diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index d953a50..304c24c 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -1,14 +1,16 @@ name: Build container image on: + pull_request: + branches: + - main schedule: - cron: '05 12 * * 2,5' workflow_dispatch: env: IMAGE_DESC: "Custom Fedora bootc image" - IMAGE_NAME: "fluffy-pancake" - IMAGE_REGISTRY: "humocs-man.duckdns.org/${{ github.repository_owner }}" + IMAGE_NAME: "${{ github.event.repository.name }}" DEFAULT_TAG: "stable" concurrency: @@ -26,18 +28,16 @@ jobs: id-token: write steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Install Podman & Tools - run: | - sudo apt-get update - sudo apt-get install -y podman jq curl - - name: Prepare environment run: | - echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} - echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} + # Extrahiert die reine Domain/Host (inkl. Port, falls vorhanden) aus der Gitea-URL + REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}') + OWNER_LOWER="${{ github.repository_owner }}" + NAME_LOWER="${{ env.IMAGE_NAME }}" + + echo "REGISTRY_HOST=${REGISTRY_HOST}" >> ${GITHUB_ENV} + echo "IMAGE_REGISTRY=${REGISTRY_HOST}/${OWNER_LOWER,,}" >> ${GITHUB_ENV} + echo "IMAGE_NAME=${NAME_LOWER,,}" >> ${GITHUB_ENV} - name: Determine image tag run: | @@ -51,6 +51,12 @@ jobs: echo "IS_TEST_BUILD=true" >> ${GITHUB_ENV} fi + - name: Checkout + uses: actions/checkout@v5 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Image Metadata uses: docker/metadata-action@v5 id: metadata @@ -59,10 +65,15 @@ jobs: type=raw,value=${{ env.IMAGE_TAG }} type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }} type=raw,value={{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }} + type=sha,enable=${{ github.event_name == 'pull_request' }} + type=ref,event=pr labels: | org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}} org.opencontainers.image.description=${{ env.IMAGE_DESC }} + org.opencontainers.image.documentation=${{ github.server_url }}/${{ github.repository }}/raw/commit/${{ github.sha }}/README.md + org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}/src/commit/${{ github.sha }}/Containerfile org.opencontainers.image.title=${{ env.IMAGE_NAME }} + org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }} org.opencontainers.image.vendor=${{ github.repository_owner }} org.opencontainers.image.version=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}} containers.bootc=1 @@ -70,77 +81,35 @@ jobs: sep-tags: " " sep-annotations: " " - - name: Build Image - env: - # Diese beiden Variablen sind der Schlüssel für den unprivilegierten Host - STORAGE_DRIVER: vfs - PODMAN_USERNS: keep-id - run: | - podman build \ - -f ./Containerfile \ - -t "localhost/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" \ - --storage-driver=vfs \ - --label "org.opencontainers.image.title=${{ env.IMAGE_NAME }}" \ - --label "org.opencontainers.image.description=${{ env.IMAGE_DESC }}" \ - --label "org.opencontainers.image.vendor=${{ github.repository_owner }}" \ - --label "containers.bootc=1" \ - --label "ostree.bootable=1" \ - . - - - name: Rechunk with chunkah - run: | - set -euo pipefail - - IMG="localhost/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" - CHUNKED_IMG="localhost/${{ env.IMAGE_NAME }}-chunked:${{ env.IMAGE_TAG }}" - - CONFIG=$(podman inspect "$IMG" | jq -c .[0]) - - CHUNKAH_CF=$(mktemp) - curl -sL https://github.com/coreos/chunkah/releases/download/v0.5.0/Containerfile.splitter -o "$CHUNKAH_CF" - - podman build --skip-unused-stages=false \ - -f "$CHUNKAH_CF" \ - --from "$IMG" \ - --build-arg CHUNKAH_CONFIG_STR="$CONFIG" \ - --build-arg "CHUNKAH_ARGS=--prune /sysroot/ --max-layers 128 --compressed --label ostree.commit- --label ostree.final-diffid- --label ostree.bootable=true --label containers.bootc=1" \ - -t "$CHUNKED_IMG" \ - . - - rm -f "$CHUNKAH_CF" - podman rmi "$IMG" - - for full_tag in ${{ steps.metadata.outputs.tags }}; do - tag_only="${full_tag##*:}" - podman tag "$CHUNKED_IMG" "localhost/${{ env.IMAGE_NAME }}:${tag_only}" - done - podman rmi "$CHUNKED_IMG" - - name: Login to Gitea Container Registry - run: | - podman login -u "${{ github.actor }}" -p "${{ secrets.GITHUB_TOKEN }}" humocs-man.duckdns.org + uses: docker/login-action@v3 + if: github.event_name != 'pull_request' + with: + registry: ${{ env.REGISTRY_HOST }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} - - name: Push to Gitea Registry - run: | - for full_tag in ${{ steps.metadata.outputs.tags }}; do - tag_only="${full_tag##*:}" - LOCAL_TAG="localhost/${{ env.IMAGE_NAME }}:${tag_only}" - REMOTE_TAG="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${tag_only}" - - podman tag "$LOCAL_TAG" "$REMOTE_TAG" - podman push "$REMOTE_TAG" - done - - DIGEST=$(podman inspect "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" | jq -r '.[0].Digest') - echo "IMAGE_DIGEST=$DIGEST" >> $GITHUB_ENV + - name: Build and Push Image + uses: docker/build-push-action@v6 + id: build_image + with: + context: . + file: ./Containerfile + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.metadata.outputs.tags }} + labels: ${{ steps.metadata.outputs.labels }} + # Nutzt das Actions Cache-System deines Gitea Runners + cache-from: type=gha + cache-to: type=gha,mode=max - name: Install Cosign - uses: sigstore/cosign-installer@v3 + uses: sigstore/cosign-installer@v4.1.2 + if: github.event_name != 'pull_request' - name: Sign container image - if: env.IS_TEST_BUILD == 'false' + if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false' run: | - cosign sign -y --tlog-upload=false --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}" + cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build_image.outputs.digest }}" env: COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}