ci: fix if-expression syntax and restructure into separate jobs

- Replace complex single-job conditional steps with 3 separate jobs:
  build-only, build-and-push-main, build-and-push-tag
- Use Gitea Actions-compatible startsWith() function instead of
  .startsWith() method call
- Remove nested parentheses that Gitea Actions cannot parse
- Push only on refs/heads/main and refs/tags/v* (not all branches)

.github/workflows/build-publish.yaml

@@ -3,15 +3,17 @@ name: Build and Publish Docker Image
 on:
   push:
     branches:
-      - '**'  # All branches
+      - '**'
   pull_request:
     types: [opened, synchronize, reopened]
   create:
     refs/tags/v*
 
 jobs:
-  build:
+  build-only:
     runs-on: ubuntu-latest
+    # All branches, all PRs, and anything that's not a push to main or a version tag
+    if: github.event_name != 'push' || (github.event_name == 'push' && !startsWith(gitea.ref, 'refs/tags/v') && gitea.ref != 'refs/heads/main')
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -19,14 +21,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Extract metadata
-        id: meta
-        run: |
-          echo "sha=${{ gitea.sha }}" >> $GITHUB_OUTPUT
-          echo "ref=${{ gitea.ref }}" >> $GITHUB_OUTPUT
-
-      - name: Build (no push — all branches and PRs)
-        if: github.event_name != 'push' || (github.event_name == 'push' && !gitea.ref.startsWith('refs/tags/v') && gitea.ref != 'refs/heads/main')
+      - name: Build (no push)
         uses: docker/build-push-action@v5
         with:
           context: .
@@ -37,8 +32,17 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+  build-and-push-main:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && gitea.ref == 'refs/heads/main'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Login to Docker Registry
-        if: github.event_name == 'push' && (gitea.ref.startsWith('refs/tags/v') || gitea.ref == 'refs/heads/main')
         uses: docker/login-action@v3
         with:
           registry: ${{ secrets.DOCKER_REGISTRY }}
@@ -46,7 +50,6 @@ jobs:
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Build and push (main branch)
-        if: github.event_name == 'push' && gitea.ref == 'refs/heads/main'
         uses: docker/build-push-action@v5
         with:
           context: .
@@ -62,8 +65,24 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+  build-and-push-tag:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && startsWith(gitea.ref, 'refs/tags/v')
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ secrets.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
       - name: Build and push (tagged release)
-        if: github.event_name == 'push' && gitea.ref.startsWith('refs/tags/v')
         uses: docker/build-push-action@v5
         with:
           context: .