From 6ec1b9fc5a0c0fc3fa4825056abdea7245d60b7e Mon Sep 17 00:00:00 2001
From: Stefan Bethke <stb@lassitu.de>
Date: Sun, 15 Nov 2026 11:48:03 +0100
Subject: [PATCH] fix: Builds images with kaniko

There are no Windows runners; build the images with kaniko in a container
on the `docker` runner, as on the link-updates branch, while keeping the
publishing restrictions:

- only pushes to refs/heads/main publish, as `latest` and `sha-<commit>`
- other refs build with --no-push under a ci-<commit> tag
- registry credentials are only passed to the build when publishing

The docker compose smoke test is dropped, as there is no Docker daemon
inside the kaniko container.
---
 .forgejo/workflows/images.yml | 85 ++++++++++++++++++-----------------
 1 file changed, 43 insertions(+), 42 deletions(-)

diff --git a/.forgejo/workflows/images.yml b/.forgejo/workflows/images.yml
index 462bab2..30a037b 100644
--- a/.forgejo/workflows/images.yml
+++ b/.forgejo/workflows/images.yml
@@ -5,7 +5,7 @@ on:
   workflow_dispatch:
 
 # Images are only published for pushes to the main branch. All other refs (branches,
-# renovate branches, tags) are built and tested locally, but never pushed.
+# renovate branches, tags) are built, but never pushed, and do not get registry credentials.
 #
 # Note: a workflow run for a pushed ref uses the workflow file from that ref, so this
 # condition alone does not stop someone with push access from publishing images. The
@@ -16,23 +16,27 @@ env:
 
 jobs:
   build:
-    runs-on: windows-2022
+    runs-on: docker
+    container:
+      image: ghcr.io/osscontainertools/kaniko:alpine
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
+      - name: Install required system packages
+        run: apk add --no-cache nodejs git
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
       - name: Set image tags
         id: vars
         env:
-          COMMIT_SHA: ${{ github.sha }}
-          PUBLISH: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+          COMMIT_SHA: ${{ forgejo.sha }}
+          PUBLISH: ${{ forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main' }}
         run: |
           if [ "$PUBLISH" = "true" ]; then
+            echo "publish=true" >> "$GITHUB_OUTPUT"
             echo "tag=latest" >> "$GITHUB_OUTPUT"
           else
+            echo "publish=false" >> "$GITHUB_OUTPUT"
             # Never derive tags from ref names: they are attacker-controlled and may collide with `latest`.
             echo "tag=ci-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
           fi
@@ -40,45 +44,42 @@ jobs:
 
       - name: Build web image
         env:
+          IMAGE: web
+          PUBLISH: ${{ steps.vars.outputs.publish }}
           TAG: ${{ steps.vars.outputs.tag }}
+          SHA_TAG: ${{ steps.vars.outputs.sha_tag }}
+          KANIKO_GIT_HAMBURG_CCC_DE_USER: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_USERNAME || '' }}
+          KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_TOKEN || '' }}
         run: |
-          docker buildx build -f ./Containerfile -t "$IMAGE_PREFIX/web:$TAG" --load .
-        working-directory: ./web
+          if [ "$PUBLISH" = "true" ]; then
+            set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --destination="$IMAGE_PREFIX/$IMAGE:$SHA_TAG"
+          else
+            set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --no-push
+          fi
+          /kaniko/executor \
+            --dockerfile="$GITHUB_WORKSPACE/$IMAGE/Containerfile" \
+            --context="dir://$GITHUB_WORKSPACE/$IMAGE" \
+            --no-push-cache \
+            --credential-helpers=env \
+            "$@"
 
       - name: Build data_handler image
         env:
-          TAG: ${{ steps.vars.outputs.tag }}
-        run: |
-          docker buildx build -f ./Containerfile -t "$IMAGE_PREFIX/data_handler:$TAG" --load .
-        working-directory: ./data_handler
-
-      - name: Update docker-compose.yml image tags
-        env:
-          TAG: ${{ steps.vars.outputs.tag }}
-        run: |
-          sed -i "s/:latest/:${TAG}/g" docker-compose.yml
-
-      - name: Start Docker Compose services
-        run: |
-          docker compose up -d --wait
-          docker compose down
-
-      - name: Login to Container Registry
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: docker/login-action@v4
-        with:
-          registry: git.hamburg.ccc.de
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Push images to Container Registry
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        env:
+          IMAGE: data_handler
+          PUBLISH: ${{ steps.vars.outputs.publish }}
           TAG: ${{ steps.vars.outputs.tag }}
           SHA_TAG: ${{ steps.vars.outputs.sha_tag }}
+          KANIKO_GIT_HAMBURG_CCC_DE_USER: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_USERNAME || '' }}
+          KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_TOKEN || '' }}
         run: |
-          for image in web data_handler; do
-            docker tag "$IMAGE_PREFIX/$image:$TAG" "$IMAGE_PREFIX/$image:$SHA_TAG"
-            docker push "$IMAGE_PREFIX/$image:$TAG"
-            docker push "$IMAGE_PREFIX/$image:$SHA_TAG"
-          done
+          if [ "$PUBLISH" = "true" ]; then
+            set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --destination="$IMAGE_PREFIX/$IMAGE:$SHA_TAG"
+          else
+            set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --no-push
+          fi
+          /kaniko/executor \
+            --dockerfile="$GITHUB_WORKSPACE/$IMAGE/Containerfile" \
+            --context="dir://$GITHUB_WORKSPACE/$IMAGE" \
+            --no-push-cache \
+            --credential-helpers=env \
+            "$@"