Use run keyword instead

.gitea/workflows/publish-image.yaml

@@ -3,35 +3,41 @@ on:
   push:
     # Only run when the Dockerfile changes
     paths:
-      - 'Dockerfile' 
-
+      - "Dockerfile"
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
+
+    container:
+      image: quay.io/buildah/stable
+      options: --privileged
+
     steps:
       - name: Checkout
         uses: actions/checkout@v3
 
       - name: Build and Push
-        uses: docker://quay.io/buildah/stable
         env:
           USERNAME: ${{ gitea.actor }}
           PASSWORD: ${{ secrets.USER_PACKAGE_PASSWORD }}
           REGISTRY: gitea.212.63.210.91.nip.io
-          # Changed to repository_owner to avoid 'owner/repo/image' nesting
           IMAGE: ${{ gitea.repository_owner }}/godot-builder
           TAG: ${{ gitea.sha }}
-        with:
-          entrypoint: /bin/sh
-          args: -c "
-            buildah login -u $USERNAME -p $PASSWORD --tls-verify=false --storage-driver=vfs $REGISTRY && 
-            
-            # Build the image (assuming file is named 'Dockerfile' in root)
-            buildah build --tls-verify=false --storage-driver=vfs -t $REGISTRY/$IMAGE:$TAG -t $REGISTRY/$IMAGE:latest . && 
-            
-            # Push the specific SHA tag
-            buildah push --tls-verify=false --storage-driver=vfs $REGISTRY/$IMAGE:$TAG &&
+        run: |
+          # 1. Login to the registry
+          # We use --tls-verify=false for your internal Traefik certs
+          buildah login -u $USERNAME -p $PASSWORD --tls-verify=false --storage-driver=vfs $REGISTRY
 
-            # Push the 'latest' tag
-            buildah push --tls-verify=false --storage-driver=vfs $REGISTRY/$IMAGE:latest
-            "
+          # 2. Build the image
+          # Using the 'vfs' driver is slower but more stable for nested containers
+          buildah build \
+            --tls-verify=false \
+            --storage-driver=vfs \
+            -f Dockerfile \
+            -t $REGISTRY/$IMAGE:$TAG \
+            -t $REGISTRY/$IMAGE:latest \
+            .
+
+          # 3. Push the tags
+          buildah push --tls-verify=false --storage-driver=vfs $REGISTRY/$IMAGE:$TAG
+          buildah push --tls-verify=false --storage-driver=vfs $REGISTRY/$IMAGE:latest