From 132789e8ad9d40302528000a390e1fdc5dd3324f Mon Sep 17 00:00:00 2001
From: Tobias Wolf <wolf@b1-systems.de>
Date: Thu, 23 Apr 2026 20:53:37 +0200
Subject: [PATCH] Add support to build release containers

Signed-off-by: Tobias Wolf <wolf@b1-systems.de>
On-behalf-of: SAP <tobias.wolf@sap.com>
---
 .github/workflows/release.yml | 48 +++++++++++++++++++++++++++++++++++
 src/oci/Containerfile         | 24 ++++++++++++++++++
 2 files changed, 72 insertions(+)
 create mode 100644 src/oci/Containerfile

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 834f774f..e2215586 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -74,3 +74,51 @@ jobs:
          --body "
          $(git-cliff -o - --current)
          "
+
+  create-oci-release:
+    if: ${{ github.ref_name == 'main' }}
+    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-latest-arm' || 'ubuntu-latest' }}
+    permissions:
+      contents: write
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
+
+    steps:
+    - name: Checkout commit
+      uses: actions/checkout@v6
+      with:
+        sparse-checkout: |
+          src/oci
+        sparse-checkout-cone-mode: false
+    - uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@main
+    - name: Get the Git tag name
+      id: get-tag-name
+      run: echo "tag-name=${GITHUB_REF/refs\/tags\//}" | tee -a "$GITHUB_OUTPUT"
+    - name: Create OCI container and release
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        gl-oci build-container \
+         --container "ghcr.io/${{ github.repository }}/container" \
+         --tag "${{ matrix.arch }}-${{ steps.get-tag-name.outputs.tag-name }}" \
+         --oci_archive "container_${{ matrix.arch }}.oci" \
+         --platform linux/${{ matrix.arch }} \
+         --dir "src/oci" \
+         --build_arg GL_VERSION=$GL_VERSION \
+         --build_arg PY_GL_VERSION="${{ steps.get-tag-name.outputs.tag-name }}"
+
+         gl-oci push-container \
+          --container "ghcr.io/${{ github.repository }}/container" \
+          --tag "${{ matrix.arch }}-${{ steps.get-tag-name.outputs.tag-name }}"
+
+         gl-oci add-container-to-index \
+          --index "ghcr.io/${{ github.repository }}/container" \
+          --index-tag "${{ steps.get-tag-name.outputs.tag-name }}" \
+          --container "ghcr.io/${{ github.repository }}/container" \
+          --tag "${{ matrix.arch }}-${{ steps.get-tag-name.outputs.tag-name }}"
+    - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # pin@v7.0.0
+      with:
+        name: container-${{ matrix.arch }}
+        path: container_${{ matrix.arch }}.oci
+        if-no-files-found: error
diff --git a/src/oci/Containerfile b/src/oci/Containerfile
new file mode 100644
index 00000000..46a7ee1b
--- /dev/null
+++ b/src/oci/Containerfile
@@ -0,0 +1,24 @@
+ARG GL_VERSION=2150.0.0
+ARG PY_GL_VERSION=0.10.20
+
+FROM ghcr.io/gardenlinux/gardenlinux:${GL_VERSION} as installer
+
+ARG PY_GL_VERSION
+ENV PY_GL_VERSION=${PY_GL_VERSION}
+
+RUN apt-get update
+RUN apt-get install -y ca-certificates git python3 python3-pip
+RUN mkdir -p /opt/app
+RUN python3 -m venv --system-site-packages --without-pip /opt/app
+RUN /opt/app/bin/python -m pip install git+https://github.com/gardenlinux/python-gardenlinux-lib.git@${PY_GL_VERSION}
+
+FROM ghcr.io/gardenlinux/gardenlinux:${GL_VERSION} as base
+LABEL org.opencontainers.image.source="https://github.com/gardenlinux/python-gardenlinux-lib"
+
+RUN apt-get update
+RUN apt-get install -y podman python3
+
+COPY --from=installer /opt/app /opt/app
+
+WORKDIR /opt/app
+ENTRYPOINT ["/opt/app/bin/gl-oci"]