ci: update build-publish workflow

- Run on all branches and PRs (build-only, no push)
- Push to registry only on main and version tags (v*)
- main branch: tag as :main, :latest, :<sha>
- version tags (v*): tag as :<tag>, :latest, :<sha>
- Use gitea context vars (gitea.sha, gitea.ref, gitea.ref_name, gitea.repository)

.github/workflows/build-publish.yaml

@@ -3,17 +3,15 @@ name: Build and Publish Docker Image
 on:
   push:
     branches:
-      - '**'
+      - '**'  # All branches
   pull_request:
     types: [opened, synchronize, reopened]
   create:
     refs/tags/v*
 
 jobs:
-  build-only:
+  build:
     runs-on: ubuntu-latest
-    # All branches, all PRs, and anything that's not a push to main or a version tag
-    if: github.event_name != 'push' || (github.event_name == 'push' && !startsWith(gitea.ref, 'refs/tags/v') && gitea.ref != 'refs/heads/main')
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -21,7 +19,14 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Build (no push)
+      - name: Extract metadata
+        id: meta
+        run: |
+          echo "sha=${{ gitea.sha }}" >> $GITHUB_OUTPUT
+          echo "ref=${{ gitea.ref }}" >> $GITHUB_OUTPUT
+
+      - name: Build (no push — all branches and PRs)
+        if: github.event_name != 'push' || (github.event_name == 'push' && !gitea.ref.startsWith('refs/tags/v') && gitea.ref != 'refs/heads/main')
         uses: docker/build-push-action@v5
         with:
           context: .
@@ -32,17 +37,8 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-  build-and-push-main:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && gitea.ref == 'refs/heads/main'
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
       - name: Login to Docker Registry
+        if: github.event_name == 'push' && (gitea.ref.startsWith('refs/tags/v') || gitea.ref == 'refs/heads/main')
         uses: docker/login-action@v3
         with:
           registry: ${{ secrets.DOCKER_REGISTRY }}
@@ -50,6 +46,7 @@ jobs:
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Build and push (main branch)
+        if: github.event_name == 'push' && gitea.ref == 'refs/heads/main'
         uses: docker/build-push-action@v5
         with:
           context: .
@@ -65,24 +62,8 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-  build-and-push-tag:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && startsWith(gitea.ref, 'refs/tags/v')
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to Docker Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ secrets.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
       - name: Build and push (tagged release)
+        if: github.event_name == 'push' && gitea.ref.startsWith('refs/tags/v')
         uses: docker/build-push-action@v5
         with:
           context: .