Split build workflow to integrate dev build

.gitea/workflows/release.yml

@@ -0,0 +1,50 @@
+name: Publish Release Image
+
+# Promote the scanned dev image to the release tag (and latest); never rebuilds.
+on:
+  release:
+    types: [published]
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  promote:
+    runs-on: running-man
+    env:
+      REGISTRY: git.sysmd.uk
+      IMAGE: git.sysmd.uk/mdaleo404/kovi
+    steps:
+      - name: Login to registry
+        run: |
+          echo "$REGISTRY_TOKEN" | docker login "${REGISTRY}" -u "$REGISTRY_USER" --password-stdin
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Resolve tags
+        env:
+          EVENT_TAG: ${{ github.event.release.tag_name }}
+          PRERELEASE: ${{ github.event.release.prerelease }}
+        run: |
+          set -euo pipefail
+          TAG="${EVENT_TAG:?release tag missing}"
+          {
+            echo "TAG=${TAG}"
+            echo "SOURCE_REF=${IMAGE}:dev"
+          } >> "$GITHUB_ENV"
+          if [ "${PRERELEASE:-}" != "true" ]; then
+            echo "PUSH_LATEST=1" >> "$GITHUB_ENV"
+          fi
+          echo "Promoting ${IMAGE}:dev -> ${IMAGE}:${TAG}"
+
+      - name: Promote image
+        run: |
+          set -euo pipefail
+          TAGS=(-t "${IMAGE}:${TAG}")
+          if [ "${PUSH_LATEST:-}" = "1" ]; then TAGS+=(-t "${IMAGE}:latest"); fi
+          docker buildx imagetools create "${TAGS[@]}" "${SOURCE_REF}"