.gitea/workflows/build-and-push.yaml aktualisiert

.gitea/workflows/build-and-push.yaml

@@ -1,13 +1,17 @@
 on:
   push:
     branches:
-      - 'main'
+      - 'dev'
     tags:
       - '*'
   schedule:
     - cron: '0 5 * * 0'
   workflow_dispatch:
 
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   release-and-build:
     runs-on: buildx-multiarch
@@ -16,6 +20,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
+          token: ${{ secrets.RUNNER_TOKEN }}
           fetch-depth: 0
 
       - name: Prepare Environment and Read Config
@@ -59,8 +64,7 @@ jobs:
 
       - name: Login to Gitea Registry
         run: |
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login \
+            echo "${{ secrets.RUNNER_TOKEN }}" | docker login git.pi-farm.de -u "${{ gitea.actor }}" --password-stdin
-            git.pi-farm.de -u ${{ secrets.REGISTRY_USER }} --password-stdin
 
       - name: Check for Real Changes
         id: check_changes
@@ -125,6 +129,7 @@ jobs:
           ARGS_HASH=${{ steps.prep.outputs.build_args_hash }}
           BASE=${{ steps.prep.outputs.base_image }}
           REPO_PURE=${{ steps.prep.outputs.repo_pure }}
+          DOCKERHUB_REPO="${{ secrets.DOCKERHUB_USERNAME }}/$REPO_PURE"
           
           set -a
           source <(grep -v '^#' buildargs.env | sed 's/\r$//')
@@ -138,14 +143,26 @@ jobs:
           
           BASE_SHA=$(docker buildx imagetools inspect $BASE --format '{{json .Manifest.Digest}}' 2>/dev/null | tr -d '"' || echo "unknown")
 
-          docker buildx build "${DOCKER_ARGS[@]}" -t "$IMAGE_GITEA:tmp-amd64" \
+          # Bereite die Tags für den initialen Build vor (Gitea immer, Docker Hub optional)
+          AMD_TAGS=("-t" "$IMAGE_GITEA:tmp-amd64")
+          ARM_TAGS=("-t" "$IMAGE_GITEA:tmp-arm64")
+          
+          if [[ "$PUSH" == *"dockerhub"* ]]; then
+            AMD_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-amd64")
+            ARM_TAGS+=("-t" "$DOCKERHUB_REPO:tmp-arm64")
+          fi
+
+          # Build AMD64 & Push zu allen Zielen
+          docker buildx build "${DOCKER_ARGS[@]}" "${AMD_TAGS[@]}" \
             --pull --platform linux/amd64 -f Dockerfile \
             --label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
           
-          docker buildx build "${DOCKER_ARGS[@]}" -t "$IMAGE_GITEA:tmp-arm64" \
+          # Build ARM64 & Push zu allen Zielen
+          docker buildx build "${DOCKER_ARGS[@]}" "${ARM_TAGS[@]}" \
             --pull --platform linux/arm64 -f Dockerfile.aarch64 \
             --label "pi_farm.base_digest=$BASE_SHA" --label "pi_farm.args_hash=$ARGS_HASH" --push .
           
+          # 1. Manifest auf Gitea erstellen (aus Gitea Temp-Tags)
           GITEA_MANIFEST_TAGS=("-t" "$IMAGE_GITEA:$TAG")
           if [[ "$BUILD_TAG_LATEST" == "y" ]]; then
             GITEA_MANIFEST_TAGS+=("-t" "$IMAGE_GITEA:latest")
@@ -155,16 +172,17 @@ jobs:
             --annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \
             "${GITEA_MANIFEST_TAGS[@]}" $IMAGE_GITEA:tmp-amd64 $IMAGE_GITEA:tmp-arm64
 
+          # 2. Manifest auf Docker Hub erstellen (aus Docker Hub Temp-Tags!)
           if [[ "$PUSH" == *"dockerhub"* ]]; then
-            DOCKERHUB_REPO="${{ secrets.DOCKERHUB_USERNAME }}/$REPO_PURE"
             DH_MANIFEST_TAGS=("-t" "$DOCKERHUB_REPO:$TAG")
             if [[ "$BUILD_TAG_LATEST" == "y" ]]; then
               DH_MANIFEST_TAGS+=("-t" "$DOCKERHUB_REPO:latest")
             fi
 
+            # WICHTIG: Hier werden jetzt als Quelle die Docker Hub Temp-Tags genutzt!
             docker buildx imagetools create \
               --annotation "index:pi_farm.base_digest=$BASE_SHA" --annotation "index:pi_farm.args_hash=$ARGS_HASH" \
-              "${DH_MANIFEST_TAGS[@]}" $IMAGE_GITEA:tmp-amd64 $IMAGE_GITEA:tmp-arm64
+              "${DH_MANIFEST_TAGS[@]}" $DOCKERHUB_REPO:tmp-amd64 $DOCKERHUB_REPO:tmp-arm64
           fi
 
       - name: Update Documentation and Compose
@@ -194,8 +212,23 @@ jobs:
               EOF
               COMMIT_MSG=$(sed 's/\[skip ci\]//g' commit_msg.txt | xargs)
         
-          wget -q https://git.pi-farm.de/pi-farm/templates/raw/branch/main/README.template -O README.template || echo "Warnung: README Template fehlt"
+              # 1. Authentifizierter Download der Templates via curl (-f bricht bei HTTP-Fehlern ab)
-          wget -q https://git.pi-farm.de/pi-farm/templates/raw/branch/main/docker-compose.template -O docker-compose.template || echo "Warnung: Compose Template fehlt"
+              TOKEN="${{ secrets.RUNNER_TOKEN }}"
+              curl -sSLf -H "Authorization: token $TOKEN" \
+                "https://git.pi-farm.de/pi-farm/templates/raw/branch/dev/README.template" \
+                -o README.template || echo "Warnung: README Template konnte nicht geladen werden"
+        
+              curl -sSLf -H "Authorization: token $TOKEN" \
+                "https://git.pi-farm.de/pi-farm/templates/raw/branch/dev/docker-compose.template" \
+                -o docker-compose.template || echo "Warnung: Compose Template konnte nicht geladen werden"
+        
+              # 2. Sicherheitsprüfung: Falls Gitea trotz -f eine HTML-Login-Seite ausgibt, Datei sofort verwerfen
+              for t_file in README.template docker-compose.template; do
+                if [ -f "$t_file" ] && grep -qi "<!DOCTYPE html>" "$t_file"; then
+                  echo "❌ FEHLER: $t_file ist eine HTML-Loginseite! Download verworfen."
+                  rm -f "$t_file"
+                fi
+              done
         
               NEW_ROW="| **$BUILD_TAG** | $CURRENT_TIME | $COMMIT_MSG ✅ |"
               if [ -f "VERSION.history" ]; then
@@ -269,38 +302,48 @@ jobs:
                 DOCKERHUB_LINK_CONTENT="[![Docker Hub](https://img.shields.io/badge/docker-hub-blue?logo=docker&logoColor=white)](https://hub.docker.com/r/${DH_USER}/${REPO_PURE})"
               fi
         
+              # Template-Verarbeitung via Python (verhindert awk-Abstürze bei Zeilenumbrüchen)
               process_template() {
                 local template=$1; local output=$2
                 [ ! -f "$template" ] && return
                 cp "$template" "$output"
         
-            sed -i "s|__REPO_NAME__|$REPO_PURE|g" "$output"
+                export REPO_PURE FULL_URL BUILD_TAG BASE_IMAGE ARM_STATUS CURRENT_TIME \
-            sed -i "s|__FULL_URL__|$FULL_URL|g" "$output"
+                       HISTORY_CONTENT DOCKERHUB_LINK_CONTENT ENV_BLOCK_CONTENT \
-            sed -i "s|__BUILD_TAG__|$BUILD_TAG|g" "$output"
+                       PORTS_BLOCK_CONTENT VOL_BLOCK_CONTENT DESCRIPTION
-            sed -i "s|__BASE_IMAGE__|$BASE_IMAGE|g" "$output"
-            sed -i "s|__ARM_STATUS__|$ARM_STATUS|g" "$output"
-            sed -i "s|__CURRENT_DATE__|$CURRENT_TIME|g" "$output"
         
-            awk -v r="$HISTORY_CONTENT" '{gsub(/__HISTORY_CONTENT__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
+                python3 -c '
-            awk -v r="$DOCKERHUB_LINK_CONTENT" '{gsub(/__DOCKERHUB_LINK__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
+            import os, sys
         
-            if grep -q "__DOCKER_RUN__" "$output" && [ -f "docker_run_block.txt" ]; then
+            output = sys.argv[1]
-               sed -e '/__DOCKER_RUN__/{r docker_run_block.txt' -e 'd;}' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
-            fi
         
-            if grep -q "__COMPOSE_BLOCK__" "$output" && [ -f "docker-compose.yml" ]; then
+            with open(output, "r", encoding="utf-8") as f:
-               sed -e '/__COMPOSE_BLOCK__/{r docker-compose.yml' -e 'd;}' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
+              content = f.read()
-            fi
         
-            if grep -q "__ENV_BLOCK__" "$output"; then
+            content = content.replace("__REPO_NAME__", os.environ.get("REPO_PURE", ""))
-               awk -v r="$(echo -e "$ENV_BLOCK_CONTENT")" '{gsub(/__ENV_BLOCK__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
+            content = content.replace("__FULL_URL__", os.environ.get("FULL_URL", ""))
-            fi
+            content = content.replace("__BUILD_TAG__", os.environ.get("BUILD_TAG", ""))
-            awk -v r="$(echo -e "$PORTS_BLOCK_CONTENT")" '{gsub(/__PORTS_BLOCK__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
+            content = content.replace("__BASE_IMAGE__", os.environ.get("BASE_IMAGE", ""))
-            awk -v r="$(echo -e "$VOL_BLOCK_CONTENT")" '{gsub(/__VOL_BLOCK__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
+            content = content.replace("__ARM_STATUS__", os.environ.get("ARM_STATUS", ""))
+            content = content.replace("__CURRENT_DATE__", os.environ.get("CURRENT_TIME", ""))
+            content = content.replace("__HISTORY_CONTENT__", os.environ.get("HISTORY_CONTENT", ""))
+            content = content.replace("__DOCKERHUB_LINK__", os.environ.get("DOCKERHUB_LINK_CONTENT", ""))
+            content = content.replace("__ENV_BLOCK__", os.environ.get("ENV_BLOCK_CONTENT", "").replace("\\n", "\n"))
+            content = content.replace("__PORTS_BLOCK__", os.environ.get("PORTS_BLOCK_CONTENT", "").replace("\\n", "\n"))
+            content = content.replace("__VOL_BLOCK__", os.environ.get("VOL_BLOCK_CONTENT", "").replace("\\n", "\n"))
+            content = content.replace("__DESCRIPTION__", os.environ.get("DESCRIPTION", "Keine Beschreibung."))
             
-            if grep -q "__DESCRIPTION__" "$output"; then
+            if "__DOCKER_RUN__" in content and os.path.exists("docker_run_block.txt"):
-               awk -v r="$(echo -e "${DESCRIPTION:-Keine Beschreibung.}")" '{gsub(/__DESCRIPTION__/, r)}1' "$output" > "$output.tmp" && mv "$output.tmp" "$output"
+                with open("docker_run_block.txt", "r", encoding="utf-8") as f:
-            fi
+                    content = content.replace("__DOCKER_RUN__", f.read())
+            
+            if "__COMPOSE_BLOCK__" in content and os.path.exists("docker-compose.yml"):
+                with open("docker-compose.yml", "r", encoding="utf-8") as f:
+                    content = content.replace("__COMPOSE_BLOCK__", f.read())
+            
+            with open(output, "w", encoding="utf-8") as f:
+                f.write(content)
+            ' "$output"
                   }
             
                   process_template "docker-compose.template" "docker-compose.yml"