chore: move tag logic into bake file, drop all metadata-action steps

docker-bake.hcl now owns semver tag generation via HCL locals + a reusable
img_tags() function: GIT_TAG="v4.1.5" → :4.1.5, :4.1, :latest on all images.
The Docker job shrinks from 13 steps to 6 — no docker/metadata-action needed.

CI simply passes GIT_TAG, COMMIT, BUILD_TIME as env vars to bake-action.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/release.yaml

@@ -148,13 +148,9 @@ jobs:
   #         SENTRY_PROJECT: ui
 
   # ── docker: build + push all images via docker bake ──────────────────────────
-  # docker-bake.hcl defines all five targets. BuildKit builds them with maximum
-  # parallelism: backend/runner/pocketbase share the Go builder stage (compiled
-  # once), while caddy and ui build concurrently alongside the Go targets.
-  #
-  # Metadata (tags + labels) is generated per-image by docker/metadata-action
-  # (bake-target mode), then merged into a single bake call via the bake-action
-  # targets input — one Docker Hub login, one buildx invocation.
+  # docker-bake.hcl owns all tag logic (semver, major.minor, latest) via HCL
+  # functions — no docker/metadata-action needed.  BuildKit builds all five
+  # targets in parallel, sharing the Go builder stage across backend/runner/pocketbase.
   docker:
     name: Docker
     runs-on: ubuntu-latest
@@ -170,7 +166,6 @@ jobs:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_TOKEN }}
 
-      # ── Prepare ui build artifact ─────────────────────────────────────────────
       - name: Download ui build artifacts
         uses: actions/download-artifact@v3
         with:
@@ -182,80 +177,16 @@ jobs:
           grep -v '^build$' ui/.dockerignore > ui/.dockerignore.tmp
           mv ui/.dockerignore.tmp ui/.dockerignore
 
-      # ── Generate per-image tags + labels (bake-target mode) ───────────────────
-      - name: Docker meta / backend
-        id: meta-backend
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-backend
-          bake-target: backend
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
-
-      - name: Docker meta / runner
-        id: meta-runner
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-runner
-          bake-target: runner
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
-
-      - name: Docker meta / pocketbase
-        id: meta-pocketbase
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-pocketbase
-          bake-target: pocketbase
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
-
-      - name: Docker meta / ui
-        id: meta-ui
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-ui
-          bake-target: ui
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
-
-      - name: Docker meta / caddy
-        id: meta-caddy
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-caddy
-          bake-target: caddy
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
-
-      # ── Build + push all images in parallel ───────────────────────────────────
       - name: Build and push all images
         uses: docker/bake-action@v6
         with:
-          files: |
-            docker-bake.hcl
-            ${{ steps.meta-backend.outputs.bake-file }}
-            ${{ steps.meta-runner.outputs.bake-file }}
-            ${{ steps.meta-pocketbase.outputs.bake-file }}
-            ${{ steps.meta-ui.outputs.bake-file }}
-            ${{ steps.meta-caddy.outputs.bake-file }}
+          files: docker-bake.hcl
           set: |
-            backend.args.VERSION=${{ steps.meta-backend.outputs.version }}
-            backend.args.COMMIT=${{ gitea.sha }}
-            runner.args.VERSION=${{ steps.meta-runner.outputs.version }}
-            runner.args.COMMIT=${{ gitea.sha }}
-            ui.args.BUILD_TIME=${{ gitea.event.head_commit.timestamp }}
             *.output=type=image,push=true
+        env:
+          GIT_TAG: ${{ gitea.ref_name }}
+          COMMIT: ${{ gitea.sha }}
+          BUILD_TIME: ${{ gitea.event.head_commit.timestamp }}
 
   # ── deploy: sync docker-compose.yml + restart prod ───────────────────────────
   # Runs after all images are pushed to Docker Hub.