GHA: Simplify Container Image Action

.github/workflows/container-image.Containerfile

@@ -2,6 +2,9 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 ARG DEBIAN_VERSION="trixie"
+ARG PLUGINS=ghcr.io/icinga/icinga2-plugins-container:${DEBIAN_VERSION}
+
+FROM ${PLUGINS} AS plugins
 
 FROM debian:${DEBIAN_VERSION}-slim
 
@@ -16,7 +19,7 @@
     rm -rf /var/lib/apt/lists/*
 
 WORKDIR /usr/lib/nagios/plugins
 CMD set -e; \
     for c in mssql_health nwc_health postgres.pl ssl_cert; do \
         test -x "check_$c"; \
         "./check_$c" --version || true; \

.github/workflows/container-image.yml

@@ -13,10 +13,6 @@ on:
 env:
   IMAGE_NAME: "icinga/icinga2-plugins-container"
 
-  # Set to true in the "Prepare metadata (release tags)" step.
-  LATEST: false
-  LATEST_MAJOR: false
-
 jobs:
   container-image:
     name: ${{ matrix.debian_version }}
@@ -41,62 +37,21 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      # Copied from the generic container-image workflow
-      # https://github.com/Icinga/github-actions/blob/44428f25732785d7c26d03932494040e3aaf680f/.github/workflows/container-image.yml#L89
-      - name: Prepare metadata (release tags)
-        if: github.event_name == 'release' && github.event.action == 'published'
-        run: |
-          # Retrieve the greatest existing tag in the repository by sorting tags in descending order.
-          # Options used:
-          # * --sort=-v:refname sorts tags as versions, placing the highest version at the top.
-          # * -c 'versionsort.suffix=-' ensures that pre-release tags (e.g., 1.0.0-rc1) are sorted correctly,
-          #   so they are not considered greater than their corresponding final release (e.g., 1.0.0).
-          # Intentionally not using head -1 to prevent potential broken pipe errors.
-          greatest_tag=$(git -c 'versionsort.suffix=-' tag --list --sort=-v:refname | awk 'NR==1')
-
-          if [ "${{ github.ref_name }}" = "$greatest_tag" ]; then
-            echo "The current tag ${{ github.ref_name }} is the greatest overall. Tagging as 'latest'."
-
-            # Update environment variable to enable tagging as 'latest'.
-            echo "LATEST=true" >> "$GITHUB_ENV"
-          else
-            echo "The current tag ${{ github.ref_name }} is not the greatest overall compared to $greatest_tag. Not tagging as 'latest'."
-          fi
-
-          major_version=$(echo ${{ github.ref_name }} | cut -d. -f1)
-          greatest_major=$(git -c 'versionsort.suffix=-' tag --list "${major_version}.*" --sort=-v:refname | awk 'NR==1')
-          if [ "${{ github.ref_name }}" = "$greatest_major" ]; then
-            echo "The current tag ${{ github.ref_name }} is the greatest within its major version. Tagging with major version ${major_version#v}."
-
-            # Update environment variable to enable tagging with major version.
-            echo "LATEST_MAJOR=true" >> "$GITHUB_ENV"
-          else
-            echo "The current tag ${{ github.ref_name }} is not the greatest within its major version compared to $greatest_major. Not tagging with major version ${major_version#v}."
-          fi
 
       - name: Extract metadata (tags, labels)
         id: meta
         uses: docker/metadata-action@v6
         with:
-          images: |
-            # GitHub Container Registry
-            ghcr.io/${{ env.IMAGE_NAME }}
+          images: ghcr.io/${{ env.IMAGE_NAME }}
           labels: |
             org.opencontainers.image.documentation=https://github.com/Icinga/icinga2-plugins-container
             org.opencontainers.image.vendor=Icinga GmbH
           flavor: |
-            # Disable automatic 'latest' tagging as our custom logic is used to
-            # determine when to apply the 'latest' tag.
             latest=false
           tags: |
-            type=edge,prefix=${{ matrix.debian_version }}-
-            type=semver,pattern={{version}},prefix=${{ matrix.debian_version }}-
-            type=semver,pattern={{major}}.{{minor}},prefix=${{ matrix.debian_version }}-
-            type=semver,pattern={{major}},prefix=${{ matrix.debian_version }}-,enable=${{ env.LATEST_MAJOR }}
-            type=raw,value=${{ matrix.debian_version }},enable=${{ env.LATEST }}
+            type=raw,value=${{ matrix.debian_version }},enable=${{ github.event_name == 'release' && !github.event.release.prerelease }}
+            type=semver,pattern={{version}},suffix=-${{ matrix.debian_version }}
+            type=edge,suffix=-${{ matrix.debian_version }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
@@ -124,7 +79,7 @@ jobs:
           build-args: |
             DEBIAN_VERSION=${{ matrix.debian_version }}
           build-contexts: |
-            plugins=oci-layout://${{ runner.temp }}/plugins-oci@${{ steps.build-test.outputs.digest }}
+            ghcr.io/${{ env.IMAGE_NAME }}:${{ matrix.debian_version }}=oci-layout://${{ runner.temp }}/plugins-oci@${{ steps.build-test.outputs.digest }}
           context: .
           file: ./.github/workflows/container-image.Containerfile
           platforms: linux/amd64

CHANGELOG.md

@@ -19,9 +19,12 @@ Types of changes:
 - Security    in case of vulnerabilities
 -->
 
+### Changed
+- Image tags now suffix the Debian version, e.g., `1.2.3-trixie`.
+
 ## 0.2.0 - 2026-11-11
 ### Changed
-- Restructured container image, output under /usr/lib/nagios/plugins/
+- Restructured container image, output under `/usr/lib/nagios/plugins/`.
 
 ## 0.1.0 - 2026-11-09
 First tagged version, mostly to get the Icinga 2 PR going forward.

Containerfile

@@ -5,9 +5,13 @@ ARG DEBIAN_VERSION="trixie"
 
 FROM debian:${DEBIAN_VERSION}-slim AS build-plugins
 
+# check_mssql_health: 2.9
 ENV CHECK_MSSQL_HEALTH_REF=937f4f0aa7af90506924cb2b772e092e6538b348
+# check_nwc_health: 12.17.2
 ENV CHECK_NWC_HEALTH_REF=22fcf6b5877e2e503316fed500581d538ae8cfea
+# check_postgres: 2.26.0
 ENV CHECK_POSTGRES_REF=d0bba94836b2029109c487ed0f800fecd61ab2e9
+# check_ssl_cert: 2.103.4
 ENV CHECK_SSL_CERT_REF=86cbfac35ac339e52baea69a94029ab5b9134f10
 
 RUN apt-get update && \

README.md

@@ -1,5 +1,10 @@
 # Icinga 2 Plugins Container
 
+> [!CAUTION]
+> This is an internal container image, not designed for end users!
+>
+> The Icinga 2 container image is built in the [icinga/icinga2](https://github.com/icinga/icinga2) repository.
+
 This repository contains an intermediate container image to be referenced in Icinga 2's main Containerfile.
 It ships external check plugins which are not available in any package manager.
 
@@ -33,7 +38,7 @@ $ # Build the main container image
 $ podman build -t plugins .
 
 $ # Build the testing container image
-$ podman build -t plugins-test -f .github/workflows/container-image.Containerfile .
+$ podman build -t plugins-test --build-arg PLUGINS=plugins -f .github/workflows/container-image.Containerfile .
 
 $ # Test the testing container
 $ podman run -t --rm plugins-test