feature: replace Docker with Buildah in CI

.github/workflows/main.yml

@@ -42,7 +42,7 @@ jobs:
           git diff .SRCINFO
 
   publish:
-    name: Publish container image
+    name: Publish OCI image
     needs: pretest
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
@@ -51,8 +51,15 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v2.4.0
 
-      - name: OCI meta
-        id: meta
+      - name: Log in to ghcr.io
+        uses: redhat-actions/podman-login@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: OCI metadata
+        id: metadata
         uses: docker/metadata-action@v3
         with:
           images: ghcr.io/${{ github.repository }}
@@ -64,29 +71,28 @@ jobs:
             type=semver,pattern={{major}}
             type=sha
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-
-      - name: Login to GHCR
-        uses: docker/login-action@v1
+      - name: Build image
+        id: build
+        uses: redhat-actions/buildah-build@v2
         with:
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}
+          containerfiles: |
+            ./Dockerfile
+          extra-args: |
+            --pull
+
+      - name: Push to ghcr.io
+        uses: redhat-actions/push-to-registry@v2
+        with:
+          image: ${{ steps.build.outputs.image }}
+          tags: ${{ steps.build.outputs.tags }}
           registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v2
-        with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          extra-args: |
+            --disable-content-trust
 
   test:
-    name: Test (with prebuilt Container Image)
+    name: Test (with prebuilt OCI Image)
     needs: publish
     runs-on: ubuntu-latest