Update redhat-actions/buildah-build action to v3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
redhat-actions/buildah-build	action	major	v2 → v3

---

Release Notes

redhat-actions/buildah-build (redhat-actions/buildah-build)

v3.1.0

Compare Source

New Features

• Sequential multi-arch builds: Add sequential input to run multi-arch builds one at a time instead of in parallel. Parallel remains the default, but sequential mode avoids qemu-related failures with FROM --platform=$(BUILDPLATFORM) stages. #​191
• Disable fuse-overlayfs override: Add disable-fuse-overlayfs input to prevent the action from overriding the storage mount program. The action now auto-detects kernel support for rootless native overlayfs (5.11+) and skips the fuse-overlayfs override when the kernel is new enough. This fixes silent data corruption and performance regressions on ubuntu-24.04 runners. #​193

Bug Fixes

• Fix digest output for non-x86 multi-arch builds: The digest output failed with image not known when the manifest only contained non-amd64 images (e.g. ppc64le, s390x). The action now uses buildah manifest inspect for multi-arch builds, which is architecture-agnostic. #​192

CI & Infrastructure

• Add workflow to rebuild bundle on Dependabot PRs. #​180
• Update CODEOWNERS to use @​redhat-actions/maintainers. Remove repo-level SECURITY.md in favor of org-wide default.

Dependency Updates

• Bump esbuild from 0.28.1 to 0.28.2. #​187
• Bump typescript-eslint from 8.65.0 to 8.67.0. #​185, #​188
• Bump eslint from 10.7.0 to 10.8.1. #​178, #​184
• Bump @​types/node from 26.1.1 to 26.2.0. #​179, #​183
• Bump undici from 6.27.0 to 6.28.0. #​181
• Bump postcss from 8.5.22 to 8.5.25. #​182

v3.0.2

Compare Source

Bug Fixes

• Fix container mode "image not known" error: Each containerized buildah command ran in a new disposable container with its own storage. Images built by buildah bud were invisible to subsequent buildah tag and buildah images commands. All containerized buildah invocations now pass --root <storageRoot> to share the bind-mounted host storage. #​177

CI & Infrastructure

• Add integration test for buildah-image container mode with multiple tags. #​177
• Consolidate three containerfile build workflows into one (native, containerized, case normalization). #​177

v3.0.1

Compare Source

Bug Fixes

• Fix container mode storage permission error: The buildah-image feature hardcoded the rootful storage path /var/lib/containers/storage, which fails with permission denied on rootless runners. The action now detects the host's actual storage root via podman info at runtime, with a fallback to the previous path. #​175

CI & Infrastructure

• Add unit test suite using vitest and a test job in CI. #​175

v3.0.0

Compare Source

Breaking Changes

• Node.js 24 runtime: The action now runs on the Node.js 24 runtime (runs.using: node24). GitHub Actions runners must support this runtime. #​154
• Squash defaults to true: The squash input now defaults to true, matching common usage. Set squash: false to preserve intermediate layers. #​161

New Features

• Annotations input: Add OCI annotations to images using the new annotations input. Separate multiple annotations by newline. Only supported by OCI images. #​161
• Container mode (buildah-image input): Run buildah from a container image instead of the host-installed version. Useful for getting a newer buildah than what the runner provides. For example, buildah-image: quay.io/buildah/stable. #​168
• Podman fallback: When buildah is not installed on the runner, the action automatically falls back to using podman build for containerfile builds. Scratch builds still require buildah. #​169
• Multiple ports: The port input now accepts multiple ports separated by newline. #​165
• Parallel multi-arch builds: When building for multiple architectures, each architecture is now built in parallel for significantly faster builds. #​167
• Architecture verification: After each multi-arch build, the action verifies the output image matches the expected architecture, catching misconfigured emulation early. #​166
• Image digest output: The digest output now reliably returns the content digest of the built image. #​153, #​165

Bug Fixes

• Fix empty entrypoint being set when the input is not provided. #​161
• Fix containerfile path resolution to check both workspace and context directory. #​165
• Fix digest retrieval using buildah images --format {{.Digest}} instead of buildah inspect which returned the wrong type. #​165

CI & Infrastructure

• Modernize all CI workflows: upgrade to actions/checkout@v7, actions/setup-node@v7, ubuntu-24.04 runners. #​156
• Add workflow permissions, concurrency groups, and path filters. #​156
• Remove broken install_latest_buildah.sh script and simplify CI matrices. #​164
• Remove defunct CRDA vulnerability scan workflow. #​170
• Enable Dependabot for npm and GitHub Actions dependencies. #​156
• Add CODEOWNERS, SECURITY.md. #​156

Dependency Updates

• Upgrade TypeScript to 6.x. #​163
• Upgrade ESLint to 10 with flat config. #​156
• Upgrade @actions/core, @actions/exec, @actions/io to latest versions. #​150, #​156
• Upgrade @types/node to v26. #​159
• Upgrade redhat-actions/common to v2. #​158

v3

Compare Source

Bug Fixes

• Fix container mode "image not known" error: Each containerized buildah command ran in a new disposable container with its own storage. Images built by buildah bud were invisible to subsequent buildah tag and buildah images commands. All containerized buildah invocations now pass --root <storageRoot> to share the bind-mounted host storage. #​177

CI & Infrastructure

• Add integration test for buildah-image container mode with multiple tags. #​177
• Consolidate three containerfile build workflows into one (native, containerized, case normalization). #​177

v2.13

Compare Source

• Update action to run on Node20. https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/

v2.12

Compare Source

• Forcibly remove existing manifest before creating a new one. #​103

v2.11

Compare Source

• Update action to run on Node16. https://github.blog/changelog/2022-05-20-actions-can-now-run-in-a-node-js-16-runtime/

v2.10

Compare Source

• Make image and tag in lowercase, if found in uppercase. #​89
• Add --tls-verify and extra-args input for buildah from command. #​92
• Remove kubic packages from test workflows. #​93

v2.9

Compare Source

• Add support for multiple archs and platforms.
• Allow building image manifest if multi arch or platform is provided.

v2.8

Compare Source

• Allow fully qualified image names in tags input, for compatibility with docker/metadata-action`. #​74
• Support for --platform argument #​65

v2.7

Compare Source

• Add output image-with-tag which provides image name and its corresponding first tag present.
• Replace input dockerfiles with containerfiles. Input dockerfiles will be present as alias of containerfiles.
• Add matrix to install latest buildah. (Internal)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.