Pull from ghcr.io explicitly

Author: lzap

.github/workflows/rhel.yml

@@ -110,6 +110,7 @@ jobs:
             --security-opt label=disable --security-opt seccomp=unconfined \
             -e "RHSM_ORG=$RHSM_ORG" -e "RHSM_ACTIVATIONKEY=$RHSM_ACTIVATIONKEY" \
             -e "RHSM_USERNAME=$RHSM_USERNAME" -e "RHSM_PASSWORD=$RHSM_PASSWORD" \
+            -e "REPO_USERNAME=$REPO_USERNAME" -e "REPO_PASSWORD=$REPO_PASSWORD" \
             -e "CACHE_IMAGE=$CACHE_IMAGE" -e "CACHE_USERNAME=$CACHE_USERNAME" -e "CACHE_PASSWORD=$CACHE_PASSWORD" \
             -e "STORAGE_DRIVER=$STORAGE_DRIVER" -e "STORAGE_OPTS=$STORAGE_OPTS" -e "BUILDAH_ISOLATION=$BUILDAH_ISOLATION" \
             -e "DRY_RUN=$DRY_RUN" \

build-and-push.sh

@@ -18,9 +18,6 @@ export TO_REGISTRY
 
 . ./login.sh
 
-if [ -n "${USE_CACHE:-}" ]; then
-  CACHE_ARGS="--cache-from 'docker://$CACHE_IMAGE' --cache-to 'docker://$CACHE_IMAGE'"
-fi
 buildah rmi "$IMAGE" 2>/dev/null || true
 
 FROM_REF="${FROM_IMAGE}:${FROM_TAG}"
@@ -29,15 +26,28 @@ cp "Containerfile.comment" "Containerfile"
 echo "FROM ${FROM_REF}" >> "Containerfile"
 tail -n +2 "Containerfile.${CONTAINERFILE}" >> "Containerfile"
 
+if [ -n "${USE_CACHE:-}" ]; then
+  CACHE_REF="${CACHE_IMAGE}:${TO_TAG}-${ARCH}"
+  echo "Using cache $CACHE_REF"
+  time buildah pull "$CACHE_REF" || true
+  time buildah pull "$FROM_REF"
+fi
+
 echo "Building $IMAGE"
-buildah build --layers $CACHE_ARGS --arch="$ARCH" \
+time buildah build --layers --arch="$ARCH" \
   --build-arg CONTAINERFILE="Containerfile" \
   --from "${FROM_REF}" \
-  -f "Containerfile.${CONTAINERFILE}" \
+  -f "Containerfile" \
   -t "$IMAGE" .
 
 if [ -z "${DRY_RUN:-}" ] && [ -n "${REPO_USERNAME:-}" ] && [ -n "${REPO_PASSWORD:-}" ]; then
   buildah push "$IMAGE"
 else
   echo "Push skipped: DRY_RUN is set or REPO_USERNAME or REPO_PASSWORD missing"
 fi
+
+if [ -z "${DRY_RUN:-}" ] && [ -n "${USE_CACHE:-}" ]; then
+  buildah push "$IMAGE" "$CACHE_REF"
+elif [ -n "${DRY_RUN:-}" ] && [ -n "${USE_CACHE:-}" ]; then
+  echo "Push to cache skipped: DRY_RUN is set"
+fi

generate-manifests.sh

@@ -23,7 +23,7 @@ buildah manifest create "$IMAGE:$TAG"
 for arch in $ARCHES; do
   if [ -n "${USE_CACHE:-}" ]; then
     echo "Pulling $CACHE_IMAGE:$TAG-$arch from cache"
-    buildah pull "docker://$CACHE_IMAGE:$TAG-$arch" 2>/dev/null || true
+    buildah pull "docker://$CACHE_IMAGE:$TAG-$arch" || true
   fi
 
   if [ -n "${REPO_USERNAME:-}" ] && [ -n "${REPO_PASSWORD:-}" ]; then

login.sh

@@ -4,7 +4,7 @@ set -xeuo pipefail
 if [ -n "${REPO_USERNAME:-}" ] && [ -n "${REPO_PASSWORD:-}" ]; then
   echo "Logging in to $TO_REGISTRY"
   echo "$REPO_PASSWORD" | buildah login -u "$REPO_USERNAME" --password-stdin "$TO_REGISTRY"
-elif [ -n "${AWS_REGION:-}" ] && [ -n "${AWS_ACCESS_KEY_ID:-}" ] && [ -n "${AWS_SECRET_ACCESS_KEY:-}" ]; then
+elif [ -n "${AWS_REGION:-}" ] && [ -n "${AWS_ACCESS_KEY_ID:-}" ] && [ -n "${AWS_SECRET_ACCESS_KEY:-}" ] && [ -n "${ECR_URL:-}" ]; then
   # Let's assume the ECR_URL from app-interface Vault is in fact not URL but hostname
   echo "Logging in to $ECR_URL"
   aws ecr get-login-password --region "$AWS_REGION" | buildah login --username AWS --password-stdin "$ECR_URL"