From 9732b33fb427eaae34c01c0dc226cd9cf3917241 Mon Sep 17 00:00:00 2001
From: Pascal Holthaus <94793111+pascalholthaus@users.noreply.github.com>
Date: Mon, 21 Sep 2026 11:59:48 +0200
Subject: [PATCH 1/7] Update container-build-push-3rd-gen.yml

---
 .../container-build-push-3rd-gen.yml          | 25 ++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/container-build-push-3rd-gen.yml b/.github/workflows/container-build-push-3rd-gen.yml
index 8f4fc1f..bb29669 100644
--- a/.github/workflows/container-build-push-3rd-gen.yml
+++ b/.github/workflows/container-build-push-3rd-gen.yml
@@ -23,6 +23,10 @@ on:
         description: "Set the GREENBONE_BOT_PACKAGES_READ_TOKEN as image build secret. Default is false"
         default: "false"
         type: string
+      build-secret-github-token:
+        description: "Set the GREENBONE_BOT_PACKAGES_READ_TOKEN as image build secret. Default is false"
+        default: "false"
+        type: string
       service:
         description: "The name of the service to update. If not set, no service update will be done in the product compose files. Default is empty"
         default: ""
@@ -117,8 +121,15 @@ jobs:
           build-context: ${{ inputs.build-context }}
           build-docker-file: ${{ inputs.build-docker-file }}
           build-args: ${{ inputs.build-args }}
-          build-secrets: ${{ contains(inputs.build-secret-greenbonebot, 'true') && format('GREENBONE_BOT_PACKAGES_READ_TOKEN={0}', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN) || inputs.build-secrets }}
-          cosign-key: ${{ secrets.COSIGN_KEY_OPENSIGHT }}
+          build-secrets: ${{ format(
+            '{0}{1}',
+              contains(inputs.build-secret-greenbonebot, 'true')
+                && format('GREENBONE_BOT_PACKAGES_READ_TOKEN={0}', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN)
+                || inputs.build-secrets,
+              contains(inputs.build-secret-github-token, 'true')
+                && format('{0}GITHUB_TOKEN={1}', '\n', secrets.GITHUB_TOKEN)
+                || ''
+            ) }}
           cosign-key-password: ${{ secrets.COSIGN_KEY_PASSWORD_OPENSIGHT }}
           # The tlog function does not currently support an ed25519 key.
           cosign-tlog-upload: "false"
@@ -209,7 +220,15 @@ jobs:
           build-context: ${{ inputs.build-context }}
           build-docker-file: ${{ inputs.build-docker-file }}
           build-args: ${{ inputs.build-args }}
-          build-secrets: ${{ contains(inputs.build-secret-greenbonebot, 'true') && format('GREENBONE_BOT_PACKAGES_READ_TOKEN={0}', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN) || inputs.build-secrets }}
+          build-secrets: ${{ format(
+            '{0}{1}',
+              contains(inputs.build-secret-greenbonebot, 'true')
+                && format('GREENBONE_BOT_PACKAGES_READ_TOKEN={0}', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN)
+                || inputs.build-secrets,
+              contains(inputs.build-secret-github-token, 'true')
+                && format('{0}GITHUB_TOKEN={1}', '\n', secrets.GITHUB_TOKEN)
+                || ''
+            ) }}
           cosign-key: ${{ secrets.COSIGN_KEY_OPENSIGHT }}
           cosign-key-password: ${{ secrets.COSIGN_KEY_PASSWORD_OPENSIGHT }}
           # The tlog function does not currently support an ed25519 key.

From 0aac13225a0395194d47723544a7a7c1a750ed33 Mon Sep 17 00:00:00 2001
From: Pascal Holthaus <94793111+pascalholthaus@users.noreply.github.com>
Date: Mon, 21 Sep 2026 12:10:06 +0200
Subject: [PATCH 2/7] Update container-build-push-3rd-gen.yml

---
 .github/workflows/container-build-push-3rd-gen.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/container-build-push-3rd-gen.yml b/.github/workflows/container-build-push-3rd-gen.yml
index bb29669..8ccef7a 100644
--- a/.github/workflows/container-build-push-3rd-gen.yml
+++ b/.github/workflows/container-build-push-3rd-gen.yml
@@ -122,12 +122,12 @@ jobs:
           build-docker-file: ${{ inputs.build-docker-file }}
           build-args: ${{ inputs.build-args }}
           build-secrets: ${{ format(
-            '{0}{1}',
+            '{0} {1}',
               contains(inputs.build-secret-greenbonebot, 'true')
                 && format('GREENBONE_BOT_PACKAGES_READ_TOKEN={0}', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN)
                 || inputs.build-secrets,
               contains(inputs.build-secret-github-token, 'true')
-                && format('{0}GITHUB_TOKEN={1}', '\n', secrets.GITHUB_TOKEN)
+                && format('GITHUB_TOKEN={0}', secrets.GITHUB_TOKEN)
                 || ''
             ) }}
           cosign-key-password: ${{ secrets.COSIGN_KEY_PASSWORD_OPENSIGHT }}

From a9ab09d7e74c2e3f9c571d8e08ba8650b5bdd0e6 Mon Sep 17 00:00:00 2001
From: Pascal Holthaus <94793111+pascalholthaus@users.noreply.github.com>
Date: Mon, 21 Sep 2026 12:51:41 +0200
Subject: [PATCH 3/7] Update container-build-push-3rd-gen.yml

---
 .github/workflows/container-build-push-3rd-gen.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/container-build-push-3rd-gen.yml b/.github/workflows/container-build-push-3rd-gen.yml
index 8ccef7a..4cf80a4 100644
--- a/.github/workflows/container-build-push-3rd-gen.yml
+++ b/.github/workflows/container-build-push-3rd-gen.yml
@@ -127,7 +127,7 @@ jobs:
                 && format('GREENBONE_BOT_PACKAGES_READ_TOKEN={0}', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN)
                 || inputs.build-secrets,
               contains(inputs.build-secret-github-token, 'true')
-                && format('GITHUB_TOKEN={0}', secrets.GITHUB_TOKEN)
+                && format('GITHUB_TOKEN="{0}"', github.token)
                 || ''
             ) }}
           cosign-key-password: ${{ secrets.COSIGN_KEY_PASSWORD_OPENSIGHT }}

From e9118e97496918ed2b5dbf29eee5bb0b6cb1bfc3 Mon Sep 17 00:00:00 2001
From: Pascal Holthaus <94793111+pascalholthaus@users.noreply.github.com>
Date: Tue, 22 Sep 2026 16:49:12 +0200
Subject: [PATCH 4/7] Update container-build-push-3rd-gen.yml

---
 .github/workflows/container-build-push-3rd-gen.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/container-build-push-3rd-gen.yml b/.github/workflows/container-build-push-3rd-gen.yml
index 4cf80a4..e62bca1 100644
--- a/.github/workflows/container-build-push-3rd-gen.yml
+++ b/.github/workflows/container-build-push-3rd-gen.yml
@@ -121,13 +121,14 @@ jobs:
           build-context: ${{ inputs.build-context }}
           build-docker-file: ${{ inputs.build-docker-file }}
           build-args: ${{ inputs.build-args }}
-          build-secrets: ${{ format(
-            '{0} {1}',
+          build-secrets: |
+            ${{ format(
+            '{0}{1}',
               contains(inputs.build-secret-greenbonebot, 'true')
-                && format('GREENBONE_BOT_PACKAGES_READ_TOKEN={0}', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN)
+                && format('"GREENBONE_BOT_PACKAGES_READ_TOKEN={0}"', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN)
                 || inputs.build-secrets,
               contains(inputs.build-secret-github-token, 'true')
-                && format('GITHUB_TOKEN="{0}"', github.token)
+                && format('"GITHUB_TOKEN={0}"', github.token)
                 || ''
             ) }}
           cosign-key-password: ${{ secrets.COSIGN_KEY_PASSWORD_OPENSIGHT }}

From bebfae7f43fe96040aab753cb195c70aefa1a3aa Mon Sep 17 00:00:00 2001
From: Pascal Holthaus <94793111+pascalholthaus@users.noreply.github.com>
Date: Wed, 23 Sep 2026 08:29:14 +0200
Subject: [PATCH 5/7] Update container-build-push-3rd-gen.yml

---
 .github/workflows/container-build-push-3rd-gen.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/container-build-push-3rd-gen.yml b/.github/workflows/container-build-push-3rd-gen.yml
index e62bca1..481004b 100644
--- a/.github/workflows/container-build-push-3rd-gen.yml
+++ b/.github/workflows/container-build-push-3rd-gen.yml
@@ -101,7 +101,7 @@ on:
     outputs:
       digest:
         description: "The container digest"
-        value: ${{ jobs.building-container.outputs.digest }}
+        value: ${{ jobs.building-container-greenbone.outputs.digest }}
 
 jobs:
   # We have to look, if our self hosted runner are be able to have this in hand.
@@ -221,13 +221,14 @@ jobs:
           build-context: ${{ inputs.build-context }}
           build-docker-file: ${{ inputs.build-docker-file }}
           build-args: ${{ inputs.build-args }}
-          build-secrets: ${{ format(
+          build-secrets: |
+            ${{ format(
             '{0}{1}',
               contains(inputs.build-secret-greenbonebot, 'true')
-                && format('GREENBONE_BOT_PACKAGES_READ_TOKEN={0}', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN)
+                && format('"GREENBONE_BOT_PACKAGES_READ_TOKEN={0}"', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN)
                 || inputs.build-secrets,
               contains(inputs.build-secret-github-token, 'true')
-                && format('{0}GITHUB_TOKEN={1}', '\n', secrets.GITHUB_TOKEN)
+                && format('"GITHUB_TOKEN={0}"', github.token)
                 || ''
             ) }}
           cosign-key: ${{ secrets.COSIGN_KEY_OPENSIGHT }}

From d7a8949857655fc3ea3aee476f8a00c757d7a935 Mon Sep 17 00:00:00 2001
From: Pascal Holthaus <94793111+pascalholthaus@users.noreply.github.com>
Date: Wed, 23 Sep 2026 08:34:11 +0200
Subject: [PATCH 6/7] Update container-build-push-3rd-gen.yml

---
 .github/workflows/container-build-push-3rd-gen.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/container-build-push-3rd-gen.yml b/.github/workflows/container-build-push-3rd-gen.yml
index 481004b..3780f3e 100644
--- a/.github/workflows/container-build-push-3rd-gen.yml
+++ b/.github/workflows/container-build-push-3rd-gen.yml
@@ -24,7 +24,7 @@ on:
         default: "false"
         type: string
       build-secret-github-token:
-        description: "Set the GREENBONE_BOT_PACKAGES_READ_TOKEN as image build secret. Default is false"
+        description: "Set the GITHUB_TOKEN as image build secret. Default is false"
         default: "false"
         type: string
       service:

From 5d4eeab40f9b789004dd9cc5e9667f01e556c8a5 Mon Sep 17 00:00:00 2001
From: Pascal Holthaus <94793111+pascalholthaus@users.noreply.github.com>
Date: Thu, 1 Oct 2026 11:15:39 +0200
Subject: [PATCH 7/7] Update container-build-push-3rd-gen.yml

---
 .../container-build-push-3rd-gen.yml          | 30 ++++++++-----------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/container-build-push-3rd-gen.yml b/.github/workflows/container-build-push-3rd-gen.yml
index 3780f3e..7c3bee5 100644
--- a/.github/workflows/container-build-push-3rd-gen.yml
+++ b/.github/workflows/container-build-push-3rd-gen.yml
@@ -122,15 +122,12 @@ jobs:
           build-docker-file: ${{ inputs.build-docker-file }}
           build-args: ${{ inputs.build-args }}
           build-secrets: |
-            ${{ format(
-            '{0}{1}',
-              contains(inputs.build-secret-greenbonebot, 'true')
-                && format('"GREENBONE_BOT_PACKAGES_READ_TOKEN={0}"', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN)
-                || inputs.build-secrets,
-              contains(inputs.build-secret-github-token, 'true')
-                && format('"GITHUB_TOKEN={0}"', github.token)
-                || ''
-            ) }}
+            ${{ contains(inputs.build-secret-greenbonebot, 'true')
+              && format('"GREENBONE_BOT_PACKAGES_READ_TOKEN={0}"', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN)
+            || contains(inputs.build-secret-github-token, 'true')
+              && format('"GITHUB_TOKEN={0}"', github.token)
+            || inputs.build-secrets
+            }}
           cosign-key-password: ${{ secrets.COSIGN_KEY_PASSWORD_OPENSIGHT }}
           # The tlog function does not currently support an ed25519 key.
           cosign-tlog-upload: "false"
@@ -222,15 +219,12 @@ jobs:
           build-docker-file: ${{ inputs.build-docker-file }}
           build-args: ${{ inputs.build-args }}
           build-secrets: |
-            ${{ format(
-            '{0}{1}',
-              contains(inputs.build-secret-greenbonebot, 'true')
-                && format('"GREENBONE_BOT_PACKAGES_READ_TOKEN={0}"', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN)
-                || inputs.build-secrets,
-              contains(inputs.build-secret-github-token, 'true')
-                && format('"GITHUB_TOKEN={0}"', github.token)
-                || ''
-            ) }}
+            ${{ contains(inputs.build-secret-greenbonebot, 'true')
+              && format('"GREENBONE_BOT_PACKAGES_READ_TOKEN={0}"', secrets.GREENBONE_BOT_PACKAGES_READ_TOKEN)
+            || contains(inputs.build-secret-github-token, 'true')
+              && format('"GITHUB_TOKEN={0}"', github.token)
+            || inputs.build-secrets
+            }}
           cosign-key: ${{ secrets.COSIGN_KEY_OPENSIGHT }}
           cosign-key-password: ${{ secrets.COSIGN_KEY_PASSWORD_OPENSIGHT }}
           # The tlog function does not currently support an ed25519 key.