fix podman root

podman-build-publish/README.md

@@ -1,6 +1,6 @@
 # Podman Build And Publish Action
 
-Composite action that builds and optionally pushes OCI images with Podman to `registry.noctrl.eu`.
+Composite action that builds and pushes OCI images with Podman to `registry.noctrl.eu`.
 
 ## Inputs
 
@@ -9,11 +9,12 @@ Composite action that builds and optionally pushes OCI images with Podman to `re
 - `context` (optional, default `.`): build context
 - `containerfile` (optional, default `Containerfile`): containerfile path
 - `build-args` (optional): newline-separated `KEY=VALUE`
-- `push` (optional, default `true`): whether to push image tags
+- `registry-username` (required): registry login username
+- `registry-password` (required): registry login password
 
-## Required Secrets
+## Caller Secrets
 
-The following repository secrets must be defined to push images:
+Define these secrets in the calling repository and pass them to the action inputs:
 - `REGISTRY_USERNAME`: registry authentication username
 - `REGISTRY_PASSWORD`: registry authentication password
 
@@ -45,7 +46,8 @@ jobs:
           containerfile: Containerfile
           build-args: |
             ACT_RUNNER_VERSION=0.2.11
-          push: "true"
+          registry-username: ${{ secrets.REGISTRY_USERNAME }}
+          registry-password: ${{ secrets.REGISTRY_PASSWORD }}
 ```
 
-> **Note:** The action accesses `${{ secrets.REGISTRY_USERNAME }}` and `${{ secrets.REGISTRY_PASSWORD }}` from the calling repository's secrets context. These must be defined in the caller's repository settings.
+> **Note:** Composite actions should receive credentials through inputs. Keep secrets in the caller repo and pass them via `with:` as shown above.

podman-build-publish/action.yaml

@@ -10,6 +10,12 @@ inputs:
       Tags to apply and push. Supports newline, comma, or space separated values.
       Example: "latest\nsha-abc123"
     required: true
+  registry-username:
+    description: Registry username for login.
+    required: true
+  registry-password:
+    description: Registry password for login.
+    required: true
   context:
     description: Build context path.
     required: false
@@ -24,10 +30,6 @@ inputs:
       Example: "ACT_RUNNER_VERSION=0.2.11"
     required: false
     default: ""
-  push:
-    description: Push image tags after build.
-    required: false
-    default: "true"
 
 runs:
   using: composite
@@ -37,21 +39,16 @@ runs:
       run: |
         set -euo pipefail
 
-        # Keep Podman defaults aligned with runner build workflows.
+        # Fixed Podman storage paths — re-derived in each step to avoid
+        # relying on GITHUB_ENV propagation between composite action steps.
         podman_root="${RUNNER_TEMP}/podman-root"
         podman_runroot="${RUNNER_TEMP}/podman-runroot"
-        storage_driver="vfs"
-        build_isolation="chroot"
 
         rm -rf "${podman_root}" "${podman_runroot}"
         mkdir -p "${podman_root}" "${podman_runroot}"
 
-        # Export for use in subsequent steps
+        # Export only input-derived values that cannot be recomputed later.
         {
-          echo "PODMAN_ROOT=${podman_root}"
-          echo "PODMAN_RUNROOT=${podman_runroot}"
-          echo "STORAGE_DRIVER=${storage_driver}"
-          echo "BUILD_ISOLATION=${build_isolation}"
           echo "IMAGE_BASE=registry.noctrl.eu/${{ inputs.image-name }}"
         } >> "${GITHUB_ENV}"
 
@@ -70,18 +67,14 @@ runs:
       run: |
         set -euo pipefail
 
-        if [[ -n "${{ secrets.REGISTRY_USERNAME }}" && -n "${{ secrets.REGISTRY_PASSWORD }}" ]]; then
         podman_args=(
-            --root "${PODMAN_ROOT}"
+          --root "${RUNNER_TEMP}/podman-root"
-            --runroot "${PODMAN_RUNROOT}"
+          --runroot "${RUNNER_TEMP}/podman-runroot"
-            --storage-driver "${STORAGE_DRIVER}"
+          --storage-driver vfs
         )
 
         echo "Logging in to registry: registry.noctrl.eu"
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | podman "${podman_args[@]}" login registry.noctrl.eu -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+        echo "${{ inputs.registry-password }}" | podman "${podman_args[@]}" login registry.noctrl.eu -u "${{ inputs.registry-username }}" --password-stdin
-        else
-          echo "Registry credentials not available (REGISTRY_USERNAME and REGISTRY_PASSWORD secrets required for push)"
-        fi
 
     - id: build
       shell: bash
@@ -89,12 +82,12 @@ runs:
         set -euo pipefail
 
         podman_args=(
-          --root "${PODMAN_ROOT}"
+          --root "${RUNNER_TEMP}/podman-root"
-          --runroot "${PODMAN_RUNROOT}"
+          --runroot "${RUNNER_TEMP}/podman-runroot"
-          --storage-driver "${STORAGE_DRIVER}"
+          --storage-driver vfs
         )
 
-        build_cmd=(podman "${podman_args[@]}" build --isolation "${BUILD_ISOLATION}" -f "${{ inputs.containerfile }}")
+        build_cmd=(podman "${podman_args[@]}" build --isolation chroot -f "${{ inputs.containerfile }}")
 
         # Add build args
         while IFS= read -r build_arg; do
@@ -118,15 +111,10 @@ runs:
       run: |
         set -euo pipefail
 
-        if [[ "${{ inputs.push }}" != "true" ]]; then
-          echo "Push disabled by input push=${{ inputs.push }}"
-          exit 0
-        fi
-
         podman_args=(
-          --root "${PODMAN_ROOT}"
+          --root "${RUNNER_TEMP}/podman-root"
-          --runroot "${PODMAN_RUNROOT}"
+          --runroot "${RUNNER_TEMP}/podman-runroot"
-          --storage-driver "${STORAGE_DRIVER}"
+          --storage-driver vfs
         )
 
         echo "Pushing image tags:"