ci: publish images to the Gitea registry, use the gitea context

Release now pushes to git.lucasrguerra.dev.br instead of ghcr.io, tags each
architecture separately (no artifact upload, no gha cache) and joins them with
imagetools. GITHUB_OUTPUT and GITHUB_STEP_SUMMARY stay: they are the runner's
own interface and the GITEA_* equivalents are not set.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -1,8 +1,9 @@
 name: Release
 
-# Publishes the four service images to GHCR after a merge into main, and again
-# under semver tags when a v* tag is pushed. The deploy host only pulls, so
-# nothing has to be built on the server.
+# Publishes the service images to the Gitea container registry after a merge
+# into main, and again under semver tags when a v* tag is pushed. The deploy
+# host only pulls, so nothing has to be built on the server. Needs the user
+# secret REGISTRY_TOKEN (a Gitea token with the write:package scope).
 on:
   push:
     branches: [main]
@@ -14,15 +15,15 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  REGISTRY: ghcr.io
+  REGISTRY: git.lucasrguerra.dev.br
 
 jobs:
   # Nothing is published unless the full suite passes first.
   ci:
-    uses: ./.github/workflows/ci.yml
+    uses: ./.gitea/workflows/ci.yml
 
-  # GHCR rejects an uppercase path, and this repository is "lucasrguerra/LambdaMail".
-  # Lowercasing github.repository here keeps the workflow fork-safe instead of
+  # Registry paths must be lowercase, and this repository is "lucasrguerra/LambdaMail".
+  # Lowercasing gitea.repository here keeps the workflow fork-safe instead of
   # hardcoding the owner.
   prepare:
     name: Namespace das imagens
@@ -31,7 +32,10 @@ jobs:
       namespace: ${{ steps.namespace.outputs.value }}
     steps:
       - id: namespace
-        run: echo "value=${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
+        # GITHUB_OUTPUT is the runner's own interface: Gitea sets it under that name.
+        run: |
+          repo='${{ gitea.repository }}'
+          echo "value=${repo,,}" >> "$GITHUB_OUTPUT"
 
   # Each architecture is built on a runner of its own kind. QEMU emulation
   # would also work, but it makes the Go and Next builds roughly an order of
@@ -54,7 +58,7 @@ jobs:
         platform: [linux/amd64, linux/arm64]
         include:
           - platform: linux/amd64
-            runner: ubuntu-latest
+            runner: linux-amd64
             arch: amd64
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
@@ -64,12 +68,12 @@ jobs:
 
       - uses: docker/setup-buildx-action@v4
 
-      - name: Autentica no GHCR
+      - name: Autentica no registro
         uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Metadados
         id: meta
@@ -77,9 +81,10 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}/${{ matrix.service }}
 
-      # Pushed by digest only: the tags are attached later, once both
-      # architectures exist and can be joined into a single manifest list.
-      - name: Build e push por digest
+      # Each architecture is pushed under its own tag (no digest artifacts: they
+      # are not portable to Gitea). The final tags are attached later, once both
+      # exist and can be joined into a single manifest list.
+      - name: Build e push por arquitetura
         id: build
         uses: docker/build-push-action@v7
         with:
@@ -87,26 +92,10 @@ jobs:
           file: services/${{ matrix.service }}/Dockerfile
           platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
-          outputs: type=image,name=${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}/${{ matrix.service }},push-by-digest=true,name-canonical=true,push=true
-          cache-from: type=gha,scope=${{ matrix.service }}-${{ matrix.arch }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.service }}-${{ matrix.arch }}
-
-      - name: Exporta o digest
-        run: |
-          mkdir -p /tmp/digests
-          # The output already carries the `sha256:` prefix; the file name must
-          # not, since the merge step prepends it again.
-          digest='${{ steps.build.outputs.digest }}'
-          touch "/tmp/digests/${digest#sha256:}"
-
-      - name: Guarda o digest
-        uses: actions/upload-artifact@v7
-        with:
-          # Slashes are not allowed in artifact names, hence the arch alias.
-          name: digest-${{ matrix.service }}-${{ matrix.arch }}
-          path: /tmp/digests/*
-          retention-days: 1
-          if-no-files-found: error
+          push: true
+          tags: ${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}/${{ matrix.service }}:build-${{ gitea.sha }}-${{ matrix.arch }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}/${{ matrix.service }}:buildcache-${{ matrix.arch }}
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}/${{ matrix.service }}:buildcache-${{ matrix.arch }},mode=max
 
   publish:
     name: Publica ${{ matrix.service }}
@@ -124,19 +113,12 @@ jobs:
 
       - uses: docker/setup-buildx-action@v4
 
-      - name: Autentica no GHCR
+      - name: Autentica no registro
         uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Recupera os digests
-        uses: actions/download-artifact@v7
-        with:
-          pattern: digest-${{ matrix.service }}-*
-          merge-multiple: true
-          path: /tmp/digests
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       # `latest` is what compose pulls. The semver tags only materialise on a
       # v* tag push and make it possible to pin or roll back to an exact
@@ -156,11 +138,11 @@ jobs:
       # Joins both architectures under one manifest list, so `docker pull`
       # resolves to the right one automatically.
       - name: Cria o manifesto multi-arquitetura
-        working-directory: /tmp/digests
         run: |
+          image='${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}/${{ matrix.service }}'
           docker buildx imagetools create \
             $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< '${{ steps.meta.outputs.json }}') \
-            $(printf '${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}/${{ matrix.service }}@sha256:%s ' *)
+            "$image:build-${{ gitea.sha }}-amd64" "$image:build-${{ gitea.sha }}-arm64"
 
       - name: Confere o resultado
         run: |