Add multi branch handling

.gitea/workflows/dnsmasq-image.yaml

@@ -7,22 +7,36 @@
 # Secure Boot keys and no iPXE binary — the signed snponly.efi rides the separate
 # fleet-ipxe image (ipxe-image.yaml), mounted into dnsmasq at /ipxe.
 #
+# Tagging mirrors gitea-main-ci.yaml so every branch builds a uniquely tagged,
+# pushed image you can test without clobbering main:
+#   - tag push    (refs/tags/v1.2.3) -> "1.2.3"          (+ :latest)
+#   - main push   (refs/heads/main)  -> "main-<sha7>"    (+ :latest)
+#   - branch push (refs/heads/<x>)   -> "<x>-<sha7>"     (dev image, no :latest)
+# Set DNSMASQ_VERSION in serving/.env to the tag you want to run.
+#
 # Runs only when the dnsmasq image inputs change (path filter) or on demand.
 #
 # Required Gitea repo secrets: PACKAGE_USER, PACKAGE_TOKEN (registry creds).
 #
 
 name: Build dnsmasq image
-run-name: ${{ gitea.actor }} builds the serving dnsmasq image
+run-name: ${{ gitea.actor }} builds the serving dnsmasq image (${{ gitea.ref_name }})
 on:
   push:
     branches:
-      - "main"
+      - "**"      # every branch — dev branches get a branch-name+sha tag
+    tags:
+      - "v*"      # tag push -> clean semver tag (v1.2.3 -> 1.2.3)
     paths:
       - "serving/dnsmasq/**"
       - ".gitea/workflows/dnsmasq-image.yaml"
   workflow_dispatch:
 
+# One build per ref at a time; a newer push to the same ref cancels the in-flight.
+concurrency:
+  group: dnsmasq-image-${{ gitea.ref }}
+  cancel-in-progress: true
+
 env:
   DNSMASQ_IMAGE: "git.bitasylum.org/audiobuzz/fleet-dnsmasq"
 
@@ -37,6 +51,25 @@ jobs:
         name: Checkout
         uses: actions/checkout@v6
 
+      -
+        name: Derive image tag
+        id: vars
+        # Same scheme as gitea-main-ci.yaml: clean semver on a tag push, else
+        # "<branch>-<sha7>" with the branch sanitized to the OCI tag charset.
+        run: |
+          short_sha="$(echo "${GITHUB_SHA}" | cut -c1-7)"
+          if [ "${GITHUB_REF#refs/tags/}" != "$GITHUB_REF" ]; then
+            version="${GITHUB_REF#refs/tags/}"; version="${version#v}"
+          else
+            branch="${GITHUB_REF#refs/heads/}"
+            safe_branch="$(printf '%s' "$branch" \
+              | sed -e 's#[^A-Za-z0-9._-]#-#g' -e 's#^[.-]*##' | cut -c1-100)"
+            [ -n "$safe_branch" ] || safe_branch="branch"
+            version="${safe_branch}-${short_sha}"
+          fi
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "Building ${DNSMASQ_IMAGE}:${version}"
+
       -
         name: Install buildah
         run: |
@@ -58,11 +91,15 @@ jobs:
           STORAGE_DRIVER: vfs
           BUILDAH_ISOLATION: chroot
         run: |
-          SHA="${{ gitea.sha }}"; SHA="${SHA:0:7}"
-          echo "Building ${DNSMASQ_IMAGE}:${SHA} (+ :latest)"
-          buildah bud \
-            -t "${DNSMASQ_IMAGE}:${SHA}" \
-            -t "${DNSMASQ_IMAGE}:latest" \
-            serving/dnsmasq
-          buildah push "${DNSMASQ_IMAGE}:${SHA}"
-          buildah push "${DNSMASQ_IMAGE}:latest"
+          VER="${{ steps.vars.outputs.version }}"
+          buildah bud -t "${DNSMASQ_IMAGE}:${VER}" serving/dnsmasq
+          buildah push "${DNSMASQ_IMAGE}:${VER}"
+          # Only main / release tags move :latest, so dev branches never clobber it.
+          case "$GITHUB_REF" in
+            refs/heads/main|refs/tags/*)
+              buildah tag  "${DNSMASQ_IMAGE}:${VER}" "${DNSMASQ_IMAGE}:latest"
+              buildah push "${DNSMASQ_IMAGE}:latest"
+              echo "Updated ${DNSMASQ_IMAGE}:latest" ;;
+            *)
+              echo "Dev branch build — :latest left untouched (run with DNSMASQ_VERSION=${VER})" ;;
+          esac