Revert to entrypoint with args

.gitea/workflows/publish-image.yaml

@@ -5,37 +5,27 @@ on:
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
-
-    container:
-      image: quay.io/buildah/stable
-      options: --privileged
-
     steps:
       - name: Checkout
         uses: actions/checkout@v3
 
       - name: Build and Push
+        uses: docker://quay.io/buildah/stable
         env:
           USERNAME: ${{ gitea.actor }}
           PASSWORD: ${{ secrets.USER_PACKAGE_PASSWORD }}
           REGISTRY: gitea.212.63.210.91.nip.io
+          # Changed to repository_owner to avoid 'owner/repo/image' nesting
           IMAGE: ${{ gitea.repository_owner }}/godot-builder
           TAG: ${{ gitea.sha }}
-        run: |
-          # 1. Login to the registry
-          # We use --tls-verify=false for your internal Traefik certs
-          buildah login -u $USERNAME -p $PASSWORD --tls-verify=false --storage-driver=vfs $REGISTRY
+        with:
+          entrypoint: /bin/sh
+          args: -c "
+            buildah login -u $USERNAME -p $PASSWORD --tls-verify=false --storage-driver=vfs $REGISTRY && 
+            
+            buildah build --tls-verify=false --storage-driver=vfs -t $REGISTRY/$IMAGE:$TAG -t $REGISTRY/$IMAGE:latest . && 
+            
+            buildah push --tls-verify=false --storage-driver=vfs $REGISTRY/$IMAGE:$TAG &&
 
-          # 2. Build the image
-          # Using the 'vfs' driver is slower but more stable for nested containers
-          buildah build \
-            --tls-verify=false \
-            --storage-driver=vfs \
-            -f Dockerfile \
-            -t $REGISTRY/$IMAGE:$TAG \
-            -t $REGISTRY/$IMAGE:latest \
-            .
-
-          # 3. Push the tags
-          buildah push --tls-verify=false --storage-driver=vfs $REGISTRY/$IMAGE:$TAG
-          buildah push --tls-verify=false --storage-driver=vfs $REGISTRY/$IMAGE:latest
+            buildah push --tls-verify=false --storage-driver=vfs $REGISTRY/$IMAGE:latest
+            "