From dfe8808c59c1b241d65a305c61849cbd89ebe80a Mon Sep 17 00:00:00 2001
From: Ruslan Bakiev <572431+veikab@users.noreply.github.com>
Date: Sun, 21 Jun 2026 10:11:01 +0700
Subject: [PATCH] Align build workflow with registry push flow

---
 .gitea/workflows/build-and-deploy.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/build-and-deploy.yml b/.gitea/workflows/build-and-deploy.yml
index bb4f422..baddea8 100644
--- a/.gitea/workflows/build-and-deploy.yml
+++ b/.gitea/workflows/build-and-deploy.yml
@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     runs-on: builder
@@ -19,11 +23,10 @@ jobs:
         run: |
           set -euo pipefail
           for attempt in 1 2 3; do
-            if docker buildx build --push --provenance=false --tag "$IMAGE_SHA" --tag "$IMAGE_LATEST" .; then
-              published_images="$(docker image ls --format '{{.Repository}}:{{.Tag}}' | awk -v sha="$IMAGE_SHA" -v latest="$IMAGE_LATEST" '$0 == sha || $0 == latest')"
-              if [ -n "$published_images" ]; then
-                docker image rm -f $published_images
-              fi
+            if docker build --tag "$IMAGE_SHA" --tag "$IMAGE_LATEST" . &&
+              docker push "$IMAGE_SHA" &&
+              docker push "$IMAGE_LATEST"; then
+              docker image rm -f "$IMAGE_SHA" "$IMAGE_LATEST"
               exit 0
             fi
             sleep "$((attempt * 10))"