Programmatic image tagging for CI/CD flow

.gitea/workflows/docker-build.yml

@@ -2,6 +2,8 @@ name: Docker Build and Push (Multi-architecture)
 
 on:
   push:
+    branches: [ main, experimental ]
+    tags: [ 'v*.*.*' ]
   workflow_dispatch:
     inputs:
       image_tag:
@@ -36,6 +38,39 @@ jobs:
           username: ${{ secrets.REGISTRY_USERNAME }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
+      - name: Determine Docker tags
+        id: tags
+        run: |
+          # Default tag from workflow_dispatch input
+          if [ -n "${{ github.event.inputs.image_tag }}" ]; then
+            PRIMARY_TAG="${{ github.event.inputs.image_tag }}"
+          # Tag for release (semantic version tag)
+          elif [[ ${{ github.ref }} == refs/tags/v* ]]; then
+            PRIMARY_TAG="${GITHUB_REF#refs/tags/}"
+            # Also create a major.minor tag (e.g., v1.2 for v1.2.3)
+            MAJOR_MINOR_TAG=$(echo "$PRIMARY_TAG" | sed -E 's/^v([0-9]+\.[0-9]+)\.[0-9]+.*$/v\1/')
+            if [[ "$MAJOR_MINOR_TAG" != "$PRIMARY_TAG" ]]; then
+              echo "major_minor_tag=$MAJOR_MINOR_TAG" >> $GITHUB_OUTPUT
+            fi
+            # Also create a major tag (e.g., v1 for v1.2.3)
+            MAJOR_TAG=$(echo "$PRIMARY_TAG" | sed -E 's/^v([0-9]+)\.[0-9]+\.[0-9]+.*$/v\1/')
+            if [[ "$MAJOR_TAG" != "$PRIMARY_TAG" ]]; then
+              echo "major_tag=$MAJOR_TAG" >> $GITHUB_OUTPUT
+            fi
+          # Tag for main branch
+          elif [[ ${{ github.ref }} == refs/heads/main ]]; then
+            PRIMARY_TAG="latest"
+          # Tag for experimental branch
+          elif [[ ${{ github.ref }} == refs/heads/experimental ]]; then
+            PRIMARY_TAG="experimental"
+          fi
+          
+          echo "primary_tag=$PRIMARY_TAG" >> $GITHUB_OUTPUT
+          echo "Using primary tag: $PRIMARY_TAG"
+          
+          # Always include SHA tag for traceability
+          echo "sha_tag=${{ github.sha }}" >> $GITHUB_OUTPUT
+
       - name: Build and push multi-arch image
         uses: docker/build-push-action@v4
         with:
@@ -45,5 +80,7 @@ jobs:
           cache-from: type=registry,ref=${{ vars.REGISTRY }}/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }}:cache
           cache-to: type=registry,ref=${{ vars.REGISTRY }}/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }}:cache,mode=max
           tags: |
-            ${{ vars.REGISTRY }}/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }}:${{ github.event.inputs.image_tag || 'latest' }}
+            ${{ vars.REGISTRY }}/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }}:${{ steps.tags.outputs.primary_tag }}
-            ${{ vars.REGISTRY }}/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }}:${{ github.sha }}
+            ${{ vars.REGISTRY }}/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }}:${{ steps.tags.outputs.sha_tag }}
+            ${{ vars.REGISTRY }}/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }}:${{ steps.tags.outputs.major_minor_tag }}
+            ${{ vars.REGISTRY }}/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }}:${{ steps.tags.outputs.major_tag }}