REFACTOR(ci): migrate from Kaniko to Buildah

- Replace Kaniko with Buildah for OCI-native builds
- Add --format oci flag for Zot compatibility
- Use privileged container for Buildah operations

.gitea/workflows/build-push.yaml

@@ -15,8 +15,8 @@ jobs:
     steps:
       - name: Create Build Job
         run: |
-          JOB_NAME="kaniko-jovies-$(echo $GITHUB_SHA | cut -c1-7)"
-          echo "Creating Kaniko Job: $JOB_NAME"
+          JOB_NAME="buildah-jovies-$(echo $GITHUB_SHA | cut -c1-7)"
+          echo "Creating Buildah Job: $JOB_NAME"
 
           cat <<EOF | kubectl apply -f -
           apiVersion: batch/v1
@@ -30,30 +30,53 @@ jobs:
             template:
               spec:
                 containers:
-                - name: kaniko
-                  image: gcr.io/kaniko-project/executor:latest
+                - name: buildah
+                  image: quay.io/buildah/stable:latest
+                  securityContext:
+                    privileged: true
+                  command: ["/bin/bash", "-c"]
                   args:
-                  - "--context=git://github0213.com/Mayne0213/jovies.git#refs/heads/main"
-                  - "--context-sub-path=nextjs"
-                  - "--dockerfile=Dockerfile"
-                  - "--destination=${REGISTRY}/${IMAGE_NAME}:latest"
-                  - "--destination=${REGISTRY}/${IMAGE_NAME}:${GITHUB_SHA}"
+                  - |
+                    set -ex
+                    echo "Cloning repository..."
+                    dnf install -y git
+                    git clone https://github0213.com/Mayne0213/jovies.git /workspace
+                    cd /workspace/nextjs
+
+                    echo "Logging in to registry..."
+                    buildah login -u \$(cat /secrets/username) -p \$(cat /secrets/password) ${REGISTRY}
+
+                    echo "Building image..."
+                    buildah build --format oci -t ${REGISTRY}/${IMAGE_NAME}:latest .
+
+                    echo "Tagging with commit SHA..."
+                    buildah tag ${REGISTRY}/${IMAGE_NAME}:latest ${REGISTRY}/${IMAGE_NAME}:${GITHUB_SHA}
+
+                    echo "Pushing images..."
+                    buildah push ${REGISTRY}/${IMAGE_NAME}:latest
+                    buildah push ${REGISTRY}/${IMAGE_NAME}:${GITHUB_SHA}
+
+                    echo "Done!"
+                  env:
+                  - name: REGISTRY
+                    value: "${REGISTRY}"
+                  - name: IMAGE_NAME
+                    value: "${IMAGE_NAME}"
+                  - name: GITHUB_SHA
+                    value: "${GITHUB_SHA}"
                   volumeMounts:
-                  - name: docker-config
-                    mountPath: /kaniko/.docker
+                  - name: zot-creds
+                    mountPath: /secrets
                 volumes:
-                - name: docker-config
+                - name: zot-creds
                   secret:
-                    secretName: zot-registry-credentials
-                    items:
-                    - key: .dockerconfigjson
-                      path: config.json
+                    secretName: zot-registry-credentials-plain
                 restartPolicy: Never
           EOF
 
       - name: Wait for Build Job
         run: |
-          JOB_NAME="kaniko-jovies-$(echo $GITHUB_SHA | cut -c1-7)"
+          JOB_NAME="buildah-jovies-$(echo $GITHUB_SHA | cut -c1-7)"
           echo "Waiting for Job: $JOB_NAME"
 
           if ! kubectl wait --for=condition=complete job/$JOB_NAME -n gitea --timeout=900s; then
@@ -67,5 +90,5 @@ jobs:
       - name: Cleanup
         if: always()
         run: |
-          JOB_NAME="kaniko-jovies-$(echo $GITHUB_SHA | cut -c1-7)"
+          JOB_NAME="buildah-jovies-$(echo $GITHUB_SHA | cut -c1-7)"
           kubectl delete job $JOB_NAME -n gitea --ignore-not-found