publish.yml passed the computed version into the image build, and the
first port of it to GitLab CI did not. A tag pushed with that port would
have shipped an image reporting itself unversioned (or, for ihasvpn, with a
stray leading "v" no earlier build had), and tagged it with the git tag
rather than the version string.
The version is now computed the way publish.yml computed it and passed as
the build arg, and the image is tagged with it, '+' turned into '-' where a
Docker tag needs that.
Ports ci.yml and publish.yml after the GitHub account was suspended and
ghcr.io/coffey-labs/ihasvpn went dark with it. The deployment on Web_Host
was still pulling that tag, and the only surviving copy was the image
already on the host -- amd64 only. This rebuilds the multi-arch tag.
The workflow built each platform on a native runner; there is one amd64
runner here, so arm64 goes through QEMU. Slower, and tag-driven for that
reason, but shipping amd64 only is exactly what the suspension already cost
us once.
The Actions workflows stay in the tree as the reference.
jcoffey-dev