ci: tag docker images of releases

- rework tag pattern match to match X.Y and X.Y.Z
- bring back latest tags for releases and protect them in cleanup

Author: j4n

.github/workflows/cleanup.yaml

@@ -47,12 +47,12 @@ jobs:
           package-name: ${{ env.PACKAGE_NAME }}
           package-type: container
           min-versions-to-keep: 30
-          ignore-versions: '^(main|latest|\d+\.\d+)$'
+          ignore-versions: '^(main|latest|\d+\.\d+|\d+\.\d+\.\d+)$'
 
   cleanup-branch:
     name: Clean up branch images
     runs-on: ubuntu-latest
-    if: github.event_name == 'delete'
+    if: github.event_name == 'delete' && github.event.ref_type == 'branch'
     permissions:
       packages: write
     steps:

.github/workflows/docker-ci.yaml

@@ -98,6 +98,7 @@ jobs:
           RELAY_REF_INPUT: ${{ steps.relay.outputs.ref }}
           EVENT_NAME: ${{ github.event_name }}
           REF_NAME: ${{ github.ref_name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
           RELAY_REF="${RELAY_REF_INPUT}"
@@ -127,11 +128,24 @@ jobs:
             BRANCH_TAG=$(echo "${RELAY_REF}" | sed 's|/|-|g')
             TAGS="${TAGS}"$'\n'"${IMAGE}:${BRANCH_TAG}"
             if [[ "${RELAY_REF}" =~ ^v?([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
-              VERSION="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.${BASH_REMATCH[3]}"
-              MINOR="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
-              TAGS="${TAGS}"$'\n'"${IMAGE}:${VERSION}"
-              TAGS="${TAGS}"$'\n'"${IMAGE}:${MINOR}"
-              TAGS="${TAGS}"$'\n'"${IMAGE}:latest"
+              MAJOR="${BASH_REMATCH[1]}"
+              MINOR="${BASH_REMATCH[2]}"
+              PATCH="${BASH_REMATCH[3]}"
+              VERSION="${MAJOR}.${MINOR}.${PATCH}"
+              TAGS="${TAGS}"$'\n'"${IMAGE}:${VERSION}"$'\n'"${IMAGE}:${MAJOR}.${MINOR}"
+              # `latest` only if this is the highest semver published so far,
+              # so a back-ported patch on an old minor line cannot clobber it.
+              HIGHEST=$(gh api \
+                "orgs/chatmail/packages/container/docker/versions?per_page=100" \
+                --jq '[.[].metadata.container.tags[]
+                  | select(test("^[0-9]+\\.[0-9]+\\.[0-9]+$"))]
+                  | sort_by(split(".") | map(tonumber)) | last // empty' \
+                2>/dev/null) || true
+              if [ -z "$HIGHEST" ] || \
+                 [ "$(printf '%s\n%s\n' "$HIGHEST" "$VERSION" \
+                      | sort -V | tail -1)" = "$VERSION" ]; then
+                TAGS="${TAGS}"$'\n'"${IMAGE}:latest"
+              fi
             fi
           fi
           echo "tags<<EOF" >> "$GITHUB_OUTPUT"