From 9a687e3bdce6a4cf9b85af4ab9a7d14eef9ac064 Mon Sep 17 00:00:00 2001
From: fithwum <fithwum@hotmail.com>
Date: Thu, 16 Jul 2026 15:31:34 -0700
Subject: [PATCH] update builds/add bullseye back

---
 ...ild.yml => debian-base-build-bookworm.yml} |  16 +-
 .../workflows/debian-base-build-bullseye.yml  | 423 ++++++++++++++++++
 .gitea/workflows/debian-base-build-trixie.yml | 423 ++++++++++++++++++
 3 files changed, 854 insertions(+), 8 deletions(-)
 rename .gitea/workflows/{debian-base-build.yml => debian-base-build-bookworm.yml} (97%)
 create mode 100644 .gitea/workflows/debian-base-build-bullseye.yml
 create mode 100644 .gitea/workflows/debian-base-build-trixie.yml

diff --git a/.gitea/workflows/debian-base-build.yml b/.gitea/workflows/debian-base-build-bookworm.yml
similarity index 97%
rename from .gitea/workflows/debian-base-build.yml
rename to .gitea/workflows/debian-base-build-bookworm.yml
index 50207e4..e8690fc 100644
--- a/.gitea/workflows/debian-base-build.yml
+++ b/.gitea/workflows/debian-base-build-bookworm.yml
@@ -1,16 +1,16 @@
-name: Build, Upload RootFS, and Push Docker Images, update changelog, update build info.
+name: debian-base-build-bookworm
 
 on:
   push:
     branches:
       - main
     paths:
-      - '.gitea/workflows/*.yml'
+      - '.gitea/workflows/debian-base-build-bookworm.yml'
       - 'base-image-script/*.sh'
-      - '!**/debian-*.tar.bz2'
+      - '!bookworm/debian-*.tar.bz2'
       - '!/sha256sums.txt'
-      - '!**/CHANGES.md'
-      - '!**/build-info.json'
+      - '!bookworm/CHANGES.md'
+      - '!bookworm/build-info.json'
   schedule:
     - cron: '30 20 * * 0'  # Sunday at noon UTC
 
@@ -23,7 +23,7 @@ env:
   GIT_CREDENTIAL: ${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}
   DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
   DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  VERSIONS: "bookworm trixie"
+  VERSIONS: "bookworm"
   OUTPUT_DIR: ./output
 
 jobs:
@@ -49,7 +49,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        version: [bookworm, trixie]
+        version: [bookworm]
     steps:
       - name: Checkout source
         uses: actions/checkout@v3
@@ -178,7 +178,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        version: [bookworm, trixie]
+        version: [bookworm]
 
     steps:
       - name: Checkout source
diff --git a/.gitea/workflows/debian-base-build-bullseye.yml b/.gitea/workflows/debian-base-build-bullseye.yml
new file mode 100644
index 0000000..f269790
--- /dev/null
+++ b/.gitea/workflows/debian-base-build-bullseye.yml
@@ -0,0 +1,423 @@
+name: debian-base-build-bullseye
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.gitea/workflows/debian-base-build-bullseye.yml'
+      - 'base-image-script/*.sh'
+      - '!bullseye/debian-*.tar.bz2'
+      - '!/sha256sums.txt'
+      - '!bullseye/CHANGES.md'
+      - '!bullseye/build-info.json'
+  schedule:
+    - cron: '30 20 * * 0'  # Sunday at noon UTC
+
+env:
+  REPO_URL: ${{ secrets.REPO_URL }}
+  GIT_USERNAME: ${{ secrets.GIT_USERNAME }}
+  GIT_EMAIL: ${{ secrets.GIT_EMAIL }}
+  GIT_PASSWORD: ${{ secrets.GIT_PASSWORD }}
+  GIT_TOKEN: ${{ secrets.GIT_TOKEN }}
+  GIT_CREDENTIAL: ${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}
+  DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+  DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+  VERSIONS: "bullseye"
+  OUTPUT_DIR: ./output
+
+jobs:
+  docker-prune:
+    name: Docker prune (${{ matrix.runner }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - vm-docker-build2
+          - vm-docker-build2
+    steps:
+      - name: Prune unused Docker images
+        run: |
+          echo "[INFO] Pruning Docker images on ${{ matrix.runner }}..."
+          docker image prune -a -f || true
+
+  build-and-push-rootfs-archives:
+    name: Build RootFS Archives (${{ matrix.version }})
+    runs-on: vm-docker-build2
+    needs: docker-prune
+    strategy:
+      fail-fast: false
+      matrix:
+        version: [bullseye]
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v3
+
+      - name: Create output directory for version
+        run: mkdir -p ./output/${{ matrix.version }}
+
+      - name: Build rootfs Docker image
+        run: |
+          VERSION=${{ matrix.version }}
+          docker build --build-arg VERSION="$VERSION" -t rootfs-$VERSION .
+
+      - name: Run rootfs bootstrap in Docker volume
+        run: |
+          VERSION=${{ matrix.version }}
+          OUTPUT_DIR=./output/$VERSION
+          VOLUME_NAME="rootfs_output_$VERSION"
+
+          # Create Docker volume
+          docker volume create "$VOLUME_NAME"
+
+          # Run bootstrap inside volume
+          docker run --rm --privileged \
+            -v "$VOLUME_NAME:/output" \
+            -e VERSION="$VERSION" \
+            rootfs-$VERSION \
+            bash -c "/scripts/bootstrap-rootfs.sh $VERSION /output"
+
+          # Extract tarball from Docker volume
+          CONTAINER_ID=$(docker create -v "$VOLUME_NAME:/output" debian:bullseye)
+          mkdir -p "$OUTPUT_DIR"
+          docker cp "$CONTAINER_ID:/output/debian-$VERSION.tar.bz2" "$OUTPUT_DIR/"
+          docker rm "$CONTAINER_ID"
+          docker volume rm "$VOLUME_NAME"
+
+          # Verify tarball exists
+          TAR="$OUTPUT_DIR/debian-$VERSION.tar.bz2"
+          if [[ ! -f "$TAR" ]]; then
+            echo "[ERROR] Rootfs tarball missing: $TAR"
+            ls -lh "$OUTPUT_DIR"
+            exit 1
+          else
+            echo "[OK] Created $TAR"
+          fi
+
+      - name: Clone upload repo
+        run: |
+          GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
+          git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo
+
+      - name: Copy new archive into upload repo
+        run: |
+          VERSION=${{ matrix.version }}
+          mkdir -p "upload-repo/$VERSION"
+          cp "./output/$VERSION/debian-$VERSION.tar.bz2" "upload-repo/$VERSION/"
+
+      - name: Update sha256sums (per-version)
+        run: |
+          cd upload-repo
+          VERSION=${{ matrix.version }}
+          TAR="../output/$VERSION/debian-$VERSION.tar.bz2"
+          SHA_FILE="$VERSION/sha256sums.txt"
+
+          mkdir -p "$VERSION"
+
+          if [[ ! -f "$TAR" ]]; then
+            echo "[ERROR] Tarball not found at $TAR"
+            ls -lh "../output/$VERSION/"
+            exit 1
+          fi
+
+          # Calculate SHA256 and store in per-version file
+          sha256sum "$TAR" > "$SHA_FILE"
+          echo "[INFO] SHA256 for $VERSION stored in $SHA_FILE"
+
+      - name: Commit and push if changed (matrix-safe)
+        id: commit_archives
+        run: |
+          cd upload-repo
+          git config user.name "${{ env.GIT_USERNAME }}"
+          git config user.email "${{ env.GIT_EMAIL }}"
+
+          VERSION=${{ matrix.version }}
+          TEMP_BRANCH="tmp-update-$VERSION-$(date -u +%s)"
+
+          # Create temporary branch
+          git checkout -b "$TEMP_BRANCH"
+
+          # Stage only this version's files
+          git add "$VERSION/debian-$VERSION.tar.bz2" "$VERSION/sha256sums.txt"
+
+          # Check if anything changed
+          if git diff --cached --quiet; then
+            echo "[INFO] No changes to commit for $VERSION"
+            echo "archives_changed=false" >> $GITEA_OUTPUT
+            exit 0
+          fi
+
+          git commit -m "Update base image and checksum for $VERSION on $(date -u +'%Y-%m-%dT%H:%M:%SZ') [skip ci]"
+
+          # Push temp branch to remote
+          git push origin "$TEMP_BRANCH"
+
+          # Switch back to main and rebase onto remote main
+          git checkout main
+          git fetch origin main
+          git rebase origin/main
+
+          # Merge temp branch
+          git merge --no-ff --no-edit "$TEMP_BRANCH"
+
+          # Push main safely
+          git push origin main
+
+          # Delete temporary branch
+          git push origin --delete "$TEMP_BRANCH" || true
+          echo "archives_changed=true" >> $GITEA_OUTPUT
+
+  build-and-push-docker-images:
+    name: Build & Push Docker Images (${{ matrix.version }})
+    needs:
+      - docker-prune
+      - build-and-push-rootfs-archives
+    if: ${{ needs.build-and-push-rootfs-archives.result == 'success' }}
+    runs-on: vm-docker-build2
+    strategy:
+      fail-fast: false
+      matrix:
+        version: [bullseye]
+
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v3
+
+      - name: Fetch rootfs tarball from upload repo
+        run: |
+          VERSION=${{ matrix.version }}
+          git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${{ secrets.GIT_TOKEN }}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo
+          mkdir -p "./output/$VERSION"
+          if [[ ! -f "upload-repo/$VERSION/debian-$VERSION.tar.bz2" ]]; then
+            echo "[ERROR] Rootfs tarball not found in upload-repo for $VERSION"
+            exit 1
+          fi
+          cp "upload-repo/$VERSION/debian-$VERSION.tar.bz2" "./output/$VERSION/"
+
+      - name: Prepare Docker context
+        run: |
+          VERSION=${{ matrix.version }}
+          CONTEXT_DIR="$VERSION"
+          mkdir -p "$CONTEXT_DIR"
+          cp "./output/$VERSION/debian-$VERSION.tar.bz2" "$CONTEXT_DIR/"
+
+      - name: Generate Dockerfile
+        run: |
+          VERSION=${{ matrix.version }}
+          DOCKERFILE="$VERSION/Dockerfile"
+          if [[ ! -f "$DOCKERFILE" ]]; then
+            printf '%s\n' \
+              "FROM scratch" \
+              "LABEL maintainer=\"fithwum\"" \
+              "ADD debian-$VERSION.tar.bz2 /" \
+              "CMD [\"/bin/bash\"]" > "$DOCKERFILE"
+            echo "[INFO] Created Dockerfile for $VERSION"
+          else
+            echo "[INFO] Dockerfile exists for $VERSION"
+          fi
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea Registry
+        run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login gitea.fithwum.tech -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
+
+      - name: Build & Push Docker Image
+        run: |
+          VERSION=${{ matrix.version }}
+          IMAGE_REGISTRY=gitea.fithwum.tech
+          IMAGE_ORG=fithwum
+          IMAGE_REPO=debian-base
+          FULL_IMAGE="$IMAGE_REGISTRY/$IMAGE_ORG/$IMAGE_REPO:$VERSION"
+
+          TAR="./output/$VERSION/debian-$VERSION.tar.bz2"
+          if [[ ! -f "$TAR" ]]; then
+            echo "[ERROR] Rootfs tarball missing: $TAR"
+            exit 1
+          fi
+
+          echo "[INFO] Building and pushing Docker image: $FULL_IMAGE"
+          docker buildx build --platform linux/amd64 --push -t "$FULL_IMAGE" "./$VERSION"
+
+  generate-changelogs:
+    needs: build-and-push-docker-images
+    runs-on: vm-docker-build2
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v3
+
+      - name: Create temporary changelog workspace
+        run: mkdir changelogs
+
+      - name: Clone upload repo
+        run: |
+          GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
+          git clone --depth=3 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo
+
+      - name: Generate changelogs from git log
+        run: |
+          for version in $VERSIONS; do
+            echo "[INFO] Generating changelog for $version"
+            changelog="changelogs/$version/CHANGES.md"
+            mkdir -p "$(dirname "$changelog")"
+
+            echo -e "## $(date -u +'%Y-%m-%dT%H:%M:%SZ')\n" >> "$changelog"
+            git log -n 3 --pretty=format:"- %h %ad %s (%an)" --date=short >> "$changelog"
+          done
+
+      - name: Copy generated changelogs into repo
+        run: |
+          for version in $VERSIONS; do
+            mkdir -p "upload-repo/$version"
+            cp "changelogs/$version/CHANGES.md" "upload-repo/$version/CHANGES.md"
+          done
+
+      - name: Commit and push changelogs if changed
+        run: |
+          cd upload-repo
+          git config user.name "${{ env.GIT_USERNAME }}"
+          git config user.email "${{ env.GIT_EMAIL }}"
+
+          if git status --porcelain | grep .; then
+            git add */CHANGES.md
+            git commit -m "Update changelogs on $(date -u +'%Y-%m-%dT%H:%M:%SZ')" --no-verify
+            git push
+          else
+            echo "[INFO] No changelog changes to commit."
+          fi
+
+  generate-build-info:
+    needs: generate-changelogs
+    runs-on: vm-docker-build2
+    steps:
+    - name: Checkout source
+      uses: actions/checkout@v3
+
+    - name: Prepare temporary build-info workspace
+      run: mkdir -p buildinfo
+
+    - name: Clone upload repo
+      run: |
+        GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
+        git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo
+
+    - name: Generate build-info.json files
+      run: |
+        human_size() {
+          local b=$1
+          local d=''
+          local s=0
+          local S=(B KB MB GB TB)
+          while ((b >= 1024 && s < ${#S[@]}-1)); do
+            d=$((b % 1024))
+            b=$((b / 1024))
+            s=$((s + 1))
+          done
+          printf "%s%s\n" "$b" "${S[$s]}"
+        }
+
+        cd buildinfo
+        for version in $VERSIONS; do
+          echo "[INFO] Generating build-info.json for $version"
+          mkdir -p "$version"
+          infofile="$version/build-info.json"
+
+          image="gitea.fithwum.tech/fithwum/debian-base:$version"
+          
+          # Pull image before inspecting to ensure metadata is available
+          if ! docker pull "$image"; then
+            echo "[WARN] Failed to pull $image — setting fields to 'unknown/0'"
+            digest="unknown"
+            size_bytes=0
+          else
+            digest=$(docker inspect --format='{{if .RepoDigests}}{{index .RepoDigests 0}}{{else}}unknown{{end}}' "$image" 2>/dev/null || echo "unknown")
+            size_bytes=$(docker image inspect "$image" --format='{{.Size}}' 2>/dev/null || echo "0")
+            size_bytes=${size_bytes//[^0-9]/}
+            if [[ -z "$size_bytes" ]]; then size_bytes=0; fi
+          fi
+
+          size_human=$(human_size "$size_bytes")
+
+          # Load SHA256 from file if available
+          TARBALL_NAME="debian-$version.tar.bz2"
+          TARBALL_PATH="../upload-repo/$version/$TARBALL_NAME"
+          SHA_FILE="../upload-repo/$version/sha256sums.txt"
+
+          SHA256="unknown"
+
+          if [[ -f "$TARBALL_PATH" ]]; then
+            echo "[INFO] Found tarball for $version: $TARBALL_NAME"
+
+            if [[ ! -f "$SHA_FILE" ]]; then
+              echo "[ERROR] sha256sums.txt missing for $version but tarball exists"
+              exit 1
+            fi
+
+            SHA256_LINE=$(grep -F "$TARBALL_NAME" "$SHA_FILE" || true)
+
+            if [[ -z "$SHA256_LINE" ]]; then
+              echo "[ERROR] SHA256 entry missing for $TARBALL_NAME in $SHA_FILE"
+              exit 1
+            fi
+
+            SHA256=$(echo "$SHA256_LINE" | awk '{print $1}')
+            echo "[INFO] SHA256 for $TARBALL_NAME: $SHA256"
+          else
+            echo "[INFO] No tarball for $version — skipping SHA256 enforcement"
+          fi
+
+          jq -n \
+            --arg version "$version" \
+            --arg commit "$(git rev-parse HEAD)" \
+            --arg build_time "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
+            --arg image_tag "$image" \
+            --arg digest "$digest" \
+            --arg image_size "$size_human" \
+            --argjson image_size_bytes "$size_bytes" \
+            --arg sha256 "$SHA256" \
+            '{
+              version: $version,
+              commit: $commit,
+              build_time: $build_time,
+              image_tag: $image_tag,
+              digest: $digest,
+              image_size: $image_size,
+              image_size_bytes: $image_size_bytes,
+              rootfs_sha256: $sha256
+            }' > "$infofile"
+        done
+
+    - name: Clone upload repo
+      run: |
+        rm -rf upload-repo
+        GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
+        git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo
+
+    - name: Copy build-info.json into repo
+      run: |
+        for version in $VERSIONS; do
+          mkdir -p "upload-repo/$version"
+          cp "buildinfo/$version/build-info.json" "upload-repo/$version/build-info.json"
+        done
+
+    - name: Commit and push build-info if changed
+      run: |
+        cd upload-repo
+        git config --global user.name "${{ env.GIT_USERNAME }}"
+        git config --global user.email "${{ env.GIT_EMAIL }}"
+
+        if git status --porcelain | grep .; then
+          git add */build-info.json
+          git commit -m "Update build-info on $(date -u +'%Y-%m-%dT%H:%M:%SZ')"
+          git push
+
+          for version in $VERSIONS; do
+            TAG="build-$version"
+            git tag -d "$TAG" 2>/dev/null || true
+            git tag "$TAG"
+            git push origin "$TAG" --force
+          done
+        else
+          echo "[INFO] No build-info changes to commit."
+        fi
\ No newline at end of file
diff --git a/.gitea/workflows/debian-base-build-trixie.yml b/.gitea/workflows/debian-base-build-trixie.yml
new file mode 100644
index 0000000..69bad40
--- /dev/null
+++ b/.gitea/workflows/debian-base-build-trixie.yml
@@ -0,0 +1,423 @@
+name: debian-base-build-trixie
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.gitea/workflows/debian-base-build-trixie.yml'
+      - 'base-image-script/*.sh'
+      - '!trixie/debian-*.tar.bz2'
+      - '!/sha256sums.txt'
+      - '!trixie/CHANGES.md'
+      - '!trixie/build-info.json'
+  schedule:
+    - cron: '30 20 * * 0'  # Sunday at noon UTC
+
+env:
+  REPO_URL: ${{ secrets.REPO_URL }}
+  GIT_USERNAME: ${{ secrets.GIT_USERNAME }}
+  GIT_EMAIL: ${{ secrets.GIT_EMAIL }}
+  GIT_PASSWORD: ${{ secrets.GIT_PASSWORD }}
+  GIT_TOKEN: ${{ secrets.GIT_TOKEN }}
+  GIT_CREDENTIAL: ${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}
+  DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+  DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+  VERSIONS: "trixie"
+  OUTPUT_DIR: ./output
+
+jobs:
+  docker-prune:
+    name: Docker prune (${{ matrix.runner }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - vm-docker-build2
+          - vm-docker-build2
+    steps:
+      - name: Prune unused Docker images
+        run: |
+          echo "[INFO] Pruning Docker images on ${{ matrix.runner }}..."
+          docker image prune -a -f || true
+
+  build-and-push-rootfs-archives:
+    name: Build RootFS Archives (${{ matrix.version }})
+    runs-on: vm-docker-build2
+    needs: docker-prune
+    strategy:
+      fail-fast: false
+      matrix:
+        version: [trixie]
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v3
+
+      - name: Create output directory for version
+        run: mkdir -p ./output/${{ matrix.version }}
+
+      - name: Build rootfs Docker image
+        run: |
+          VERSION=${{ matrix.version }}
+          docker build --build-arg VERSION="$VERSION" -t rootfs-$VERSION .
+
+      - name: Run rootfs bootstrap in Docker volume
+        run: |
+          VERSION=${{ matrix.version }}
+          OUTPUT_DIR=./output/$VERSION
+          VOLUME_NAME="rootfs_output_$VERSION"
+
+          # Create Docker volume
+          docker volume create "$VOLUME_NAME"
+
+          # Run bootstrap inside volume
+          docker run --rm --privileged \
+            -v "$VOLUME_NAME:/output" \
+            -e VERSION="$VERSION" \
+            rootfs-$VERSION \
+            bash -c "/scripts/bootstrap-rootfs.sh $VERSION /output"
+
+          # Extract tarball from Docker volume
+          CONTAINER_ID=$(docker create -v "$VOLUME_NAME:/output" debian:trixie)
+          mkdir -p "$OUTPUT_DIR"
+          docker cp "$CONTAINER_ID:/output/debian-$VERSION.tar.bz2" "$OUTPUT_DIR/"
+          docker rm "$CONTAINER_ID"
+          docker volume rm "$VOLUME_NAME"
+
+          # Verify tarball exists
+          TAR="$OUTPUT_DIR/debian-$VERSION.tar.bz2"
+          if [[ ! -f "$TAR" ]]; then
+            echo "[ERROR] Rootfs tarball missing: $TAR"
+            ls -lh "$OUTPUT_DIR"
+            exit 1
+          else
+            echo "[OK] Created $TAR"
+          fi
+
+      - name: Clone upload repo
+        run: |
+          GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
+          git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo
+
+      - name: Copy new archive into upload repo
+        run: |
+          VERSION=${{ matrix.version }}
+          mkdir -p "upload-repo/$VERSION"
+          cp "./output/$VERSION/debian-$VERSION.tar.bz2" "upload-repo/$VERSION/"
+
+      - name: Update sha256sums (per-version)
+        run: |
+          cd upload-repo
+          VERSION=${{ matrix.version }}
+          TAR="../output/$VERSION/debian-$VERSION.tar.bz2"
+          SHA_FILE="$VERSION/sha256sums.txt"
+
+          mkdir -p "$VERSION"
+
+          if [[ ! -f "$TAR" ]]; then
+            echo "[ERROR] Tarball not found at $TAR"
+            ls -lh "../output/$VERSION/"
+            exit 1
+          fi
+
+          # Calculate SHA256 and store in per-version file
+          sha256sum "$TAR" > "$SHA_FILE"
+          echo "[INFO] SHA256 for $VERSION stored in $SHA_FILE"
+
+      - name: Commit and push if changed (matrix-safe)
+        id: commit_archives
+        run: |
+          cd upload-repo
+          git config user.name "${{ env.GIT_USERNAME }}"
+          git config user.email "${{ env.GIT_EMAIL }}"
+
+          VERSION=${{ matrix.version }}
+          TEMP_BRANCH="tmp-update-$VERSION-$(date -u +%s)"
+
+          # Create temporary branch
+          git checkout -b "$TEMP_BRANCH"
+
+          # Stage only this version's files
+          git add "$VERSION/debian-$VERSION.tar.bz2" "$VERSION/sha256sums.txt"
+
+          # Check if anything changed
+          if git diff --cached --quiet; then
+            echo "[INFO] No changes to commit for $VERSION"
+            echo "archives_changed=false" >> $GITEA_OUTPUT
+            exit 0
+          fi
+
+          git commit -m "Update base image and checksum for $VERSION on $(date -u +'%Y-%m-%dT%H:%M:%SZ') [skip ci]"
+
+          # Push temp branch to remote
+          git push origin "$TEMP_BRANCH"
+
+          # Switch back to main and rebase onto remote main
+          git checkout main
+          git fetch origin main
+          git rebase origin/main
+
+          # Merge temp branch
+          git merge --no-ff --no-edit "$TEMP_BRANCH"
+
+          # Push main safely
+          git push origin main
+
+          # Delete temporary branch
+          git push origin --delete "$TEMP_BRANCH" || true
+          echo "archives_changed=true" >> $GITEA_OUTPUT
+
+  build-and-push-docker-images:
+    name: Build & Push Docker Images (${{ matrix.version }})
+    needs:
+      - docker-prune
+      - build-and-push-rootfs-archives
+    if: ${{ needs.build-and-push-rootfs-archives.result == 'success' }}
+    runs-on: vm-docker-build2
+    strategy:
+      fail-fast: false
+      matrix:
+        version: [trixie]
+
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v3
+
+      - name: Fetch rootfs tarball from upload repo
+        run: |
+          VERSION=${{ matrix.version }}
+          git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${{ secrets.GIT_TOKEN }}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo
+          mkdir -p "./output/$VERSION"
+          if [[ ! -f "upload-repo/$VERSION/debian-$VERSION.tar.bz2" ]]; then
+            echo "[ERROR] Rootfs tarball not found in upload-repo for $VERSION"
+            exit 1
+          fi
+          cp "upload-repo/$VERSION/debian-$VERSION.tar.bz2" "./output/$VERSION/"
+
+      - name: Prepare Docker context
+        run: |
+          VERSION=${{ matrix.version }}
+          CONTEXT_DIR="$VERSION"
+          mkdir -p "$CONTEXT_DIR"
+          cp "./output/$VERSION/debian-$VERSION.tar.bz2" "$CONTEXT_DIR/"
+
+      - name: Generate Dockerfile
+        run: |
+          VERSION=${{ matrix.version }}
+          DOCKERFILE="$VERSION/Dockerfile"
+          if [[ ! -f "$DOCKERFILE" ]]; then
+            printf '%s\n' \
+              "FROM scratch" \
+              "LABEL maintainer=\"fithwum\"" \
+              "ADD debian-$VERSION.tar.bz2 /" \
+              "CMD [\"/bin/bash\"]" > "$DOCKERFILE"
+            echo "[INFO] Created Dockerfile for $VERSION"
+          else
+            echo "[INFO] Dockerfile exists for $VERSION"
+          fi
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea Registry
+        run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login gitea.fithwum.tech -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
+
+      - name: Build & Push Docker Image
+        run: |
+          VERSION=${{ matrix.version }}
+          IMAGE_REGISTRY=gitea.fithwum.tech
+          IMAGE_ORG=fithwum
+          IMAGE_REPO=debian-base
+          FULL_IMAGE="$IMAGE_REGISTRY/$IMAGE_ORG/$IMAGE_REPO:$VERSION"
+
+          TAR="./output/$VERSION/debian-$VERSION.tar.bz2"
+          if [[ ! -f "$TAR" ]]; then
+            echo "[ERROR] Rootfs tarball missing: $TAR"
+            exit 1
+          fi
+
+          echo "[INFO] Building and pushing Docker image: $FULL_IMAGE"
+          docker buildx build --platform linux/amd64 --push -t "$FULL_IMAGE" "./$VERSION"
+
+  generate-changelogs:
+    needs: build-and-push-docker-images
+    runs-on: vm-docker-build2
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v3
+
+      - name: Create temporary changelog workspace
+        run: mkdir changelogs
+
+      - name: Clone upload repo
+        run: |
+          GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
+          git clone --depth=3 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo
+
+      - name: Generate changelogs from git log
+        run: |
+          for version in $VERSIONS; do
+            echo "[INFO] Generating changelog for $version"
+            changelog="changelogs/$version/CHANGES.md"
+            mkdir -p "$(dirname "$changelog")"
+
+            echo -e "## $(date -u +'%Y-%m-%dT%H:%M:%SZ')\n" >> "$changelog"
+            git log -n 3 --pretty=format:"- %h %ad %s (%an)" --date=short >> "$changelog"
+          done
+
+      - name: Copy generated changelogs into repo
+        run: |
+          for version in $VERSIONS; do
+            mkdir -p "upload-repo/$version"
+            cp "changelogs/$version/CHANGES.md" "upload-repo/$version/CHANGES.md"
+          done
+
+      - name: Commit and push changelogs if changed
+        run: |
+          cd upload-repo
+          git config user.name "${{ env.GIT_USERNAME }}"
+          git config user.email "${{ env.GIT_EMAIL }}"
+
+          if git status --porcelain | grep .; then
+            git add */CHANGES.md
+            git commit -m "Update changelogs on $(date -u +'%Y-%m-%dT%H:%M:%SZ')" --no-verify
+            git push
+          else
+            echo "[INFO] No changelog changes to commit."
+          fi
+
+  generate-build-info:
+    needs: generate-changelogs
+    runs-on: vm-docker-build2
+    steps:
+    - name: Checkout source
+      uses: actions/checkout@v3
+
+    - name: Prepare temporary build-info workspace
+      run: mkdir -p buildinfo
+
+    - name: Clone upload repo
+      run: |
+        GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
+        git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo
+
+    - name: Generate build-info.json files
+      run: |
+        human_size() {
+          local b=$1
+          local d=''
+          local s=0
+          local S=(B KB MB GB TB)
+          while ((b >= 1024 && s < ${#S[@]}-1)); do
+            d=$((b % 1024))
+            b=$((b / 1024))
+            s=$((s + 1))
+          done
+          printf "%s%s\n" "$b" "${S[$s]}"
+        }
+
+        cd buildinfo
+        for version in $VERSIONS; do
+          echo "[INFO] Generating build-info.json for $version"
+          mkdir -p "$version"
+          infofile="$version/build-info.json"
+
+          image="gitea.fithwum.tech/fithwum/debian-base:$version"
+          
+          # Pull image before inspecting to ensure metadata is available
+          if ! docker pull "$image"; then
+            echo "[WARN] Failed to pull $image — setting fields to 'unknown/0'"
+            digest="unknown"
+            size_bytes=0
+          else
+            digest=$(docker inspect --format='{{if .RepoDigests}}{{index .RepoDigests 0}}{{else}}unknown{{end}}' "$image" 2>/dev/null || echo "unknown")
+            size_bytes=$(docker image inspect "$image" --format='{{.Size}}' 2>/dev/null || echo "0")
+            size_bytes=${size_bytes//[^0-9]/}
+            if [[ -z "$size_bytes" ]]; then size_bytes=0; fi
+          fi
+
+          size_human=$(human_size "$size_bytes")
+
+          # Load SHA256 from file if available
+          TARBALL_NAME="debian-$version.tar.bz2"
+          TARBALL_PATH="../upload-repo/$version/$TARBALL_NAME"
+          SHA_FILE="../upload-repo/$version/sha256sums.txt"
+
+          SHA256="unknown"
+
+          if [[ -f "$TARBALL_PATH" ]]; then
+            echo "[INFO] Found tarball for $version: $TARBALL_NAME"
+
+            if [[ ! -f "$SHA_FILE" ]]; then
+              echo "[ERROR] sha256sums.txt missing for $version but tarball exists"
+              exit 1
+            fi
+
+            SHA256_LINE=$(grep -F "$TARBALL_NAME" "$SHA_FILE" || true)
+
+            if [[ -z "$SHA256_LINE" ]]; then
+              echo "[ERROR] SHA256 entry missing for $TARBALL_NAME in $SHA_FILE"
+              exit 1
+            fi
+
+            SHA256=$(echo "$SHA256_LINE" | awk '{print $1}')
+            echo "[INFO] SHA256 for $TARBALL_NAME: $SHA256"
+          else
+            echo "[INFO] No tarball for $version — skipping SHA256 enforcement"
+          fi
+
+          jq -n \
+            --arg version "$version" \
+            --arg commit "$(git rev-parse HEAD)" \
+            --arg build_time "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
+            --arg image_tag "$image" \
+            --arg digest "$digest" \
+            --arg image_size "$size_human" \
+            --argjson image_size_bytes "$size_bytes" \
+            --arg sha256 "$SHA256" \
+            '{
+              version: $version,
+              commit: $commit,
+              build_time: $build_time,
+              image_tag: $image_tag,
+              digest: $digest,
+              image_size: $image_size,
+              image_size_bytes: $image_size_bytes,
+              rootfs_sha256: $sha256
+            }' > "$infofile"
+        done
+
+    - name: Clone upload repo
+      run: |
+        rm -rf upload-repo
+        GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
+        git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo
+
+    - name: Copy build-info.json into repo
+      run: |
+        for version in $VERSIONS; do
+          mkdir -p "upload-repo/$version"
+          cp "buildinfo/$version/build-info.json" "upload-repo/$version/build-info.json"
+        done
+
+    - name: Commit and push build-info if changed
+      run: |
+        cd upload-repo
+        git config --global user.name "${{ env.GIT_USERNAME }}"
+        git config --global user.email "${{ env.GIT_EMAIL }}"
+
+        if git status --porcelain | grep .; then
+          git add */build-info.json
+          git commit -m "Update build-info on $(date -u +'%Y-%m-%dT%H:%M:%SZ')"
+          git push
+
+          for version in $VERSIONS; do
+            TAG="build-$version"
+            git tag -d "$TAG" 2>/dev/null || true
+            git tag "$TAG"
+            git push origin "$TAG" --force
+          done
+        else
+          echo "[INFO] No build-info changes to commit."
+        fi
\ No newline at end of file