CI: build release images only from vX.Y.Z tags

Tests still run on every push. The docker job is gated on ref_type=tag,
validates the tag is a strict vX.Y.Z semver, and publishes :<tag> plus
:latest. No branch images (sha-* / main latest) anymore.

.gitea/workflows/ci.yml

@@ -22,28 +22,20 @@ jobs:
             echo "golangci-lint not available in runner image, skipping"
           fi
 
+  # Release images are built only from version tags (vX.Y.Z).
   docker:
+    if: gitea.ref_type == 'tag'
     needs: test
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - name: Compute image tags and version
-        id: meta
+      - name: Check tag is semantic version
         run: |
-          SHORT=$(echo "${{ gitea.sha }}" | cut -c1-7)
-          REPO=git.rambossek.at/${{ gitea.repository }}
-          TAGS="$REPO:sha-$SHORT"
-          VERSION="sha-$SHORT"
-          if [ "${{ gitea.ref_type }}" = "branch" ] && [ "${{ gitea.ref_name }}" = "main" ]; then
-            TAGS="$TAGS,$REPO:latest"
+          if ! echo "${{ gitea.ref_name }}" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "tag '${{ gitea.ref_name }}' is not a vX.Y.Z semantic version" >&2
+            exit 1
           fi
-          if [ "${{ gitea.ref_type }}" = "tag" ]; then
-            TAGS="$TAGS,$REPO:${{ gitea.ref_name }}"
-            VERSION="${{ gitea.ref_name }}"
-          fi
-          echo "tags=$TAGS" >> "$GITHUB_OUTPUT"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - uses: docker/setup-buildx-action@v3
 
@@ -58,5 +50,7 @@ jobs:
           context: .
           push: true
           build-args: |
-            VERSION=${{ steps.meta.outputs.version }}
-          tags: ${{ steps.meta.outputs.tags }}
+            VERSION=${{ gitea.ref_name }}
+          tags: |
+            git.rambossek.at/${{ gitea.repository }}:${{ gitea.ref_name }}
+            git.rambossek.at/${{ gitea.repository }}:latest