refactor(ci): use buildah binary instead of external actions

Author: aardbol

.github/workflows/_reusable-build.yaml

@@ -15,6 +15,7 @@ on:
 
 env:
   REGISTRY: ghcr.io
+  GO_VERSION: '1.26.5'
 
 permissions:
   contents: read
@@ -31,39 +32,52 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.checkout_ref || github.ref }}
+          fetch-depth: 0
 
-      - name: Log in to GHCR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Log in to GHCR
+        uses: ./.github/actions/ghcr-login
+
+      - name: Compute build metadata
+        id: meta
+        run: |
+          VERSION=$(git describe --tags)
+          COMMIT=$(git log --format="%h" -n 1)
+          TREE_STATE=$(git diff --quiet && echo 'clean' || echo 'dirty')
+          IMAGE="${{ env.REGISTRY }}/${{ github.repository }}${{ inputs.image_suffix }}"
+          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
+          echo "commit=${COMMIT}" >> "${GITHUB_OUTPUT}"
+          echo "tree_state=${TREE_STATE}" >> "${GITHUB_OUTPUT}"
+          echo "image=${IMAGE}" >> "${GITHUB_OUTPUT}"
 
       - name: Build image
         id: build-image
-        uses: aardbol/buildah-build@14762338941c54f8835374e1844663c745dadb2a # v3.0.3
-        with:
-          image: ${{ github.repository }}${{ inputs.image_suffix }}
-          tags: ${{ inputs.tags }}
-          context: .
-          containerfiles: cmd/upcloud-csi-plugin/Containerfile
-          platforms: linux/amd64
-          extra-args: --pull=always
+        env:
+          VERSION: ${{ steps.meta.outputs.version }}
+          COMMIT: ${{ steps.meta.outputs.commit }}
+          TREE_STATE: ${{ steps.meta.outputs.tree_state }}
+          IMAGE: ${{ steps.meta.outputs.image }}
+          IMAGE_TAG: ${{ inputs.tags }}
+        run: ./build-image.sh
 
       - name: Push image
         id: push-image
-        uses: aardbol-actions/push-to-registry@5402e3869fc3a6b2c0de9f078dbfe87f82f2fe76 # v3.0.3
-        with:
-          image: ${{ steps.build-image.outputs.image }}
-          tags: ${{ inputs.tags }}
-          registry: ${{ env.REGISTRY }}
+        run: |
+          DIGESTFILE=$(mktemp)
+          buildah push --digestfile "${DIGESTFILE}" \
+            "${{ steps.meta.outputs.image }}:${{ inputs.tags }}" \
+            "docker://${{ steps.meta.outputs.image }}:${{ inputs.tags }}"
+          echo "digest=$(cat "${DIGESTFILE}")" >> "${GITHUB_OUTPUT}"
 
       - name: Build summary
         run: |
           echo "## Container image" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
           echo "| Field | Value |" >> "$GITHUB_STEP_SUMMARY"
           echo "|---|---|" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Image | \`${{ steps.build-image.outputs.image }}\` |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Image | \`${{ steps.meta.outputs.image }}\` |" >> "$GITHUB_STEP_SUMMARY"
           echo "| Tags | \`${{ inputs.tags }}\` |" >> "$GITHUB_STEP_SUMMARY"
           echo "| Digest | \`${{ steps.push-image.outputs.digest }}\` |" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/trivy-scan.yaml

@@ -8,7 +8,7 @@ on:
       - "**/*.go"
       - go.mod
       - go.sum
-      - cmd/upcloud-csi-plugin/Containerfile
+      - build-image.sh
       - '.github/workflows/trivy-scan.yaml'
       - '.trivyignore.yaml'
   pull_request:
@@ -39,7 +39,7 @@ jobs:
               - '**/*.go'
               - go.mod
               - go.sum
-              - 'cmd/upcloud-csi-plugin/Containerfile'
+              - 'build-image.sh'
               - '.github/workflows/trivy-scan.yaml'
               - '.trivyignore.yaml'
 

AGENTS.md

@@ -5,7 +5,7 @@
 - Pin to a specific release like `ubuntu-24.04`. Never use `ubuntu-latest`.
 - Pin every action by commit SHA with a comment containing the readable version, e.g. `actions/checkout@df4cb1c0... # v6.0.3`.
 - Do NOT add install steps for tools that ship with the base image (`kubectl`, `docker`, `git`, `curl`, etc.). Check the [current image contents](https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md) before adding an install step.
-- Container builds use `buildah` via `redhat-actions/buildah-build` + `redhat-actions/push-to-registry`. Containerfile at `cmd/upcloud-csi-plugin/Containerfile`.
+- Container builds use `buildah` binary on runner image.
 
 ## Versioning and changelogs
 
@@ -18,7 +18,7 @@
 
 ## Go
 
-- Version: `1.26` (must match `go.mod` and Containerfile)
+- Version: `1.26` (must match `go.mod` and `build-image.sh`)
 - Test: `make test` runs `go vet ./... && go test -race ./...`
 - Lint: `golangci-lint` with config in `.golangci.yml`. Run via `cd test/e2e && golangci-lint run --timeout=2m ./testruns/` or pre-commit.
 

Makefile

@@ -1,19 +1,16 @@
 TAG ?= $(shell git describe --tags)
 COMMIT = $(shell git log --format="%h" -n 1)
 TREE_STATE = $(shell git diff --quiet && echo 'clean' || echo 'dirty')
+TARGETARCH ?= amd64
 
 CONTAINER_REPO ?= ghcr.io/upcloud-tools/upcloud-csi-test
 IMAGE_TAG ?= $(shell git rev-parse HEAD)
 
 
 .PHONY: container-build
 container-build:
-	buildah build --platform linux/amd64 \
-		--build-arg VERSION=$(TAG) \
-		--build-arg COMMIT=$(COMMIT) \
-		--build-arg TREE_STATE=$(TREE_STATE) \
-		-t $(CONTAINER_REPO):$(IMAGE_TAG) \
-		-f cmd/upcloud-csi-plugin/Containerfile .
+	TARGETARCH=$(TARGETARCH) VERSION=$(TAG) COMMIT=$(COMMIT) TREE_STATE=$(TREE_STATE) \
+	IMAGE=$(CONTAINER_REPO) IMAGE_TAG=$(IMAGE_TAG) ./build-image.sh
 
 .PHONY: push-image
 push-image: container-build

build-image.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION="${VERSION:-unknown}"
+COMMIT="${COMMIT:-unknown}"
+TREE_STATE="${TREE_STATE:-unknown}"
+TARGETARCH="${TARGETARCH:-amd64}"
+IMAGE="${IMAGE:-upcloud-csi}"
+IMAGE_TAG="${IMAGE_TAG:-latest}"
+
+ALPINE_VERSION="3.23.5"
+
+echo "Building ${IMAGE}:${IMAGE_TAG} (arch=${TARGETARCH}, version=${VERSION})"
+
+CGO_ENABLED=0 GOOS=linux GOARCH="${TARGETARCH}" \
+  go build -ldflags="-s -w \
+    -X github.com/upcloud-tools/upcloud-csi/internal/plugin.version=${VERSION} \
+    -X github.com/upcloud-tools/upcloud-csi/internal/plugin.commit=${COMMIT} \
+    -X github.com/upcloud-tools/upcloud-csi/internal/plugin.gitTreeState=${TREE_STATE}" \
+    -o upcloud-csi-plugin ./cmd/upcloud-csi-plugin
+
+CTR=$(buildah from docker.io/alpine:${ALPINE_VERSION})
+
+buildah run "${CTR}" -- apk add --no-cache \
+  ca-certificates \
+  cloud-utils-growpart \
+  e2fsprogs \
+  e2fsprogs-extra \
+  eudev \
+  nfs-utils \
+  parted \
+  util-linux \
+  xfsprogs \
+  xfsprogs-extra
+
+buildah copy "${CTR}" upcloud-csi-plugin /bin/upcloud-csi-plugin
+
+buildah config --os linux --arch "${TARGETARCH}" "${CTR}"
+buildah config --label "org.opencontainers.image.source=https://github.com/upcloud-tools/upcloud-csi" "${CTR}"
+buildah config --label "org.opencontainers.image.description=UpCloud CSI Driver" "${CTR}"
+buildah config --label "org.opencontainers.image.version=${VERSION}" "${CTR}"
+buildah config --entrypoint '["/bin/upcloud-csi-plugin"]' "${CTR}"
+
+buildah commit --format docker "${CTR}" "${IMAGE}:${IMAGE_TAG}"
+buildah rm "${CTR}"
+
+rm -f upcloud-csi-plugin
+
+echo "Built ${IMAGE}:${IMAGE_TAG}"