From 46b7509c37d92b50f5710f84ddccc2862daacf8e Mon Sep 17 00:00:00 2001
From: Stefan Bethke <stb@lassitu.de>
Date: Sun, 15 Nov 2026 11:57:18 +0100
Subject: [PATCH] chore: Reverts workflow changes

The image build workflow is handled separately in the kaniko-build branch;
this pull request no longer changes it.
---
 .forgejo/workflows/images.yml | 98 +++++++++++++----------------------
 1 file changed, 35 insertions(+), 63 deletions(-)

diff --git a/.forgejo/workflows/images.yml b/.forgejo/workflows/images.yml
index 30a037b..0306fee 100644
--- a/.forgejo/workflows/images.yml
+++ b/.forgejo/workflows/images.yml
@@ -4,82 +4,54 @@ on:
   push:
   workflow_dispatch:
 
-# Images are only published for pushes to the main branch. All other refs (branches,
-# renovate branches, tags) are built, but never pushed, and do not get registry credentials.
-#
-# Note: a workflow run for a pushed ref uses the workflow file from that ref, so this
-# condition alone does not stop someone with push access from publishing images. The
-# registry credentials must additionally be restricted to the protected main branch.
-
-env:
-  IMAGE_PREFIX: git.hamburg.ccc.de/ccchh/sunders
-
 jobs:
   build:
-    runs-on: docker
-    container:
-      image: ghcr.io/osscontainertools/kaniko:alpine
+    runs-on: windows-2022
     steps:
-      - name: Install required system packages
-        run: apk add --no-cache nodejs git
-
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Login to Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: git.hamburg.ccc.de
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      
       - name: Set image tags
         id: vars
-        env:
-          COMMIT_SHA: ${{ forgejo.sha }}
-          PUBLISH: ${{ forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main' }}
         run: |
-          if [ "$PUBLISH" = "true" ]; then
-            echo "publish=true" >> "$GITHUB_OUTPUT"
-            echo "tag=latest" >> "$GITHUB_OUTPUT"
+          if [ "${{ github.ref_name }}" = "main" ] && [ "${{ github.event_name }}" = "push" ]; then
+            echo "tag=latest" >> $GITHUB_OUTPUT
           else
-            echo "publish=false" >> "$GITHUB_OUTPUT"
-            # Never derive tags from ref names: they are attacker-controlled and may collide with `latest`.
-            echo "tag=ci-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
+            # renovate creates sub branches with `/`; these break the tagging in the build process
+            echo tag=$(echo "${{ github.ref_name }}" | sed 's/[^a-zA-Z0-9._-]/_/g') >> $GITHUB_OUTPUT
           fi
-          echo "sha_tag=sha-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
 
       - name: Build web image
-        env:
-          IMAGE: web
-          PUBLISH: ${{ steps.vars.outputs.publish }}
-          TAG: ${{ steps.vars.outputs.tag }}
-          SHA_TAG: ${{ steps.vars.outputs.sha_tag }}
-          KANIKO_GIT_HAMBURG_CCC_DE_USER: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_USERNAME || '' }}
-          KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_TOKEN || '' }}
         run: |
-          if [ "$PUBLISH" = "true" ]; then
-            set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --destination="$IMAGE_PREFIX/$IMAGE:$SHA_TAG"
-          else
-            set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --no-push
-          fi
-          /kaniko/executor \
-            --dockerfile="$GITHUB_WORKSPACE/$IMAGE/Containerfile" \
-            --context="dir://$GITHUB_WORKSPACE/$IMAGE" \
-            --no-push-cache \
-            --credential-helpers=env \
-            "$@"
+          docker buildx build -f ./Containerfile -t git.hamburg.ccc.de/ccchh/sunders/web:${{ steps.vars.outputs.tag }} --load .
+        working-directory: ./web
 
       - name: Build data_handler image
-        env:
-          IMAGE: data_handler
-          PUBLISH: ${{ steps.vars.outputs.publish }}
-          TAG: ${{ steps.vars.outputs.tag }}
-          SHA_TAG: ${{ steps.vars.outputs.sha_tag }}
-          KANIKO_GIT_HAMBURG_CCC_DE_USER: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_USERNAME || '' }}
-          KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_TOKEN || '' }}
         run: |
-          if [ "$PUBLISH" = "true" ]; then
-            set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --destination="$IMAGE_PREFIX/$IMAGE:$SHA_TAG"
-          else
-            set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --no-push
-          fi
-          /kaniko/executor \
-            --dockerfile="$GITHUB_WORKSPACE/$IMAGE/Containerfile" \
-            --context="dir://$GITHUB_WORKSPACE/$IMAGE" \
-            --no-push-cache \
-            --credential-helpers=env \
-            "$@"
+          docker buildx build -f ./Containerfile -t git.hamburg.ccc.de/ccchh/sunders/data_handler:${{ steps.vars.outputs.tag }} --load .
+        working-directory: ./data_handler
+
+      - name: Push images to Container Registry
+        run: |
+          docker push git.hamburg.ccc.de/ccchh/sunders/web:${{ steps.vars.outputs.tag }}
+          docker push git.hamburg.ccc.de/ccchh/sunders/data_handler:${{ steps.vars.outputs.tag }}
+        if: github.event_name == 'push'
+
+      - name: Update docker-compose.yml image tags
+        run: |
+          sed -i "s/:latest/:${{ steps.vars.outputs.tag }}/g" docker-compose.yml
+
+      - name: Start Docker Compose services
+        run: |
+          docker compose up -d --wait
+          docker compose down 
\ No newline at end of file