From d5ae4f45d7bc48dcb502eb724b2bc38b76191467 Mon Sep 17 00:00:00 2001 From: humocs-man <251756307+humocs-man@users.noreply.github.com> Date: Sun, 17 May 2026 12:36:18 +0200 Subject: [PATCH] Refactor build workflow for image optimization Updated GitHub Actions workflow to optimize image building and signing process. --- .github/workflows/build.yml | 118 +++++++++++++++--------------------- 1 file changed, 49 insertions(+), 69 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 454c862..c90607e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,4 +1,3 @@ ---- name: Build container image on: pull_request: @@ -20,7 +19,7 @@ env: DEFAULT_TAG: "stable" concurrency: - group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }} + group: ${{ github.workflow }}-${{ github.ref || github.run_id }} cancel-in-progress: true jobs: @@ -44,40 +43,18 @@ jobs: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 - # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines: - # - name: Maximize build space - # uses: ublue-os/remove-unwanted-software@517622d6452028f266b7ba4cc9a123b5f58a6b53 # v7 - # with: - # remove-codeql: true - - name: Mount BTRFS for podman storage id: container-storage-action uses: ublue-os/container-storage-action@911baca08baf30c8654933e9e9723cb399892140 # main - - # Fallback to the remove-unwanted-software-action if github doesn't allocate enough space - # See: https://github.com/ublue-os/container-storage-action/pull/11 continue-on-error: true with: target-dir: /var/lib/containers mount-opts: compress-force=zstd:2 - - name: Get current date - id: date - run: | - # This generates a timestamp like what is defined on the ArtifactHub documentation - # E.G: 2022-02-08T15:38:15Z' - # https://artifacthub.io/docs/topics/repositories/container-images/ - # https://linux.die.net/man/1/date - echo "date=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)" >> $GITHUB_OUTPUT - - # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images - # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not. - name: Image Metadata uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v5 id: metadata with: - # This generates all the tags for your image, you can add custom tags here too! - # Default tags are "$DEFAULT_TAG" and "$DEFAULT_TAG.$date". tags: | type=raw,value=${{ env.DEFAULT_TAG }} type=raw,value=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}} @@ -85,7 +62,7 @@ jobs: type=sha,enable=${{ github.event_name == 'pull_request' }} type=ref,event=pr labels: | - org.opencontainers.image.created=${{ steps.date.outputs.date }} + org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}} org.opencontainers.image.description=${{ env.IMAGE_DESC }} org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/${{ github.sha }}/Containerfile @@ -97,7 +74,6 @@ jobs: sep-tags: " " sep-annotations: " " - # Hinzufügen vor dem "Build Image" Schritt: - name: Cache buildah layers uses: actions/cache@v5 with: @@ -109,55 +85,65 @@ jobs: restore-keys: | ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile') }}- - - name: Build Image id: build_image uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2 with: containerfiles: | ./Containerfile - # Postfix image name with -custom to make it a little more descriptive - # Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format image: ${{ env.IMAGE_NAME }} tags: ${{ env.DEFAULT_TAG }} labels: ${{ steps.metadata.outputs.labels }} - oci: false + oci: true + + # --- CHUNKAH OPTIMIERUNG --- + - name: Apply chunkah optimization + id: chunkah + run: | + set -x + BASE_IMAGE="${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}" + + # Rootfs extrahieren + CONTAINER_ID=$(podman create $BASE_IMAGE) + mkdir -p ./chunkah-in ./chunkah-out + podman export $CONTAINER_ID | tar -xf - -C ./chunkah-in + podman rm $CONTAINER_ID + + # Original-Konfiguration sichern + podman inspect $BASE_IMAGE --format '{{json .Config}}' > ./chunkah-config.json + + # Chunkah-Lauf (Nutzt nativ ZSTD für die Chunks) + podman run --rm \ + -v ./chunkah-in:/inputs:z \ + -v ./chunkah-out:/outputs:z \ + -v ./chunkah-config.json:/config.json:z \ + quay.io/coreos/chunkah:latest \ + build \ + --config /config.json \ + --prune /sysroot/ \ + --max-layers 128 \ + --compressed \ + --output /outputs/image.ociarchive \ + /inputs + + # Altes Image löschen, um Platz zu machen und Eindeutigkeit beim Laden zu sichern + podman rmi $BASE_IMAGE + podman load -i ./chunkah-out/image.ociarchive + + # Eindeutige ID-Zuweisung des frisch geladenen Images (schließt das Chunkah-Image aus) + IMAGE_ID=$(podman images --filter "dangling=true" --format "{{.ID}}" | head -n 1) + if [ -z "$IMAGE_ID" ]; then + IMAGE_ID=$(podman images --format "{{.ID}} {{.Repository}}" | grep -v "chunkah" | head -n 1 | awk '{print $1}') + fi + podman tag $IMAGE_ID $BASE_IMAGE - # Tag for registry - name: Tag for registry run: | for tag in ${{ steps.metadata.outputs.tags }}; do podman tag ${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} ${{ env.IMAGE_NAME }}:$tag done - # SBOM (OPTIONAL): Software Bill of Materials generation using Syft - # Creates a detailed inventory of all software components in the image for supply chain security. - # To enable: - # 1. Uncomment the "Setup Syft" step below - # 2. Uncomment the "Generate SBOM" step below - # 3. If using image signing, also uncomment the "Add SBOM Attestation" step further down - # Documentation: https://github.com/anchore/syft - - # - name: Setup Syft - # id: setup-syft - # uses: anchore/sbom-action/download-syft@8e94d75ddd33f69f691467e42275782e4bfefe84 # v0.20.9 - # with: - # syft-version: v1.20.0 - # - # - name: Generate SBOM - # id: generate-sbom - # env: - # IMAGE: ${{ env.IMAGE_NAME }} - # DEFAULT_TAG: ${{ env.DEFAULT_TAG }} - # SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }} - # run: | - # OUTPUT_PATH="$(mktemp -d)/sbom.json" - # export SYFT_PARALLELISM=$(($(nproc)*2)) - # $SYFT_CMD ${IMAGE}:${DEFAULT_TAG} -o spdx-json=${OUTPUT_PATH} - # echo "OUTPUT_PATH=${OUTPUT_PATH}" >> $GITHUB_OUTPUT - - # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing - # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work + # Login to GitHub Container Registry - name: Login to GitHub Container Registry uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v3 if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) @@ -179,9 +165,8 @@ jobs: tags: ${{ steps.metadata.outputs.tags }} username: ${{ env.REGISTRY_USER }} password: ${{ env.REGISTRY_PASSWORD }} - - # OPTIONAL: Image Signing with Cosign - # Signing is disabled by default. To enable, see README.md "Optional: Enable Image Signing" section. + # Erzwingt die Beibehaltung und Kompression der Layer als ZSTD beim Push in die Registry + extra-args: --compression-format=zstd --compression-level=5 - name: Install Cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 @@ -190,13 +175,8 @@ jobs: - name: Sign container image if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) run: | - IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}" - for tag in ${{ steps.metadata.outputs.tags }}; do - cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag - done + # Statisches Signing basierend auf dem unveränderlichen SHA256-Digest des Push-Schritts + cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}" env: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} - - -