back to docker-build

.gitea/workflows/build.yml

@@ -1,9 +1,9 @@
 name: Build container image
 
 on:
-  #pull_request:
+  pull_request:
-    #branches:
+    branches:
-      #- main
+      - main
   schedule:
     - cron: '05 12 * * 2,5'
   workflow_dispatch:
@@ -30,6 +30,7 @@ jobs:
     steps:
       - name: Prepare environment
         run: |
+          # Extrahiert die reine Domain/Host (inkl. Port, falls vorhanden) aus der Gitea-URL
           REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}')
           OWNER_LOWER="${{ github.repository_owner }}"
           NAME_LOWER="${{ env.IMAGE_NAME }}"
@@ -40,7 +41,7 @@ jobs:
 
       - name: Determine image tag
         run: |
-          BRANCH="$GITHUB_REF_NAME"
+          BRANCH="${GITHUB_REF_NAME}"
           if [[ "$BRANCH" == "main" ]]; then
             echo "IMAGE_TAG=${DEFAULT_TAG}" >> ${GITHUB_ENV}
             echo "IS_TEST_BUILD=false" >> ${GITHUB_ENV}
@@ -51,15 +52,16 @@ jobs:
           fi
 
       - name: Checkout
-        # Abgesichert: entspricht actions/checkout@v5.0.0 (oder aktuellste v5-Commit)
+        uses: actions/checkout@v5
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
       - name: Image Metadata
         id: metadata
-        # Abgesichert: entspricht docker/metadata-action@v5.7.0
+        uses: docker/metadata-action@v5
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         with:
-          images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
+          images: ${{ env.IMAGE_REGISTRY }}/${{ github.repository }}
           tags: |
             type=raw,value=${{ env.IMAGE_TAG }}
             type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
@@ -78,90 +80,62 @@ jobs:
             containers.bootc=1
             ostree.bootable=1
 
-      - name: Login to Gitea Container Registry (Buildah)
+      - name: Install Skopeo
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y skopeo
+
+      - name: Login to Gitea Container Registry
         if: github.event_name != 'pull_request'
-        run: |
+        uses: docker/login-action@v3
-          echo "${{ secrets.REGISTRY }}" | buildah login -u "${{ github.repository_owner }}" --password-stdin ${{ env.REGISTRY_HOST }}
+        with:
+          registry: ${{ env.REGISTRY_HOST }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.REGISTRY }}
 
-      - name: 1. Build Base OS Image (Rootless)
+      - name: Build Image Locally
-        run: |
+        uses: docker/build-push-action@v6
-          LABEL_ARGS=()
+        id: build_image
-          while IFS= read -r line; do
+        with:
-            if [[ -n "$line" ]]; then
+          context: .
-              LABEL_ARGS+=("--label" "$line")
+          file: ./Containerfile
-            fi
+          push: false
-          done <<< "${{ steps.metadata.outputs.labels }}"
+          load: true
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}
 
-          buildah bud \
+      - name: Push Image via Skopeo (Optimized Archive)
-            --storage-driver=overlay \
-            --storage-opt=overlay.mount_program=/usr/bin/fuse-overlayfs \
-            --format=oci \
-            "${LABEL_ARGS[@]}" \
-            -t localhost/fluffy-pancake:base \
-            -f ./Containerfile \
-            .
-
-      - name: 2. Rechunk via Chunkah (Rootless)
         if: github.event_name != 'pull_request'
         env:
           GENERATED_TAGS: ${{ steps.metadata.outputs.tags }}
         run: |
-          CHUNKAH_CONFIG_STR="$(podman inspect localhost/fluffy-pancake:base)"
+          # Die mehrzeiligen Tags in ein Bash-Array umwandeln
-          # Chunkah ist hier bereits vorbildlich über seinen immutable SHA-256 Digest gepinnt!
-          CHUNKAH_REF="quay.io/coreos/chunkah:v0.6.0@sha256:ff8b8b466a942ec6000445d4001fc661e2fc5a952ad9ee29b4de9ab09d1d1708"
-
           TAG_LIST=($GENERATED_TAGS)
           FIRST_TAG=${TAG_LIST[0]}
 
-          echo "Starte Re-Chunking für Haupt-Tag: $FIRST_TAG"
+          echo "Saving image ONCE via $FIRST_TAG to temporary tarball..."
-          buildah build \
+          docker save "$FIRST_TAG" -o image.tar
-            --storage-driver=overlay \
-            --storage-opt=overlay.mount_program=/usr/bin/fuse-overlayfs \
-            --skip-unused-stages=false \
-            --from localhost/fluffy-pancake:base \
-            --build-arg "CHUNKAH=${CHUNKAH_REF}" \
-            --build-arg "CHUNKAH_CONFIG_STR=${CHUNKAH_CONFIG_STR}" \
-            --build-arg "CHUNKAH_ARGS=--max-layers 128 --prune /sysroot/ --label ostree.commit- --label ostree.final-diffid-" \
-            -t "$FIRST_TAG" \
-            -v "$(pwd):/run/src" \
-            --security-opt=label=disable \
-            ./Containerfile.splitter
 
+          # Jetzt loopen wir NUR den Upload-Schritt über dieselbe Datei
           for tag in "${TAG_LIST[@]}"; do
-            if [[ "$tag" != "$FIRST_TAG" ]]; then
+            echo "Pushing and converting $tag to clean OCI format..."
-              echo "Zusätzliches Tag setzen: $tag"
+            skopeo copy \
-              buildah tag --storage-driver=overlay "$FIRST_TAG" "$tag"
+              --format oci \
-            fi
+              --dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
+              docker-archive:image.tar \
+              docker://$tag
           done
 
-          rm -rf out
+          # Am Ende sauber aufräumen
+          rm -f image.tar
 
-      - name: 3. Push OCI Images directly
+      - name: Install envsubst dependencies
         if: github.event_name != 'pull_request'
-        env:
-          GENERATED_TAGS: ${{ steps.metadata.outputs.tags }}
         run: |
-          TAG_LIST=($GENERATED_TAGS)
+          sudo apt-get update && sudo apt-get install -y gettext
-          FIRST_TAG=${TAG_LIST[0]}
-
-          echo "Pushe primäres Image und extrahiere Digest für Cosign..."
-          buildah push \
-            --storage-driver=overlay \
-            --digestfile primary_digest.txt \
-            "$FIRST_TAG"
-
-          echo "IMAGE_DIGEST=$(cat primary_digest.txt)" >> ${GITHUB_ENV}
-
-          for tag in "${TAG_LIST[@]}"; do
-            if [[ "$tag" != "$FIRST_TAG" ]]; then
-              echo "Pushe zusätzliches Tag: $tag"
-              buildah push --storage-driver=overlay "$tag"
-            fi
-          done
 
       - name: Install Cosign
         if: github.event_name != 'pull_request'
-        # Abgesichert: entspricht sigstore/cosign-installer@v3.8.1 (Stabile v3/v4-Basis)
         uses: sigstore/cosign-installer@v4.1.2
 
       - name: Sign container image
@@ -170,17 +144,34 @@ jobs:
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
           COSIGN_PASSWORD: ""
         run: |
-          echo "Signing image mit lokal extrahiertem Digest: ${{ env.IMAGE_DIGEST }}"
+          IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
+
+          echo "Fetching digest for $IMAGE_REF..."
+          DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}')
+
+          echo "Signing image with explicit Cosign v3 legacy bypass..."
           cosign sign -y \
             --key env://COSIGN_PRIVATE_KEY \
             --use-signing-config=false \
             --new-bundle-format=false \
             --tlog-upload=false \
             --registry-referrers-mode=legacy \
-            "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}"
+            "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"
 
     - name: Post-Build Cleanup
       if: always()
       run: |
-          echo "Bereinige unprivilegierten Buildah-Storage..."
+        echo "Starting deep cleanup of Docker system..."
-          buildah prune --storage-driver=overlay --force
+
+        # 1. Entfernt alle ungenutzten Container, Netzwerke, Images und Volumes
+        docker system prune -af --volumes
+
+        # 2. Entfernt den BuildKit-Cache (wichtig, da du Buildx nutzt!)
+        # Dieser Befehl ist extrem wichtig, um den Speicher von Buildx-Caches zu leeren.
+        docker builder prune -af
+
+        echo "Removing temporary tarballs..."
+        rm -f image.tar
+
+        echo "Cleanup complete."
+