Refactor build workflow for image optimization

Updated GitHub Actions workflow to optimize image building and signing process.

.github/workflows/build.yml

@@ -1,4 +1,3 @@
----
 name: Build container image
 on:
   pull_request:
@@ -20,7 +19,7 @@ env:
   DEFAULT_TAG: "stable"
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
@@ -44,40 +43,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
 
-      # This is optional, but if you see that your builds are way too big for the runners, you can enable this by uncommenting the following lines:
-      # - name: Maximize build space
-      #   uses: ublue-os/remove-unwanted-software@517622d6452028f266b7ba4cc9a123b5f58a6b53 # v7
-      #   with:
-      #     remove-codeql: true
-
       - name: Mount BTRFS for podman storage
         id: container-storage-action
         uses: ublue-os/container-storage-action@911baca08baf30c8654933e9e9723cb399892140 # main
-
-        # Fallback to the remove-unwanted-software-action if github doesn't allocate enough space
-        # See: https://github.com/ublue-os/container-storage-action/pull/11
         continue-on-error: true 
         with:
           target-dir: /var/lib/containers
           mount-opts: compress-force=zstd:2
 
-      - name: Get current date
-        id: date
-        run: |
-          # This generates a timestamp like what is defined on the ArtifactHub documentation
-          # E.G: 2022-02-08T15:38:15Z'
-          # https://artifacthub.io/docs/topics/repositories/container-images/
-          # https://linux.die.net/man/1/date
-          echo "date=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)" >> $GITHUB_OUTPUT
-
-      # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
-      # The metadata by itself is not going to do anything, you choose if you want your image to be on ArtifactHub or not.
       - name: Image Metadata
         uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v5
         id: metadata
         with:
-          # This generates all the tags for your image, you can add custom tags here too!
-          # Default tags are "$DEFAULT_TAG" and "$DEFAULT_TAG.$date".
           tags: |
             type=raw,value=${{ env.DEFAULT_TAG }}
             type=raw,value=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
@@ -85,7 +62,7 @@ jobs:
             type=sha,enable=${{ github.event_name == 'pull_request' }}
             type=ref,event=pr
           labels: |
-            org.opencontainers.image.created=${{ steps.date.outputs.date }}
+            org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}}
             org.opencontainers.image.description=${{ env.IMAGE_DESC }}
             org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/${{ github.sha }}/README.md
             org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/${{ github.sha }}/Containerfile
@@ -97,7 +74,6 @@ jobs:
           sep-tags: " "
           sep-annotations: " "
 
-          # Hinzufügen vor dem "Build Image" Schritt:
       - name: Cache buildah layers
         uses: actions/cache@v5
         with:
@@ -109,55 +85,65 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('Containerfile') }}-
 
-
       - name: Build Image
         id: build_image
         uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
         with:
           containerfiles: |
             ./Containerfile
-          # Postfix image name with -custom to make it a little more descriptive
-          # Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format
           image: ${{ env.IMAGE_NAME }}
           tags: ${{ env.DEFAULT_TAG }}
           labels: ${{ steps.metadata.outputs.labels }}
-          oci: false
+          oci: true
+
+      # --- CHUNKAH OPTIMIERUNG ---
+      - name: Apply chunkah optimization
+        id: chunkah
+        run: |
+          set -x
+          BASE_IMAGE="${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}"
+          
+          # Rootfs extrahieren
+          CONTAINER_ID=$(podman create $BASE_IMAGE)
+          mkdir -p ./chunkah-in ./chunkah-out
+          podman export $CONTAINER_ID | tar -xf - -C ./chunkah-in
+          podman rm $CONTAINER_ID
+
+          # Original-Konfiguration sichern
+          podman inspect $BASE_IMAGE --format '{{json .Config}}' > ./chunkah-config.json
+
+          # Chunkah-Lauf (Nutzt nativ ZSTD für die Chunks)
+          podman run --rm \
+            -v ./chunkah-in:/inputs:z \
+            -v ./chunkah-out:/outputs:z \
+            -v ./chunkah-config.json:/config.json:z \
+            quay.io/coreos/chunkah:latest \
+            build \
+            --config /config.json \
+            --prune /sysroot/ \
+            --max-layers 128 \
+            --compressed \
+            --output /outputs/image.ociarchive \
+            /inputs
+
+          # Altes Image löschen, um Platz zu machen und Eindeutigkeit beim Laden zu sichern
+          podman rmi $BASE_IMAGE
+          podman load -i ./chunkah-out/image.ociarchive
+          
+          # Eindeutige ID-Zuweisung des frisch geladenen Images (schließt das Chunkah-Image aus)
+          IMAGE_ID=$(podman images --filter "dangling=true" --format "{{.ID}}" | head -n 1)
+          if [ -z "$IMAGE_ID" ]; then
+            IMAGE_ID=$(podman images --format "{{.ID}} {{.Repository}}" | grep -v "chunkah" | head -n 1 | awk '{print $1}')
+          fi
+          podman tag $IMAGE_ID $BASE_IMAGE
 
-      # Tag for registry
       - name: Tag for registry
         run: |
           for tag in ${{ steps.metadata.outputs.tags }}; do
             podman tag ${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }} ${{ env.IMAGE_NAME }}:$tag
           done
 
-      # SBOM (OPTIONAL): Software Bill of Materials generation using Syft
+      # Login to GitHub Container Registry
-      # Creates a detailed inventory of all software components in the image for supply chain security.
-      # To enable:
-      #   1. Uncomment the "Setup Syft" step below
-      #   2. Uncomment the "Generate SBOM" step below
-      #   3. If using image signing, also uncomment the "Add SBOM Attestation" step further down
-      # Documentation: https://github.com/anchore/syft
-      
-      # - name: Setup Syft
-      #   id: setup-syft
-      #   uses: anchore/sbom-action/download-syft@8e94d75ddd33f69f691467e42275782e4bfefe84 # v0.20.9
-      #   with:
-      #     syft-version: v1.20.0
-      #
-      # - name: Generate SBOM
-      #   id: generate-sbom
-      #   env:
-      #     IMAGE: ${{ env.IMAGE_NAME }}
-      #     DEFAULT_TAG: ${{ env.DEFAULT_TAG }}
-      #     SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
-      #   run: |
-      #     OUTPUT_PATH="$(mktemp -d)/sbom.json"
-      #     export SYFT_PARALLELISM=$(($(nproc)*2))
-      #     $SYFT_CMD ${IMAGE}:${DEFAULT_TAG} -o spdx-json=${OUTPUT_PATH}
-      #     echo "OUTPUT_PATH=${OUTPUT_PATH}" >> $GITHUB_OUTPUT
-
-      # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing
-      # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work
       - name: Login to GitHub Container Registry
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v3
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
@@ -179,9 +165,8 @@ jobs:
           tags: ${{ steps.metadata.outputs.tags }}
           username: ${{ env.REGISTRY_USER }}
           password: ${{ env.REGISTRY_PASSWORD }}
-
+          # Erzwingt die Beibehaltung und Kompression der Layer als ZSTD beim Push in die Registry
-      # OPTIONAL: Image Signing with Cosign
+          extra-args: --compression-format=zstd --compression-level=5
-      # Signing is disabled by default. To enable, see README.md "Optional: Enable Image Signing" section.
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
@@ -190,13 +175,8 @@ jobs:
       - name: Sign container image
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         run: |
-          IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
+          # Statisches Signing basierend auf dem unveränderlichen SHA256-Digest des Push-Schritts
-          for tag in ${{ steps.metadata.outputs.tags }}; do
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}"
-            cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag
-          done
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-
-
-