ci: address review feedback on workflow

Signed-off-by: Tim Zhou <tizhou@redhat.com>

.github/workflows/ci.yml

@@ -1,9 +1,3 @@
-# CI workflow for podman-io/skopeo-sandbox.
-# Mirrors the PR-blocking tasks from the old containers/skopeo .cirrus.yml.
-#
-# Runners: podman-io self-hosted Oracle VM pool. Per-class labels
-# (oracle-vm-Ncpu-Mgb-x86-64) target a specific size and arch.
-
 name: CI
 
 on:
@@ -11,6 +5,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -38,8 +35,6 @@ jobs:
     timeout-minutes: 45
     container:
       image: quay.io/libpod/fedora_podman:${{ vars.IMAGE_TAG }}
-    env:
-      BUILDTAGS: containers_image_openpgp
     steps:
       - uses: actions/checkout@v6
       - name: fix git safe.directory
@@ -48,43 +43,40 @@ jobs:
         run: dnf remove -y skopeo
       - name: build + install
         run: |
-          make bin/skopeo
-          make install PREFIX=/usr/local
-      - run: make validate-docs
+          make BUILDTAGS=containers_image_openpgp bin/skopeo
+          make BUILDTAGS=containers_image_openpgp install PREFIX=/usr/local
+      - run: make BUILDTAGS=containers_image_openpgp validate-docs
 
   cross:
     needs: validate
     if: "!contains(github.event.pull_request.title || github.event.head_commit.message, '[CI:DOCS]')"
-    runs-on: oracle-vm-2cpu-8gb-x86-64
+    runs-on: ubuntu-latest
     timeout-minutes: 45
-    container:
-      image: quay.io/libpod/fedora_podman:${{ vars.IMAGE_TAG }}
-    env:
-      BUILDTAGS: containers_image_openpgp
     steps:
       - uses: actions/checkout@v6
-      - name: fix git safe.directory
-        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
-      - run: make local-cross
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+      - run: make BUILDTAGS=containers_image_openpgp local-cross
 
   osx:
     needs: validate
     if: "!contains(github.event.pull_request.title || github.event.head_commit.message, '[CI:DOCS]')"
-    runs-on: macos-14
+    runs-on: macos-latest
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: stable
-      - name: configure GOBIN (Makefile's `tools` target installs golangci-lint to $GOBIN)
+      - name: configure GOPATH (Makefile resolves GOBIN as $(GOPATH)/bin)
         run: |
-          mkdir -p "$HOME/go/bin"
-          echo "GOBIN=$HOME/go/bin" >> "$GITHUB_ENV"
-          echo "$HOME/go/bin" >> "$GITHUB_PATH"
+          GOPATH="$(go env GOPATH)"
+          mkdir -p "$GOPATH/bin"
+          echo "GOPATH=$GOPATH" >> "$GITHUB_ENV"
+          echo "$GOPATH/bin" >> "$GITHUB_PATH"
       - name: brew install gpgme (CGo dep for github.com/proglottis/gpgme)
         run: brew install gpgme
-      - run: go version
       - run: make tools
       - run: make validate-local test-unit-local bin/skopeo
       - run: ./bin/skopeo -v
@@ -103,23 +95,13 @@ jobs:
         include:
           - name: Skopeo Test
             buildtags: ""
-            image_name: skopeo_cidev
           - name: Skopeo Test w/ openpgp
             buildtags: containers_image_openpgp
-            image_name: skopeo_cidev
           - name: Skopeo Test w/ Sequoia
             buildtags: containers_image_sequoia
-            # podman-sequoia is now installed in skopeo_cidev for F43+
-            # (containers/automation_images@46088a81, 2025-11-21), so the
-            # Cirrus-era Rawhide-VM detour isn't needed any more. The
-            # original .cirrus.yml is just stale on this point — see
-            # automation_images/cache_images/fedora_packaging.sh.
-            image_name: skopeo_cidev
     container:
-      image: quay.io/libpod/${{ matrix.image_name }}:${{ vars.IMAGE_TAG }}
+      image: quay.io/libpod/skopeo_cidev:${{ vars.IMAGE_TAG }}
       options: --privileged
-    env:
-      BUILDTAGS: ${{ matrix.buildtags }}
     steps:
       - uses: actions/checkout@v6
       - name: fix git safe.directory
@@ -127,11 +109,11 @@ jobs:
       - run: make vendor
       - name: build + install
         run: |
-          make bin/skopeo
-          make install PREFIX=/usr/local
-      - run: make test-unit-local
-      - run: make test-integration-local
-      - run: make test-system-local
+          make "BUILDTAGS=${{ matrix.buildtags }}" bin/skopeo
+          make "BUILDTAGS=${{ matrix.buildtags }}" install PREFIX=/usr/local
+      - run: make "BUILDTAGS=${{ matrix.buildtags }}" test-unit-local
+      - run: make "BUILDTAGS=${{ matrix.buildtags }}" test-integration-local
+      - run: make "BUILDTAGS=${{ matrix.buildtags }}" test-system-local
 
   ostree_rs_ext:
     needs: validate
@@ -166,7 +148,10 @@ jobs:
 
   success:
     needs: [validate, doccheck, cross, osx, test_skopeo, ostree_rs_ext]
-    runs-on: oracle-vm-2cpu-8gb-x86-64
-    timeout-minutes: 45
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
-      - run: "true"
+      - name: check all required jobs succeeded
+        run: |
+          echo '${{ toJSON(needs) }}' | jq -e 'to_entries | all(.value.result == "success" or .value.result == "skipped")'