ci: harden gitea workflow reruns

.gitea/workflows/build.yml

@@ -38,7 +38,12 @@ jobs:
         run: docker compose config
 
       - name: Build Docker image
-        run: docker build -t "${REGISTRY_HOST}/${REGISTRY_NAMESPACE}/${IMAGE_NAME}:${GITHUB_SHA}" .
+        shell: bash
+        run: |
+          image="${REGISTRY_HOST}/${REGISTRY_NAMESPACE}/${IMAGE_NAME}"
+          build_tag="build-${GITHUB_RUN_ID:-local}-${GITHUB_RUN_NUMBER:-0}"
+          echo "BUILD_IMAGE=${image}:${build_tag}" >> "$GITHUB_ENV"
+          docker build -t "${image}:${build_tag}" .
 
       - name: Publish Docker image
         if: ${{ env.REGISTRY_TOKEN != '' }}
@@ -47,8 +52,9 @@ jobs:
           image="${REGISTRY_HOST}/${REGISTRY_NAMESPACE}/${IMAGE_NAME}"
           date_tag="$(date -u +%Y%m%d)"
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY_HOST}" -u "${REGISTRY_USERNAME}" --password-stdin
-          docker tag "${image}:${GITHUB_SHA}" "${image}:latest"
-          docker tag "${image}:${GITHUB_SHA}" "${image}:${date_tag}"
+          docker tag "${BUILD_IMAGE}" "${image}:${GITHUB_SHA}"
+          docker tag "${BUILD_IMAGE}" "${image}:latest"
+          docker tag "${BUILD_IMAGE}" "${image}:${date_tag}"
           docker push "${image}:${GITHUB_SHA}"
           docker push "${image}:latest"
           docker push "${image}:${date_tag}"

.gitea/workflows/release-dry-run.yml

@@ -38,7 +38,7 @@ jobs:
 
           for path in "${placeholder_paths[@]}"; do
             [ -e "$path" ] || continue
-            if grep -RInE --exclude-dir=.git "$placeholder_pattern" "$path"; then
+            if grep -RInE --exclude-dir=.git --exclude='release-dry-run.yml' --exclude='template-compliance.yml' "$placeholder_pattern" "$path"; then
               echo "Unresolved template placeholders found."
               missing=1
             fi

.gitea/workflows/template-compliance.yml

@@ -58,7 +58,7 @@ jobs:
 
           for path in "${paths[@]}"; do
             [ -e "$path" ] || continue
-            if grep -RInE --exclude-dir=.git "$pattern" "$path"; then
+            if grep -RInE --exclude-dir=.git --exclude='release-dry-run.yml' --exclude='template-compliance.yml' "$pattern" "$path"; then
               found=1
             fi
           done