Removes helper image and adds logic back to RHEL image

Author: bthomee

.github/workflows/rhel-ubi.yml

@@ -42,8 +42,10 @@ jobs:
         architecture:
           - platform: linux/amd64
             runner: ubuntu-24.04
+            name: x86_64
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
+            name: aarch64
         os:
           - release: 8
             compiler_name: gcc
@@ -122,6 +124,7 @@ jobs:
             GCOVR_VERSION=${{ env.GCOVR_VERSION }}
             CMAKE_VERSION=${{ env.CMAKE_VERSION }}
             MOLD_VERSION=${{ env.MOLD_VERSION }}
+            RHEL_ARCH=${{ matrix.architecture.name }}
             RHEL_VERSION=${{ matrix.os.release }}
           context: .
           file: docker/rhel/Dockerfile
@@ -130,6 +133,9 @@ jobs:
           provenance: mode=max
           push: ${{ env.PUSH }}
           sbom: true
+          secrets: |
+            "RHEL_KEY=${{ secrets.RHEL_KEY }}"
+            "RHEL_ORG=${{ secrets.RHEL_ORG }}"
           labels: ${{ steps.meta.outputs.labels }}
           target: ${{ matrix.os.compiler_name }}
       - name: Export digest

.github/workflows/rhel.yml

@@ -1,15 +1,24 @@
 # ====================== BASE IMAGE ======================
-ARG RHEL_VERSION
-FROM ghcr.io/xrplf/ci/rhel-${RHEL_VERSION}:ubi AS base
 
-# This is not inherited from the base image.
 ARG RHEL_VERSION
+FROM registry.access.redhat.com/ubi${RHEL_VERSION}/ubi:latest AS base
 
 # Use Bash as the default shell for RUN commands, using the options
 # `set -o errexit -o pipefail`, and as the entrypoint.
 SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
 ENTRYPOINT ["/bin/bash"]
 
+# This is not inherited from the base image.
+ARG RHEL_VERSION
+
+# Enable the repository containing packages we need that are missing from the
+# UBI image. The RHEL architecture should be either 'x86_64' or 'aarch64'.
+ARG RHEL_ARCH
+RUN --mount=type=secret,id=RHEL_KEY,env=RHEL_KEY \
+    --mount=type=secret,id=RHEL_ORG,env=RHEL_ORG \
+    subscription-manager register --activationkey="${RHEL_KEY}" --org="${RHEL_ORG}" && \
+    subscription-manager repos --enable=rhel-${RHEL_VERSION}-for-${RHEL_ARCH}-appstream-rpms
+
 # Install tools that are shared by all stages.
 RUN <<EOF
 pkgs=()
@@ -50,6 +59,10 @@ dnf clean -y all
 rm -rf /var/cache/dnf/*
 EOF
 
+# Unregister from the subscription manager to avoid the credentials to be used \
+# by consumers of this image.
+RUN subscription-manager unregister && subscription-manager clean
+
 # Add symlinks to point to the latest Python versions. The /usr/local/bin
 # directory is in the PATH before the /usr/bin directory, so the new Python
 # versions will be used by default.