From 5a0e181293139f8df9ff664a8659eefe35b2fb1c Mon Sep 17 00:00:00 2001
From: mram <mram@rambossek.at>
Date: Sun, 20 Sep 2026 18:12:00 +0200
Subject: [PATCH] CI: build release images only from vX.Y.Z tags

Tests still run on every push. The docker job is gated on ref_type=tag,
validates the tag is a strict vX.Y.Z semver, and publishes :<tag> plus
:latest. No branch images (sha-* / main latest) anymore.
---
 .gitea/workflows/ci.yml | 26 ++++++++++----------------
 README.md               |  9 +++++----
 SPEC.md                 | 10 +++++-----
 3 files changed, 20 insertions(+), 25 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index bfbb3f2..14c91f7 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -22,28 +22,20 @@ jobs:
             echo "golangci-lint not available in runner image, skipping"
           fi
 
+  # Release images are built only from version tags (vX.Y.Z).
   docker:
+    if: gitea.ref_type == 'tag'
     needs: test
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - name: Compute image tags and version
-        id: meta
+      - name: Check tag is semantic version
         run: |
-          SHORT=$(echo "${{ gitea.sha }}" | cut -c1-7)
-          REPO=git.rambossek.at/${{ gitea.repository }}
-          TAGS="$REPO:sha-$SHORT"
-          VERSION="sha-$SHORT"
-          if [ "${{ gitea.ref_type }}" = "branch" ] && [ "${{ gitea.ref_name }}" = "main" ]; then
-            TAGS="$TAGS,$REPO:latest"
+          if ! echo "${{ gitea.ref_name }}" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "tag '${{ gitea.ref_name }}' is not a vX.Y.Z semantic version" >&2
+            exit 1
           fi
-          if [ "${{ gitea.ref_type }}" = "tag" ]; then
-            TAGS="$TAGS,$REPO:${{ gitea.ref_name }}"
-            VERSION="${{ gitea.ref_name }}"
-          fi
-          echo "tags=$TAGS" >> "$GITHUB_OUTPUT"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - uses: docker/setup-buildx-action@v3
 
@@ -58,5 +50,7 @@ jobs:
           context: .
           push: true
           build-args: |
-            VERSION=${{ steps.meta.outputs.version }}
-          tags: ${{ steps.meta.outputs.tags }}
+            VERSION=${{ gitea.ref_name }}
+          tags: |
+            git.rambossek.at/${{ gitea.repository }}:${{ gitea.ref_name }}
+            git.rambossek.at/${{ gitea.repository }}:latest
diff --git a/README.md b/README.md
index 30ee6a0..0b92618 100644
--- a/README.md
+++ b/README.md
@@ -67,10 +67,11 @@ docker run --rm -p 11434:11434 -p 8188:8188 \
   gpu-turnstile
 ```
 
-Releases are built by Gitea Actions (`.gitea/workflows/ci.yml`): pushes run
-`go vet` and `go test -race` and publish
-`git.rambossek.at/<owner>/gpu-turnstile:sha-<short>`; `main` additionally gets
-`:latest`, and a git tag `vX.Y.Z` produces the versioned image.
+Releases are built by Gitea Actions (`.gitea/workflows/ci.yml`): every push
+runs `go vet` and `go test -race`, and pushing a semantic-version tag
+`vX.Y.Z` builds and publishes
+`git.rambossek.at/<owner>/gpu-turnstile:vX.Y.Z` (and updates `:latest`).
+No images are built from branches.
 
 ## Development
 
diff --git a/SPEC.md b/SPEC.md
index b5096d1..8061a48 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -181,14 +181,14 @@ are new.
   `scratch`), non-root user, `EXPOSE 8188 11434`,
   `ENTRYPOINT ["/gpu-turnstile"]`.
 - `.gitea/workflows/ci.yml` (Gitea Actions):
-  1. on push and tag: `go vet`, `go test -race ./...`, `golangci-lint` if
+  1. on every push: `go vet`, `go test -race ./...`, `golangci-lint` if
      available in the runner image
-  2. build image with buildx, tags `:sha-<short>` and `:latest` on main,
-     `:<tag>` on tags
-  3. push to the Gitea registry `git.rambossek.at/<owner>/gpu-turnstile`
+  2. on a version tag only (`vX.Y.Z`, enforced): build the image with buildx
+     and push it to the Gitea registry
+     `git.rambossek.at/<owner>/gpu-turnstile` tagged `:<tag>` and `:latest`,
      using the workflow token (`${{ secrets.GITEA_TOKEN }}` / `gitea.actor`)
 - Release: a git tag `vX.Y.Z` produces the versioned image; the Open WebUI
-  compose pins that tag.
+  compose pins that tag. No images are built from branches.
 
 ## Deployment (target)