From c29c37357bd8544ec39528cc1200300f0ca8e731 Mon Sep 17 00:00:00 2001 From: gunnar Date: Wed, 10 Jun 2026 22:08:26 +0200 Subject: [PATCH] back to docker-build --- .gitea/workflows/build.yml | 151 +++++++++++++++++-------------------- 1 file changed, 71 insertions(+), 80 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 25a12da..883fe15 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -1,9 +1,9 @@ name: Build container image on: - #pull_request: - #branches: - #- main + pull_request: + branches: + - main schedule: - cron: '05 12 * * 2,5' workflow_dispatch: @@ -30,6 +30,7 @@ jobs: steps: - name: Prepare environment run: | + # Extrahiert die reine Domain/Host (inkl. Port, falls vorhanden) aus der Gitea-URL REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}') OWNER_LOWER="${{ github.repository_owner }}" NAME_LOWER="${{ env.IMAGE_NAME }}" @@ -40,7 +41,7 @@ jobs: - name: Determine image tag run: | - BRANCH="$GITHUB_REF_NAME" + BRANCH="${GITHUB_REF_NAME}" if [[ "$BRANCH" == "main" ]]; then echo "IMAGE_TAG=${DEFAULT_TAG}" >> ${GITHUB_ENV} echo "IS_TEST_BUILD=false" >> ${GITHUB_ENV} @@ -51,15 +52,16 @@ jobs: fi - name: Checkout - # Abgesichert: entspricht actions/checkout@v5.0.0 (oder aktuellste v5-Commit) - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5.0.0 + uses: actions/checkout@v5 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 - name: Image Metadata id: metadata - # Abgesichert: entspricht docker/metadata-action@v5.7.0 - uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0 + uses: docker/metadata-action@v5 with: - images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }} + images: ${{ env.IMAGE_REGISTRY }}/${{ github.repository }} tags: | type=raw,value=${{ env.IMAGE_TAG }} type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }} @@ -78,90 +80,62 @@ jobs: containers.bootc=1 ostree.bootable=1 - - name: Login to Gitea Container Registry (Buildah) + - name: Install Skopeo + run: | + sudo apt-get update + sudo apt-get install -y skopeo + + - name: Login to Gitea Container Registry if: github.event_name != 'pull_request' - run: | - echo "${{ secrets.REGISTRY }}" | buildah login -u "${{ github.repository_owner }}" --password-stdin ${{ env.REGISTRY_HOST }} + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY_HOST }} + username: ${{ github.repository_owner }} + password: ${{ secrets.REGISTRY }} - - name: 1. Build Base OS Image (Rootless) - run: | - LABEL_ARGS=() - while IFS= read -r line; do - if [[ -n "$line" ]]; then - LABEL_ARGS+=("--label" "$line") - fi - done <<< "${{ steps.metadata.outputs.labels }}" + - name: Build Image Locally + uses: docker/build-push-action@v6 + id: build_image + with: + context: . + file: ./Containerfile + push: false + load: true + tags: ${{ steps.metadata.outputs.tags }} + labels: ${{ steps.metadata.outputs.labels }} - buildah bud \ - --storage-driver=overlay \ - --storage-opt=overlay.mount_program=/usr/bin/fuse-overlayfs \ - --format=oci \ - "${LABEL_ARGS[@]}" \ - -t localhost/fluffy-pancake:base \ - -f ./Containerfile \ - . - - - name: 2. Rechunk via Chunkah (Rootless) + - name: Push Image via Skopeo (Optimized Archive) if: github.event_name != 'pull_request' env: GENERATED_TAGS: ${{ steps.metadata.outputs.tags }} run: | - CHUNKAH_CONFIG_STR="$(podman inspect localhost/fluffy-pancake:base)" - # Chunkah ist hier bereits vorbildlich über seinen immutable SHA-256 Digest gepinnt! - CHUNKAH_REF="quay.io/coreos/chunkah:v0.6.0@sha256:ff8b8b466a942ec6000445d4001fc661e2fc5a952ad9ee29b4de9ab09d1d1708" - + # Die mehrzeiligen Tags in ein Bash-Array umwandeln TAG_LIST=($GENERATED_TAGS) FIRST_TAG=${TAG_LIST[0]} - echo "Starte Re-Chunking für Haupt-Tag: $FIRST_TAG" - buildah build \ - --storage-driver=overlay \ - --storage-opt=overlay.mount_program=/usr/bin/fuse-overlayfs \ - --skip-unused-stages=false \ - --from localhost/fluffy-pancake:base \ - --build-arg "CHUNKAH=${CHUNKAH_REF}" \ - --build-arg "CHUNKAH_CONFIG_STR=${CHUNKAH_CONFIG_STR}" \ - --build-arg "CHUNKAH_ARGS=--max-layers 128 --prune /sysroot/ --label ostree.commit- --label ostree.final-diffid-" \ - -t "$FIRST_TAG" \ - -v "$(pwd):/run/src" \ - --security-opt=label=disable \ - ./Containerfile.splitter + echo "Saving image ONCE via $FIRST_TAG to temporary tarball..." + docker save "$FIRST_TAG" -o image.tar + # Jetzt loopen wir NUR den Upload-Schritt über dieselbe Datei for tag in "${TAG_LIST[@]}"; do - if [[ "$tag" != "$FIRST_TAG" ]]; then - echo "Zusätzliches Tag setzen: $tag" - buildah tag --storage-driver=overlay "$FIRST_TAG" "$tag" - fi + echo "Pushing and converting $tag to clean OCI format..." + skopeo copy \ + --format oci \ + --dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \ + docker-archive:image.tar \ + docker://$tag done - rm -rf out + # Am Ende sauber aufräumen + rm -f image.tar - - name: 3. Push OCI Images directly + - name: Install envsubst dependencies if: github.event_name != 'pull_request' - env: - GENERATED_TAGS: ${{ steps.metadata.outputs.tags }} run: | - TAG_LIST=($GENERATED_TAGS) - FIRST_TAG=${TAG_LIST[0]} - - echo "Pushe primäres Image und extrahiere Digest für Cosign..." - buildah push \ - --storage-driver=overlay \ - --digestfile primary_digest.txt \ - "$FIRST_TAG" - - echo "IMAGE_DIGEST=$(cat primary_digest.txt)" >> ${GITHUB_ENV} - - for tag in "${TAG_LIST[@]}"; do - if [[ "$tag" != "$FIRST_TAG" ]]; then - echo "Pushe zusätzliches Tag: $tag" - buildah push --storage-driver=overlay "$tag" - fi - done + sudo apt-get update && sudo apt-get install -y gettext - name: Install Cosign if: github.event_name != 'pull_request' - # Abgesichert: entspricht sigstore/cosign-installer@v3.8.1 (Stabile v3/v4-Basis) uses: sigstore/cosign-installer@v4.1.2 - name: Sign container image @@ -170,17 +144,34 @@ jobs: COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} COSIGN_PASSWORD: "" run: | - echo "Signing image mit lokal extrahiertem Digest: ${{ env.IMAGE_DIGEST }}" + IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" + + echo "Fetching digest for $IMAGE_REF..." + DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}') + + echo "Signing image with explicit Cosign v3 legacy bypass..." cosign sign -y \ --key env://COSIGN_PRIVATE_KEY \ --use-signing-config=false \ --new-bundle-format=false \ --tlog-upload=false \ --registry-referrers-mode=legacy \ - "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}" + "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}" + + - name: Post-Build Cleanup + if: always() + run: | + echo "Starting deep cleanup of Docker system..." + + # 1. Entfernt alle ungenutzten Container, Netzwerke, Images und Volumes + docker system prune -af --volumes + + # 2. Entfernt den BuildKit-Cache (wichtig, da du Buildx nutzt!) + # Dieser Befehl ist extrem wichtig, um den Speicher von Buildx-Caches zu leeren. + docker builder prune -af + + echo "Removing temporary tarballs..." + rm -f image.tar + + echo "Cleanup complete." - - name: Post-Build Cleanup - if: always() - run: | - echo "Bereinige unprivilegierten Buildah-Storage..." - buildah prune --storage-driver=overlay --force