Harden CI and switch release builds to tagged immutable images

.forgejo/workflows/build.yml

@@ -1,25 +1,34 @@
-name: Automated Container Build
+name: Container release
 
 on:
   push:
-    branches:
-      - main
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
 
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
-
-      - name: Log into Local Registry
+      - uses: actions/checkout@v4
+      - name: Log into local registry
+        run: echo "${{ secrets.FORGEJO_PAT }}" | docker login git.elijahkuntz.com -u "${{ github.actor }}" --password-stdin
+      - name: Build and publish immutable release
+        env:
+          REPOSITORY: ${{ github.repository }}
+          REVISION: ${{ github.sha }}
+          TAG: ${{ github.ref_name }}
         run: |
-          echo "${{ secrets.FORGEJO_PAT }}" | docker login git.elijahkuntz.com -u "${{ gitea.actor }}" --password-stdin
-
-      - name: Build and Push Image
-        run: |
-          # Force the entire image path string to lowercase dynamically
-          IMAGE_PATH=$(echo "git.elijahkuntz.com/${{ gitea.actor }}/${{ github.event.repository.name }}:latest" | tr '[:upper:]' '[:lower:]')
-          
-          docker build -t "$IMAGE_PATH" .
-          docker push "$IMAGE_PATH"
+          IMAGE_PATH="git.elijahkuntz.com/$(echo "$REPOSITORY" | tr '[:upper:]' '[:lower:]')"
+          docker build \
+            --build-arg VERSION="$TAG+$REVISION" \
+            --label org.opencontainers.image.revision="$REVISION" \
+            --label org.opencontainers.image.version="$TAG" \
+            -t "$IMAGE_PATH:$TAG" \
+            -t "$IMAGE_PATH:sha-$REVISION" \
+            -t "$IMAGE_PATH:latest" .
+          docker push "$IMAGE_PATH:$TAG"
+          docker push "$IMAGE_PATH:sha-$REVISION"
+          docker push "$IMAGE_PATH:latest"