Run hosted Podman Feature tests rootfully

[Christof Marti (chrmarti)]

Summary

Run the existing Podman Feature integration tests rootfully on GitHub-hosted runners.

Session Context

Key decisions from the development session:

• Independent fix: This PR targets main and changes only the Podman test.
• Preserve coverage: The original image- and Dockerfile-based tests continue installing the Docker-in-Docker and hello Features.
• Hosted-runner regression: GitHub's runner switched from distro Podman 4.9.3 to a static Podman 5.8.4 bundle. APT fails only inside the full Feature build when it drops privileges to _apt.
• Configuration investigation: Disabling ignore_chown_errors, testing both bundled runtimes, and using Buildah chroot isolation did not fix the Feature build. Preflight tests confirmed /tmp is 1777 and _apt can write in normal containers and minimal RUN --mount builds.
• Limit the workaround: Only GitHub Actions uses a passwordless-sudo Podman wrapper. Local Podman tests retain their existing behavior.

Changes

• Create a temporary rootful Podman wrapper on GitHub Actions.
• Pass that executable to the CLI under test and use it for cleanup.
• Leave the original Feature workloads unchanged.

Validation

• Both push and pull-request Podman matrix jobs passed with the rootful wrapper.
• Podman test file type-loads successfully.
• yarn type-check
• yarn lint
• git diff --check

[Copilot]

Pull request overview

This PR restores rootless Podman feature-test reliability on GitHub-hosted runners by overriding a runner-image Podman storage option (overlay.ignore_chown_errors) that breaks APT’s _apt user during feature builds.

Changes:

• Reset the rootless Podman system state on GitHub Actions to start from a clean store.
• Write a minimal user-level storage.conf to set the overlay driver and disable ignore_chown_errors.
• Assert the effective Podman storage option via podman info before running the packaged CLI tests.

Show a summary per file

File	Description
src/test/cli.podman.test.ts	Adds GitHub Actions–specific rootless Podman storage reset + minimal storage.conf override, with a verification assertion before running the Podman feature tests.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite