back to docker-build

2026-06-10 22:08:26 +02:00
parent 0503cf217c
commit c29c37357b
1 changed files with 71 additions and 80 deletions
@@ -1,9 +1,9 @@
 name: Build container image

 on:
-  #pull_request:
-    #branches:
-      #- main
+  pull_request:
+    branches:
+      - main
  schedule:
    - cron: '05 12 * * 2,5'
  workflow_dispatch:
@@ -30,6 +30,7 @@ jobs:
    steps:
      - name: Prepare environment
        run: |
+          # Extrahiert die reine Domain/Host (inkl. Port, falls vorhanden) aus der Gitea-URL
          REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}')
          OWNER_LOWER="${{ github.repository_owner }}"
          NAME_LOWER="${{ env.IMAGE_NAME }}"
@@ -40,7 +41,7 @@ jobs:

      - name: Determine image tag
        run: |
-          BRANCH="$GITHUB_REF_NAME"
+          BRANCH="${GITHUB_REF_NAME}"
          if [[ "$BRANCH" == "main" ]]; then
            echo "IMAGE_TAG=${DEFAULT_TAG}" >> ${GITHUB_ENV}
            echo "IS_TEST_BUILD=false" >> ${GITHUB_ENV}
@@ -51,15 +52,16 @@ jobs:
          fi

      - name: Checkout
-        # Abgesichert: entspricht actions/checkout@v5.0.0 (oder aktuellste v5-Commit)
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5.0.0
+        uses: actions/checkout@v5
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3

      - name: Image Metadata
        id: metadata
-        # Abgesichert: entspricht docker/metadata-action@v5.7.0
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        uses: docker/metadata-action@v5
        with:
-          images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
+          images: ${{ env.IMAGE_REGISTRY }}/${{ github.repository }}
          tags: |
            type=raw,value=${{ env.IMAGE_TAG }}
            type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }}
@@ -78,90 +80,62 @@ jobs:
            containers.bootc=1
            ostree.bootable=1

-      - name: Login to Gitea Container Registry (Buildah)
+      - name: Install Skopeo
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y skopeo
+
+      - name: Login to Gitea Container Registry
        if: github.event_name != 'pull_request'
-        run: |
-          echo "${{ secrets.REGISTRY }}" | buildah login -u "${{ github.repository_owner }}" --password-stdin ${{ env.REGISTRY_HOST }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY_HOST }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.REGISTRY }}

-      - name: 1. Build Base OS Image (Rootless)
-        run: |
-          LABEL_ARGS=()
-          while IFS= read -r line; do
-            if [[ -n "$line" ]]; then
-              LABEL_ARGS+=("--label" "$line")
-            fi
-          done <<< "${{ steps.metadata.outputs.labels }}"
+      - name: Build Image Locally
+        uses: docker/build-push-action@v6
+        id: build_image
+        with:
+          context: .
+          file: ./Containerfile
+          push: false
+          load: true
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}

-          buildah bud \
-            --storage-driver=overlay \
-            --storage-opt=overlay.mount_program=/usr/bin/fuse-overlayfs \
-            --format=oci \
-            "${LABEL_ARGS[@]}" \
-            -t localhost/fluffy-pancake:base \
-            -f ./Containerfile \
-            .
-
-      - name: 2. Rechunk via Chunkah (Rootless)
+      - name: Push Image via Skopeo (Optimized Archive)
        if: github.event_name != 'pull_request'
        env:
          GENERATED_TAGS: ${{ steps.metadata.outputs.tags }}
        run: |
-          CHUNKAH_CONFIG_STR="$(podman inspect localhost/fluffy-pancake:base)"
-          # Chunkah ist hier bereits vorbildlich über seinen immutable SHA-256 Digest gepinnt!
-          CHUNKAH_REF="quay.io/coreos/chunkah:v0.6.0@sha256:ff8b8b466a942ec6000445d4001fc661e2fc5a952ad9ee29b4de9ab09d1d1708"
-
+          # Die mehrzeiligen Tags in ein Bash-Array umwandeln
          TAG_LIST=($GENERATED_TAGS)
          FIRST_TAG=${TAG_LIST[0]}

-          echo "Starte Re-Chunking für Haupt-Tag: $FIRST_TAG"
-          buildah build \
-            --storage-driver=overlay \
-            --storage-opt=overlay.mount_program=/usr/bin/fuse-overlayfs \
-            --skip-unused-stages=false \
-            --from localhost/fluffy-pancake:base \
-            --build-arg "CHUNKAH=${CHUNKAH_REF}" \
-            --build-arg "CHUNKAH_CONFIG_STR=${CHUNKAH_CONFIG_STR}" \
-            --build-arg "CHUNKAH_ARGS=--max-layers 128 --prune /sysroot/ --label ostree.commit- --label ostree.final-diffid-" \
-            -t "$FIRST_TAG" \
-            -v "$(pwd):/run/src" \
-            --security-opt=label=disable \
-            ./Containerfile.splitter
+          echo "Saving image ONCE via $FIRST_TAG to temporary tarball..."
+          docker save "$FIRST_TAG" -o image.tar

+          # Jetzt loopen wir NUR den Upload-Schritt über dieselbe Datei
          for tag in "${TAG_LIST[@]}"; do
-            if [[ "$tag" != "$FIRST_TAG" ]]; then
-              echo "Zusätzliches Tag setzen: $tag"
-              buildah tag --storage-driver=overlay "$FIRST_TAG" "$tag"
-            fi
+            echo "Pushing and converting $tag to clean OCI format..."
+            skopeo copy \
+              --format oci \
+              --dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
+              docker-archive:image.tar \
+              docker://$tag
          done

-          rm -rf out
+          # Am Ende sauber aufräumen
+          rm -f image.tar

-      - name: 3. Push OCI Images directly
+      - name: Install envsubst dependencies
        if: github.event_name != 'pull_request'
-        env:
-          GENERATED_TAGS: ${{ steps.metadata.outputs.tags }}
        run: |
-          TAG_LIST=($GENERATED_TAGS)
-          FIRST_TAG=${TAG_LIST[0]}
-
-          echo "Pushe primäres Image und extrahiere Digest für Cosign..."
-          buildah push \
-            --storage-driver=overlay \
-            --digestfile primary_digest.txt \
-            "$FIRST_TAG"
-
-          echo "IMAGE_DIGEST=$(cat primary_digest.txt)" >> ${GITHUB_ENV}
-
-          for tag in "${TAG_LIST[@]}"; do
-            if [[ "$tag" != "$FIRST_TAG" ]]; then
-              echo "Pushe zusätzliches Tag: $tag"
-              buildah push --storage-driver=overlay "$tag"
-            fi
-          done
+          sudo apt-get update && sudo apt-get install -y gettext

      - name: Install Cosign
        if: github.event_name != 'pull_request'
-        # Abgesichert: entspricht sigstore/cosign-installer@v3.8.1 (Stabile v3/v4-Basis)
        uses: sigstore/cosign-installer@v4.1.2

      - name: Sign container image
@@ -170,17 +144,34 @@ jobs:
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
          COSIGN_PASSWORD: ""
        run: |
-          echo "Signing image mit lokal extrahiertem Digest: ${{ env.IMAGE_DIGEST }}"
+          IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
+
+          echo "Fetching digest for $IMAGE_REF..."
+          DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}')
+
+          echo "Signing image with explicit Cosign v3 legacy bypass..."
          cosign sign -y \
            --key env://COSIGN_PRIVATE_KEY \
            --use-signing-config=false \
            --new-bundle-format=false \
            --tlog-upload=false \
            --registry-referrers-mode=legacy \
-            "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}"
+            "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"

    - name: Post-Build Cleanup
      if: always()
      run: |
-          echo "Bereinige unprivilegierten Buildah-Storage..."
-          buildah prune --storage-driver=overlay --force
+        echo "Starting deep cleanup of Docker system..."
+
+        # 1. Entfernt alle ungenutzten Container, Netzwerke, Images und Volumes
+        docker system prune -af --volumes
+
+        # 2. Entfernt den BuildKit-Cache (wichtig, da du Buildx nutzt!)
+        # Dieser Befehl ist extrem wichtig, um den Speicher von Buildx-Caches zu leeren.
+        docker builder prune -af
+
+        echo "Removing temporary tarballs..."
+        rm -f image.tar
+
+        echo "Cleanup complete."
+