ci: update build-publish workflow

- Run on all branches and PRs (build-only, no push)
- Push to registry only on main and version tags (v*)
- main branch: tag as :main, :latest, :<sha>
- version tags (v*): tag as :<tag>, :latest, :<sha>
- Use gitea context vars (gitea.sha, gitea.ref, gitea.ref_name, gitea.repository)

.github/workflows/build-publish.yaml

@@ -3,11 +3,15 @@ name: Build and Publish Docker Image
 on:
   push:
     branches:
-      - main  # Trigger on pushes to main
+      - '**'  # All branches
+  pull_request:
+    types: [opened, synchronize, reopened]
+  create:
+    refs/tags/v*
 
 jobs:
-  build-and-push:
-    runs-on: ubuntu-latest  # Ensure your Gitea runner has this label
+  build:
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -15,25 +19,60 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      # Login to your registry (Docker Hub, Gitea Package Registry, or Harbor)
+      - name: Extract metadata
+        id: meta
+        run: |
+          echo "sha=${{ gitea.sha }}" >> $GITHUB_OUTPUT
+          echo "ref=${{ gitea.ref }}" >> $GITHUB_OUTPUT
+
+      - name: Build (no push — all branches and PRs)
+        if: github.event_name != 'push' || (github.event_name == 'push' && !gitea.ref.startsWith('refs/tags/v') && gitea.ref != 'refs/heads/main')
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          push: false
+          tags: |
+            ${{ secrets.DOCKER_REGISTRY }}/${{ secrets.DOCKER_USERNAME }}/email-classifier:build-test
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
       - name: Login to Docker Registry
+        if: github.event_name == 'push' && (gitea.ref.startsWith('refs/tags/v') || gitea.ref == 'refs/heads/main')
         uses: docker/login-action@v3
         with:
-          registry: ${{ secrets.DOCKER_REGISTRY }} # Remove if using Docker Hub
+          registry: ${{ secrets.DOCKER_REGISTRY }}
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Build and push
+      - name: Build and push (main branch)
+        if: github.event_name == 'push' && gitea.ref == 'refs/heads/main'
         uses: docker/build-push-action@v5
         with:
           context: .
           file: Dockerfile
           push: true
-          # Tags the image as 'latest' and also uses the git SHA for versioning
           tags: |
-            ${{ secrets.DOCKER_REGISTRY }}/${{ secrets.DOCKER_USERNAME }}/email-classifier:${{ gitea.sha }}
+            ${{ secrets.DOCKER_REGISTRY }}/${{ secrets.DOCKER_USERNAME }}/email-classifier:main
             ${{ secrets.DOCKER_REGISTRY }}/${{ secrets.DOCKER_USERNAME }}/email-classifier:latest
-          # Caching speeds up builds by reusing layers (crucial for 'uv' installs)
+            ${{ secrets.DOCKER_REGISTRY }}/${{ secrets.DOCKER_USERNAME }}/email-classifier:${{ gitea.sha }}
+          labels: |
+            org.opencontainers.image.source=${{ gitea.server_url }}/${{ gitea.repository }}
+            org.opencontainers.image.description=Email Classifier Service
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build and push (tagged release)
+        if: github.event_name == 'push' && gitea.ref.startsWith('refs/tags/v')
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          push: true
+          tags: |
+            ${{ secrets.DOCKER_REGISTRY }}/${{ secrets.DOCKER_USERNAME }}/email-classifier:${{ gitea.ref_name }}
+            ${{ secrets.DOCKER_REGISTRY }}/${{ secrets.DOCKER_USERNAME }}/email-classifier:latest
+            ${{ secrets.DOCKER_REGISTRY }}/${{ secrets.DOCKER_USERNAME }}/email-classifier:${{ gitea.sha }}
           labels: |
             org.opencontainers.image.source=${{ gitea.server_url }}/${{ gitea.repository }}
             org.opencontainers.image.description=Email Classifier Service