
-            org.opencontainers.image.version=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}}
-            containers.bootc=1
-            ostree.bootable=1
-          sep-tags: " "
-          sep-annotations: " "
-
-      # OPTIMIERUNG 1: Der Cache lauscht jetzt auf Containerfile UND alle Skripte/Configs
-      - name: Cache buildah layers
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.cache/buildah
-            /tmp/.buildah-cache
-          key: ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile', 'build/**', 'configs/**', 'scripts/**') }}-${{ github.ref }}
-          restore-keys: |
-            ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile', 'build/**', 'configs/**', 'scripts/**') }}-
-            ${{ runner.os }}-${{ github.workflow }}-
-
-      - name: Build Image
-        id: build_image
-        uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
-        with:
-          containerfiles: |
-            ./Containerfile
-          image: ${{ env.IMAGE_NAME }}
-          tags: ${{ env.IMAGE_TAG }}
-          labels: ${{ steps.metadata.outputs.labels }}
-          oci: true
-
-      - name: Rechunk with chunkah
-        run: |
-          set -euo pipefail
-
-          IMG="localhost/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
-          CHUNKED_IMG="localhost/${{ env.IMAGE_NAME }}-chunked:${{ env.IMAGE_TAG }}"
-
-          # Image-Config fuer chunkah sichern (Labels, Annotations, etc.)
-          CONFIG=$(buildah inspect "$IMG" | jq -c .)
-
-          # Platz schaffen fuer den Rechunk (OCI-Archive + Original passen nicht beide)
-          sudo rm -rf /tmp/.buildah-cache/* 2>/dev/null || true
-
-          # chunkah: content-based Layer-Splitting
-          # --max-layers 128: Desktop-Images brauchen mehr als Default (64)
-          # --prune /sysroot/: entfernt OSTree-Metadaten (optional seit bootc 1.1.3)
-          # --label ostree.*: entfernt gueltigkeitsfaehige ostree-Labels
-          CHUNKAH_CF=$(mktemp)
-          curl -sL https://github.com/coreos/chunkah/releases/download/v0.5.0/Containerfile.splitter -o "$CHUNKAH_CF"
-
-          buildah build --skip-unused-stages=false \
-            -f "$CHUNKAH_CF" \
-            --from "$IMG" \
-            --build-arg CHUNKAH_CONFIG_STR="$CONFIG" \
-            --build-arg "CHUNKAH_ARGS=--prune /sysroot/ --max-layers 128 --compressed --label ostree.commit- --label ostree.final-diffid- --label ostree.bootable=true --label containers.bootc=1" \
-            -t "$CHUNKED_IMG" \
-            .
-
-          rm -f "$CHUNKAH_CF" out.ociarchive
-
-          # Platz freigeben: Original und Zwischenprodukt entfernen
-          buildah rmi "$IMG"
-          for full_tag in ${{ steps.metadata.outputs.tags }}; do
-            tag_only="${full_tag##*:}"
-            buildah tag "$CHUNKED_IMG" "localhost/${{ env.IMAGE_NAME }}:${tag_only}"
-          done
-          buildah rmi "$CHUNKED_IMG"
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v3
-        if: github.event_name != 'pull_request'
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Push to GHCR
-        id: push
-        if: github.event_name != 'pull_request'
-        uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
-        with:
-          image: ${{ env.IMAGE_NAME }}
-          tags: ${{ steps.metadata.outputs.tags }}
-          registry: ${{ env.IMAGE_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        if: github.event_name != 'pull_request'
-      
-      - name: Sign container image
-        if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
-        run: |
-          cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}"
-        env:
-          COSIGN_EXPERIMENTAL: false
-          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}

.github/workflows/clean.yml

@@ -1,27 +0,0 @@
-name: Cleanup Old Images
-on:
-  schedule:
-    - cron: "0 0 * * 0" # Weekly on Sunday at midnight UTC
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
-
-jobs:
-  delete-older-than-90:
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-    steps:
-      - name: Delete Images Older Than 90 Days
-        uses: dataaxiom/ghcr-cleanup-action@f092b48ba3b604b2a83690dc4b2bbb3392e1045f # v1.2.1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          # IMPORTANT: Update this to match your image name from Containerfile (line 9)
-          # This should match the "# Name: your-repo-name" comment in your Containerfile
-          # Example: If your Containerfile has "# Name: my-custom-os", use "my-custom-os" here
-          packages: fluffy-pancake
-          older-than: 45 days
-          delete-orphaned-images: true
-          keep-n-tagged: 5
-          keep-n-untagged: 5

.github/workflows/renovate.yml

@@ -1,31 +0,0 @@
-name: Renovate
-on:
-  schedule:
-    # Run every 6 hours
-    - cron: '0 */6 * * *'
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-    paths:
-      - '.github/renovate.json5'
-      - '.github/workflows/renovate.yml'
-
-jobs:
-  renovate:
-    name: Run Renovate
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-
-      - name: Self-hosted Renovate
-        uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
-        with:
-          configurationFile: .github/renovate.json5
-          token: ${{ secrets.GITHUB_TOKEN }}
-        env:
-          LOG_LEVEL: 'debug'

.github/workflows/validate-renovate.yml

@@ -1,35 +0,0 @@
-name: Validate Renovate Config
-
-on:
-  pull_request:
-    paths:
-      - ".github/renovate.json5"
-      - ".github/workflows/renovate.yml"
-  push:
-    branches:
-      - main
-    paths:
-      - ".github/renovate.json5"
-      - ".github/workflows/renovate.yml"
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
-        with:
-          node-version: latest
-
-      - name: Install dependencies
-        shell: bash
-        env:
-          RENOVATE_VERSION: latest
-        run: npm install -g renovate@${RENOVATE_VERSION}
-
-      - name: Validate Renovate config
-        shell: bash
-        run: renovate-config-validator --strict