From ddc9f4ddee3666afeaab18ab6f4f0c717909bce8 Mon Sep 17 00:00:00 2001
From: arnef <dev@arnef.de>
Date: Fri, 21 Aug 2026 20:02:23 +0200
Subject: [PATCH] Align Docker release workflow with the ebooks project's
 registry setup

Switch from a dynamically-derived registry/GITHUB_TOKEN login to the
same pattern already proven in the ebooks project: a fixed
git.arnef.de/arnef/nidus registry/image, docker/login-action with
REGISTRY_USERNAME/REGISTRY_PASSWORD repo secrets, docker/metadata-action
for tag/label generation (version, major.minor, latest, short SHA), and
a final buildx/system prune cleanup step. Also add a manual
workflow_dispatch trigger.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/docker-release.yml | 74 +++++++++++++---------------
 README.md                            | 10 ++--
 2 files changed, 40 insertions(+), 44 deletions(-)

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index dec3f62..e99423c 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -1,64 +1,58 @@
-name: Docker release
-
-# Builds and publishes a multi-arch (linux/amd64 + linux/arm64) Docker
-# image whenever a version tag (e.g. "v1.2.3") is pushed, or a release is
-# published for one. Written against the GitHub Actions syntax, which
-# Gitea Actions runs unmodified — the ${{ github.* }} context and
-# secrets.GITHUB_TOKEN are provided as compatibility aliases by Gitea's
-# act runner, so this workflow works as-is on either platform.
-#
-# The image is pushed to this server's own container registry, addressed
-# as "<host>/<owner>/<repo>" (e.g. git.example.com/owner/nidus on Gitea,
-# or ghcr.io/owner/nidus if this repo is ever mirrored to GitHub).
+name: Docker Image bauen und veröffentlichen
 
 on:
   push:
-    tags:
-      - "v*"
+    tags: ["v*"]
   release:
     types: [published]
+  workflow_dispatch: {}
+
+env:
+  REGISTRY: git.arnef.de
+  IMAGE_NAME: arnef/nidus
 
 jobs:
   docker:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
-      - name: Check out repository
+      - name: Repository auschecken
         uses: actions/checkout@v4
 
-      - name: Determine registry, image name, and tags
-        id: vars
-        run: |
-          registry="$(echo "${{ github.server_url }}" | sed -E 's#^https?://##')"
-          image_name="$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')"
-          image="${registry}/${image_name}"
-          version="${GITHUB_REF_NAME#v}"
-
-          {
-            echo "registry=${registry}"
-            echo "image=${image}"
-            echo "tags=${image}:${version},${image}:latest"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Set up QEMU
+      - name: QEMU einrichten (für Cross-Platform-Builds)
         uses: docker/setup-qemu-action@v3
 
-      - name: Set up Docker Buildx
+      - name: Docker Buildx einrichten
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to the container registry
+      - name: Bei Registry anmelden
         uses: docker/login-action@v3
         with:
-          registry: ${{ steps.vars.outputs.registry }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
 
-      - name: Build and push
+      - name: Metadaten (Tags/Labels) ermitteln
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,prefix=,format=short
+
+      - name: Image bauen und pushen (amd64 + arm64)
         uses: docker/build-push-action@v6
         with:
           context: .
           platforms: linux/amd64,linux/arm64
           push: true
-          tags: ${{ steps.vars.outputs.tags }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Build-Umgebung aufräumen
+        if: always()
+        run: |
+          docker buildx prune --all --force
+          docker system prune --all --force --volumes
diff --git a/README.md b/README.md
index f661794..4d367c9 100644
--- a/README.md
+++ b/README.md
@@ -108,14 +108,16 @@ docker compose exec davserver nidusctl -config /app/config.yaml addressbook crea
 Pushing a version tag (e.g. `v1.2.3`) or publishing a release triggers
 [`.github/workflows/docker-release.yml`](.github/workflows/docker-release.yml),
 which builds and publishes a multi-arch (`linux/amd64` + `linux/arm64`)
-image to this repository's own container registry, tagged with both the
-version and `latest`. Point `docker-compose.yaml`'s `image:` at it instead
-of `build: .` to use it directly, e.g.:
+image to `git.arnef.de/arnef/nidus`, tagged with the version, `<major>.<minor>`,
+`latest`, and the short commit SHA. It authenticates via the
+`REGISTRY_USERNAME`/`REGISTRY_PASSWORD` repository secrets. Point
+`docker-compose.yaml`'s `image:` at it instead of `build: .` to use it
+directly, e.g.:
 
 ```yaml
 services:
   davserver:
-    image: <registry>/<owner>/<repo>:latest
+    image: git.arnef.de/arnef/nidus:latest
 ```
 
 ---