release: 1.1.0

.gitea/workflows/docker-builder.yml

@@ -64,21 +64,30 @@ jobs:
           fi
 
       - name: Detect version
+        id: detect_version
         run: |
+          echo "== Detect version =="
+          # Prüfen, ob wir auf einem Tag oder main-Branch sind
           if [ "$GITHUB_REF_TYPE" = "tag" ]; then
             VERSION="$GITHUB_REF_NAME"
-            CLEAN_VERSION="${VERSION#v}"
+            CLEAN_VERSION="${VERSION#v}"  # entfernt führendes 'v'
             IS_TAG=true
           else
-            VERSION="edge"
-            CLEAN_VERSION="edge"
+            VERSION="main"
+            CLEAN_VERSION="main"
             IS_TAG=false
           fi
 
+          echo "VERSION=$VERSION"
+          echo "CLEAN_VERSION=$CLEAN_VERSION"
+          echo "IS_TAG=$IS_TAG"
+
+          # Env für alle weiteren Steps exportieren
           echo "VERSION=$VERSION" >> $GITHUB_ENV
           echo "CLEAN_VERSION=$CLEAN_VERSION" >> $GITHUB_ENV
           echo "IS_TAG=$IS_TAG" >> $GITHUB_ENV
 
+
       - name: Set dynamic variables and check Dockerfiles
         id: check_files
         run: |
@@ -120,20 +129,13 @@ jobs:
 
       - name: Compute Docker tags
         run: |
-          TAGS="${IMAGE_NAME}:${VERSION}"
-
           if [[ "$IS_TAG" == "true" ]]; then
-            MAJOR=$(echo $CLEAN_VERSION | cut -d. -f1)
-            MINOR=$(echo $CLEAN_VERSION | cut -d. -f1,2)
-
-            TAGS="$TAGS,${IMAGE_NAME}:${MINOR}"
-            TAGS="$TAGS,${IMAGE_NAME}:${MAJOR}"
-            TAGS="$TAGS,${IMAGE_NAME}:latest"
+            DOCKER_TAGS="${IMAGE_NAME}:${VERSION},${IMAGE_NAME}:latest"
           else
-            TAGS="$TAGS,${IMAGE_NAME}:main"
+            DOCKER_TAGS="${IMAGE_NAME}:main"
           fi
 
-          echo "DOCKER_TAGS=$TAGS" >> $GITEA_ENV
+          echo "DOCKER_TAGS=$DOCKER_TAGS" >> $GITEA_ENV
 
       - name: Load versions.env safely
         shell: bash
@@ -153,7 +155,6 @@ jobs:
           parse_env
 
           # Fixen von Workflow-Variablen
-          VERSION="$GITHUB_REF_NAME"
           CLEAN_VERSION="${VERSION#v}"
           BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
 
@@ -208,10 +209,11 @@ jobs:
             -t ${CACHE_IMAGE_NAME}:${VERSION}-arm64 \
             --push .
 
-          docker buildx imagetools create \
-            -t ${IMAGE_NAME}:${VERSION} \
-            ${CACHE_IMAGE_NAME}:${VERSION}-amd64 \
-            ${CACHE_IMAGE_NAME}:${VERSION}-arm64
+          for TAG in $(echo $DOCKER_TAGS | tr ',' ' '); do
+            docker buildx imagetools create -t $TAG \
+              ${CACHE_IMAGE_NAME}:${VERSION}-amd64 \
+              ${CACHE_IMAGE_NAME}:${VERSION}-arm64
+          done
 
           echo "== Multiarch Build Complete =="
 
@@ -224,7 +226,15 @@ jobs:
 
       - name: Generate SBOM
         run: |
-          syft ${IMAGE_NAME}:${VERSION} -o spdx-json > sbom.spdx.json
+          # Benutze die Build-Variable DOCKER_TAGS oder IMAGE_NAME + VERSION
+          if [[ "$IS_TAG" == "true" ]]; then
+            TARGET_IMAGE="${IMAGE_NAME}:${VERSION}"
+          else
+            TARGET_IMAGE="${IMAGE_NAME}:main"
+          fi
+
+          echo "Generating SBOM for $TARGET_IMAGE"
+          syft $TARGET_IMAGE -o spdx-json > sbom.spdx.json || true
       
       - name: Upload SBOM
         uses: actions/upload-artifact@v3
@@ -233,14 +243,29 @@ jobs:
           path: sbom.spdx.json
           
       - name: Install cosign
+        shell: bash
         run: |
           curl -sSfL https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 \
-            -o /usr/local/bin/cosign
-          chmod +x /usr/local/bin/cosign
-      
+            -o cosign
+          chmod +x cosign
+          mv cosign /usr/local/bin/
+          cosign version
+
       - name: Sign image
-        if: env.IS_TAG == 'true'
+        shell: bash
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+          # Diese Variable ist der wichtigste Hebel:
+          COSIGN_SKIP_REKOR_UPLOAD: "true"
+          COSIGN_REPOSITORY: ${{ env.REGISTRY_HOST }}/${{ env.IMAGE_BASE }}/signatures
         run: |
-          cosign sign --key ${{ secrets.COSIGN_KEY }} ${IMAGE_NAME}:${VERSION}
-
+          echo "$COSIGN_PRIVATE_KEY" > cosign.key
+          
+          # Wir lassen NUR NOCH die absolut notwendigen Flags stehen.
+          # Keine Erwähnung von tlog oder configs mehr.
+          cosign sign --yes --key cosign.key \
+            --registry-referrers-mode legacy \
+            "${REGISTRY_HOST}/${IMAGE_BASE}:main"
 
+          rm -f cosign.key

.gitea/workflows/promote.yml

@@ -1,35 +0,0 @@
-name: Promote Edge To Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-env:
-  REGISTRY_HOST: git.pi-farm.de
-  IMAGE_BASE: ${{ gitea.repository }}
-
-jobs:
-  promote:
-    runs-on: buildx-multiarch
-
-    steps:
-      - name: Extract version
-        run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-          echo "VERSION=$VERSION" >> $GITEA_ENV
-          echo "IMAGE=${REGISTRY_HOST}/${IMAGE_BASE}" >> $GITEA_ENV
-
-      - name: Login registry
-        run: |
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login \
-            ${{ env.REGISTRY_HOST }} -u ${{ secrets.REGISTRY_USER }} --password-stdin
-
-      - name: Promote edge image
-        run: |
-          docker buildx imagetools create \
-            -t ${IMAGE}:v${VERSION} \
-            -t ${IMAGE}:${VERSION%.*} \
-            -t ${IMAGE}:${VERSION%%.*} \
-            -t ${IMAGE}:latest \
-            ${IMAGE}:edge

CHANGELOG.md

@@ -0,0 +1,271 @@
+## 1.1.0 - 2026-02-10
+- neuer fix
+- fix signature-tags
+- release: 1.2.0
+- fix signature-tags
+- release: 1.1.0
+- fix
+- fix
+- fix cosign
+- new cosign fix
+- fix cosign
+- cosign experimental=1
+- fix cosign sha256-tags
+- release: 1.1.0
+- fix sign error
+- release: 1.1.0
+- fix cosign failure
+- release: 1.1.0
+- fix sign key
+- release: 1.1.0
+- fix cosign key
+- release: 1.1.0
+- fix sign step
+- fix again
+- release: 1.1.0
+- fix signing step
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix sign-step
+- release: 1.1.0
+- fix sign-step for version-tags
+- release: 1.3.0
+- fix SBOM
+- siplify workflow
+- release: 1.1.0
+- fix release.sh
+- release: 1.2.0
+- rebuild release.sh
+## 1.2.0 - 2026-02-10
+- fix signature-tags
+## 1.1.0 - 2026-02-10
+- fix
+- fix
+- fix cosign
+- new cosign fix
+- fix cosign
+- cosign experimental=1
+- fix cosign sha256-tags
+- release: 1.1.0
+- fix sign error
+- release: 1.1.0
+- fix cosign failure
+- release: 1.1.0
+- fix sign key
+- release: 1.1.0
+- fix cosign key
+- release: 1.1.0
+- fix sign step
+- fix again
+- release: 1.1.0
+- fix signing step
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix sign-step
+- release: 1.1.0
+- fix sign-step for version-tags
+- release: 1.3.0
+- fix SBOM
+- siplify workflow
+- release: 1.1.0
+- fix release.sh
+- release: 1.2.0
+- rebuild release.sh
+## 1.1.0 - 2026-02-09
+- fix sign error
+- release: 1.1.0
+- fix cosign failure
+- release: 1.1.0
+- fix sign key
+- release: 1.1.0
+- fix cosign key
+- release: 1.1.0
+- fix sign step
+- fix again
+- release: 1.1.0
+- fix signing step
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix sign-step
+- release: 1.1.0
+- fix sign-step for version-tags
+- release: 1.3.0
+- fix SBOM
+- siplify workflow
+- release: 1.1.0
+- fix release.sh
+- release: 1.2.0
+- rebuild release.sh
+## 1.1.0 - 2026-02-09
+- fix cosign failure
+- release: 1.1.0
+- fix sign key
+- release: 1.1.0
+- fix cosign key
+- release: 1.1.0
+- fix sign step
+- fix again
+- release: 1.1.0
+- fix signing step
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix sign-step
+- release: 1.1.0
+- fix sign-step for version-tags
+- release: 1.3.0
+- fix SBOM
+- siplify workflow
+- release: 1.1.0
+- fix release.sh
+- release: 1.2.0
+- rebuild release.sh
+## 1.1.0 - 2026-02-09
+- fix sign key
+- release: 1.1.0
+- fix cosign key
+- release: 1.1.0
+- fix sign step
+- fix again
+- release: 1.1.0
+- fix signing step
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix sign-step
+- release: 1.1.0
+- fix sign-step for version-tags
+- release: 1.3.0
+- fix SBOM
+- siplify workflow
+- release: 1.1.0
+- fix release.sh
+- release: 1.2.0
+- rebuild release.sh
+## 1.1.0 - 2026-02-09
+- fix cosign key
+- release: 1.1.0
+- fix sign step
+- fix again
+- release: 1.1.0
+- fix signing step
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix sign-step
+- release: 1.1.0
+- fix sign-step for version-tags
+- release: 1.3.0
+- fix SBOM
+- siplify workflow
+- release: 1.1.0
+- fix release.sh
+- release: 1.2.0
+- rebuild release.sh
+## 1.1.0 - 2026-02-09
+- fix sign step
+- fix again
+- release: 1.1.0
+- fix signing step
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix sign-step
+- release: 1.1.0
+- fix sign-step for version-tags
+- release: 1.3.0
+- fix SBOM
+- siplify workflow
+- release: 1.1.0
+- fix release.sh
+- release: 1.2.0
+- rebuild release.sh
+## 1.1.0 - 2026-02-09
+- fix signing step
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix sign-step
+- release: 1.1.0
+- fix sign-step for version-tags
+- release: 1.3.0
+- fix SBOM
+- siplify workflow
+- release: 1.1.0
+- fix release.sh
+- release: 1.2.0
+- rebuild release.sh
+## 1.1.0 - 2026-02-09
+- fix signing
+- release: 1.1.0
+- fix signing
+- release: 1.1.0
+- fix sign-step
+- release: 1.1.0
+- fix sign-step for version-tags
+- release: 1.3.0
+- fix SBOM
+- siplify workflow
+- release: 1.1.0
+- fix release.sh
+- release: 1.2.0
+- rebuild release.sh
+## 1.1.0 - 2026-02-09
+- fix signing
+- release: 1.1.0
+- fix sign-step
+- release: 1.1.0
+- fix sign-step for version-tags
+- release: 1.3.0
+- fix SBOM
+- siplify workflow
+- release: 1.1.0
+- fix release.sh
+- release: 1.2.0
+- rebuild release.sh
+## 1.1.0 - 2026-02-09
+- fix sign-step
+- release: 1.1.0
+- fix sign-step for version-tags
+- release: 1.3.0
+- fix SBOM
+- siplify workflow
+- release: 1.1.0
+- fix release.sh
+- release: 1.2.0
+- rebuild release.sh
+## 1.1.0 - 2026-02-09
+- fix sign-step for version-tags
+- release: 1.3.0
+- fix SBOM
+- siplify workflow
+- release: 1.1.0
+- fix release.sh
+- release: 1.2.0
+- rebuild release.sh
+## 1.3.0 - 2026-02-09
+- fix SBOM
+- siplify workflow
+## 1.1.0 - 2026-02-09
+- fix release.sh
+## 1.2.0 - 2026-02-09
+- rebuild release.sh

release.sh

@@ -4,143 +4,84 @@ set -e
 VERSION="$1"
 
 if [ -z "$VERSION" ]; then
-  echo "Usage: ./release.sh <semver>"
-  echo "Example: ./release.sh 1.4.0"
-  exit 1
+echo "Usage: ./release.sh <semver>"
+exit 1
 fi
 
-# -----------------------------
-# SemVer validation
-# -----------------------------
-if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-  echo "Version must be SemVer: X.Y.Z"
-  exit 1
+if ! [[ "$VERSION" =~ ^[0-9]+.[0-9]+.[0-9]+$ ]]; then
+echo "Version must be SemVer: X.Y.Z"
+exit 1
 fi
 
 TAG="v$VERSION"
 
 echo "=== Release $TAG ==="
 
-# -----------------------------
-# Branch check
-# -----------------------------
+sedi() {
+if sed --version >/dev/null 2>&1; then
+sed -i "$@"
+else
+sed -i '' "$@"
+fi
+}
+
 BRANCH=$(git rev-parse --abbrev-ref HEAD)
-if [ "$BRANCH" != "main" ]; then
-  echo "Not on main branch"
-  exit 1
-fi
+[ "$BRANCH" = "main" ] || { echo "Not on main"; exit 1; }
 
-# -----------------------------
-# Working tree clean?
-# -----------------------------
-if ! git diff --quiet; then
-  echo "Working tree not clean — commit first"
-  exit 1
-fi
+git diff --quiet || { echo "Working tree not clean"; exit 1; }
 
-# -----------------------------
-# Sync with remote
-# -----------------------------
 git fetch origin
 
 LOCAL=$(git rev-parse main)
 REMOTE=$(git rev-parse origin/main)
 
-if [ "$LOCAL" != "$REMOTE" ]; then
-  echo "Local main not in sync with origin/main"
-  exit 1
-fi
+[ "$LOCAL" = "$REMOTE" ] || { echo "main not in sync"; exit 1; }
 
-# -----------------------------
-# Tag already exists?
-# -----------------------------
-if git rev-parse "$TAG" >/dev/null 2>&1; then
-  echo "Tag already exists locally"
-  exit 1
-fi
+git rev-parse "$TAG" >/dev/null 2>&1 && { echo "Tag exists locally"; exit 1; }
+git ls-remote --tags origin | grep -q "refs/tags/$TAG" && { echo "Tag exists remote"; exit 1; }
 
-if git ls-remote --tags origin | grep -q "$TAG"; then
-  echo "Tag already exists on remote"
-  exit 1
-fi
+[ -f versions.env ] || { echo "versions.env missing"; exit 1; }
 
-# -----------------------------
-# Update versions.env
-# -----------------------------
 echo "Updating versions.env"
 
 if grep -q "^APP_VERSION=" versions.env; then
-  sed -i "s/^APP_VERSION=.*/APP_VERSION=${VERSION}/" versions.env
+sedi "s/^APP_VERSION=.*/APP_VERSION=$VERSION/" versions.env
 else
-  echo "APP_VERSION=${VERSION}" >> versions.env
+echo "APP_VERSION=$VERSION" >> versions.env
 fi
 
-# -----------------------------
-# Optional changelog entry
-# -----------------------------
 if [ -f CHANGELOG.md ]; then
-  echo "Updating CHANGELOG.md"
-  DATE=$(date +%Y-%m-%d)
-  sed -i "1i ## $VERSION - $DATE\n- release\n" CHANGELOG.md
-  git add CHANGELOG.md
-fi
-
-LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+echo "Updating CHANGELOG.md"
+LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)
 
 if [ -n "$LAST_TAG" ]; then
-  echo "Generating release notes from $LAST_TAG → HEAD"
-  git log $LAST_TAG..HEAD --pretty=format:"- %s" > RELEASE_NOTES.tmp
+git log $LAST_TAG..HEAD --pretty=format:"- %s" > NOTES.tmp
 else
-  git log --pretty=format:"- %s" > RELEASE_NOTES.tmp
+git log --pretty=format:"- %s" > NOTES.tmp
 fi
 
-echo -e "\n## $VERSION\n" | cat - RELEASE_NOTES.tmp >> CHANGELOG.md
-rm RELEASE_NOTES.tmp
+DATE=$(date +%Y-%m-%d)
+
+{
+echo "## $VERSION - $DATE"
+cat NOTES.tmp
+echo
+cat CHANGELOG.md
+} > CHANGELOG.new
+
+mv CHANGELOG.new CHANGELOG.md
+rm NOTES.tmp
+git add CHANGELOG.md
+fi
 
-# -----------------------------
-# Commit version bump
-# -----------------------------
 git add versions.env
 git commit -m "release: $VERSION"
 
-# -----------------------------
-# Push main → triggers edge build
-# -----------------------------
 git push origin main
+echo "Main pushed → edge build"
 
-echo "Main pushed — edge build will run"
-
-# -----------------------------
-# Create annotated tag
-# -----------------------------
 git tag -a "$TAG" -m "Release $TAG"
-
-# -----------------------------
-# Push tag → triggers release build
-# -----------------------------
 git push origin "$TAG"
 
-echo "Tag pushed — release build triggered"
-
-# -----------------------------
-# Optional: wait for CI success
-# -----------------------------
-if [ -n "$GITEA_TOKEN" ]; then
-  echo "Checking CI status..."
-
-  REPO=$(git config --get remote.origin.url | sed 's#.*/##; s/.git$//')
-  OWNER=$(git config --get remote.origin.url | awk -F'[:/]' '{print $(NF-1)}')
-
-  for i in {1..30}; do
-    STATUS=$(curl -s \
-      -H "Authorization: token $GITEA_TOKEN" \
-      "https://git.pi-farm.de/api/v1/repos/$OWNER/$REPO/actions/runs?event=push" \
-      | jq -r '.workflow_runs[0].status')
-
-    echo "CI status: $STATUS"
-    [ "$STATUS" = "success" ] && break
-    sleep 5
-  done
-fi
-
+echo "Tag pushed → release build"
 echo "=== Release complete ==="

versions.env

@@ -1,5 +1,5 @@
 APP_NAME=test2
-APP_VERSION=3.22
+APP_VERSION=1.1.0
 APP_DESCRIPTION=Watchdog for notify on updates on dockerhub, github and other git-sources
 
 BASE_IMAGE=alpine:3.22