ci: split server release into independent binaries and image jobs

First tag run failed as one monolithic job. Binaries + Gitea release now
need only Go and curl (jq dropped too) and succeed on any runner; the
docker image build is a separate job that can fail without killing the
release self-update depends on.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/build-server.yml

@@ -1,6 +1,10 @@
-# Server RELEASE: on server-v* tags builds
-# and pushes the container image to the Gitea registry AND attaches static
-# binaries to a Gitea release (the artifact --self-update consumes).
+# Server RELEASE: on server-v* tags, builds static binaries and attaches them
+# to a Gitea release (the artifact --self-update consumes), and separately
+# builds + pushes the container image to the Gitea registry.
+#
+# Two independent jobs on purpose: the release job needs only Go + curl and
+# must succeed on any runner; the image job needs a Docker-capable runner and
+# may fail without taking the release down with it.
 #
 # Tags are namespaced (server-v1.2.3) so app releases (v*) and server
 # releases don't trigger each other's pipelines.
@@ -21,12 +25,9 @@ jobs:
       - uses: actions/setup-go@v5
         with: { go-version: "1.26", cache-dependency-path: server/go.mod }
 
-      - name: Derive version + registry coords
+      - name: Derive version
         id: meta
-        run: |
-          echo "version=${GITHUB_REF_NAME#server-}" >> "$GITHUB_OUTPUT"
-          HOST="${GITHUB_SERVER_URL#https://}"
-          echo "image=$HOST/${GITHUB_REPOSITORY,,}-server" >> "$GITHUB_OUTPUT"
+        run: echo "version=${GITHUB_REF_NAME#server-}" >> "$GITHUB_OUTPUT"
 
       - name: Build static binaries (linux amd64+arm64)
         working-directory: server
@@ -38,16 +39,6 @@ jobs:
           done
           (cd ../dist && sha256sum * > SHA256SUMS)
 
-      - name: Build + push image
-        run: |
-          echo "${{ secrets.GITHUB_TOKEN }}" | docker login "${GITHUB_SERVER_URL#https://}" -u "$GITHUB_ACTOR" --password-stdin
-          docker build server \
-            --build-arg VERSION=${{ steps.meta.outputs.version }} \
-            -t "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}" \
-            -t "${{ steps.meta.outputs.image }}:latest"
-          docker push "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}"
-          docker push "${{ steps.meta.outputs.image }}:latest"
-
       - name: Create release + attach binaries
         env:
           TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -56,8 +47,33 @@ jobs:
           REL=$(curl -sf -X POST "$API/releases" \
             -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
             -d "{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"$GITHUB_REF_NAME\"}")
-          ID=$(echo "$REL" | jq -r .id)
+          # jq-free id extraction — keep runner image requirements minimal
+          ID=$(echo "$REL" | sed -n 's/.*"id":\([0-9]*\).*/\1/p' | head -1)
           for f in dist/*; do
             curl -sf -X POST "$API/releases/$ID/assets?name=$(basename "$f")" \
               -H "Authorization: token $TOKEN" -F "attachment=@$f"
           done
+
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Derive version + registry coords
+        id: meta
+        run: |
+          echo "version=${GITHUB_REF_NAME#server-}" >> "$GITHUB_OUTPUT"
+          HOST="${GITHUB_SERVER_URL#https://}"
+          echo "host=$HOST" >> "$GITHUB_OUTPUT"
+          echo "image=$HOST/${GITHUB_REPOSITORY,,}-server" >> "$GITHUB_OUTPUT"
+
+      - name: Build + push image (needs a Docker-capable runner)
+        run: |
+          command -v docker >/dev/null || { echo "::error::no docker on this runner — image skipped; binaries/release are unaffected"; exit 1; }
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login "${{ steps.meta.outputs.host }}" -u "$GITHUB_ACTOR" --password-stdin
+          docker build server \
+            --build-arg VERSION=${{ steps.meta.outputs.version }} \
+            -t "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}" \
+            -t "${{ steps.meta.outputs.image }}:latest"
+          docker push "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}"
+          docker push "${{ steps.meta.outputs.image }}:latest"