ci: publish portable containers after successful main deployment

.gitea/workflows/ci.yaml

@@ -82,3 +82,25 @@ jobs:
         env:
           DEPLOY_BRANCH: ${{ gitea.ref_name }}
         run: bash scripts/ci-deploy.sh
+
+  # Publish only after checks and the production deployment have succeeded.
+  # Serial execution also avoids two builds competing on the self-hosted runner.
+  publish-container:
+    needs: deploy
+    if: gitea.event_name == 'push' && (gitea.ref_name == 'main' || gitea.ref_name == 'master')
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ gitea.repository }}
+          token: ${{ gitea.token }}
+
+      - name: Build, verify portability and publish
+        shell: bash
+        env:
+          REGISTRY_SERVER: ${{ gitea.server_url }}
+          REGISTRY_REPOSITORY: ${{ gitea.repository }}
+          REGISTRY_USER: ${{ secrets.CONTAINER_REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.CONTAINER_REGISTRY_TOKEN }}
+        run: bash scripts/publish-container.sh