chore: move tag logic into bake file, drop all metadata-action steps

docker-bake.hcl now owns semver tag generation via HCL locals + a reusable
img_tags() function: GIT_TAG="v4.1.5" → :4.1.5, :4.1, :latest on all images.
The Docker job shrinks from 13 steps to 6 — no docker/metadata-action needed.

CI simply passes GIT_TAG, COMMIT, BUILD_TIME as env vars to bake-action.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-bake.hcl

@@ -5,75 +5,99 @@
 #   - backend, runner, pocketbase share the Go builder stage (built once)
 #   - caddy and ui build independently in parallel alongside the Go targets
 #
-# Local build (no push):
+# Local build (push=false by default):
 #   docker buildx bake
 #
-# CI sets per-target tags and labels via --set overrides in docker/bake-action.
+# CI passes GIT_TAG (e.g. "v4.1.3") and the bake file computes all three tag
+# variants (full semver, major.minor, latest) — no docker/metadata-action needed.
 
-# ── Variables injected by CI via --set ───────────────────────────────────────
+# ── Variables injected by CI ──────────────────────────────────────────────────
 
 variable "DOCKER_USER" { default = "kalekber" }
 
-variable "VERSION"    { default = "dev" }
+# Full git tag, e.g. "v4.1.3".  CI passes this via --set or env.
+# Locally defaults to "dev" so images get a :dev tag.
+variable "GIT_TAG" { default = "dev" }
+
 variable "COMMIT"     { default = "unknown" }
 variable "BUILD_TIME" { default = "" }
 
-# ── Shared defaults ───────────────────────────────────────────────────────────
+# ── Tag helpers ───────────────────────────────────────────────────────────────
 
-# All targets inherit these.  CI overrides tags/labels per-target via --set.
-target "_defaults" {
-  pull   = true
-  output = ["type=image,push=false"]
+locals {
+  # Strip leading "v": "v4.1.3" → "4.1.3"
+  version = trimprefix(GIT_TAG, "v")
+
+  # major.minor only: "4.1.3" → "4.1"
+  major_minor = join(".", slice(split(".", local.version), 0, 2))
+
+  # true when building a real release tag (not local "dev" build)
+  is_release = GIT_TAG != "dev"
 }
 
-# Registry cache shared across all targets in a run.
-target "_cache" {
+# Return the three standard tags for a given image repo.
+# Always includes :latest and the full version; skips major.minor for dev builds.
+function "img_tags" {
+  params = [repo]
+  result = local.is_release ? [
+    "${repo}:${local.version}",
+    "${repo}:${local.major_minor}",
+    "${repo}:latest",
+  ] : ["${repo}:dev"]
+}
+
+# ── Shared defaults ───────────────────────────────────────────────────────────
+
+target "_defaults" {
+  pull     = true
+  # CI overrides this to push=true via --set *.output=type=image,push=true
+  output   = ["type=image,push=false"]
   cache-to = ["type=inline"]
 }
 
 # ── Go targets (share the backend/ build context + builder stage) ─────────────
 
 target "backend" {
-  inherits  = ["_defaults", "_cache"]
-  context   = "backend"
-  target    = "backend"
-  tags      = ["${DOCKER_USER}/libnovel-backend:latest"]
+  inherits   = ["_defaults"]
+  context    = "backend"
+  target     = "backend"
+  tags       = img_tags("${DOCKER_USER}/libnovel-backend")
   cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-backend:latest"]
   args = {
-    VERSION = VERSION
+    VERSION = local.version
     COMMIT  = COMMIT
   }
 }
 
 target "runner" {
-  inherits  = ["_defaults", "_cache"]
-  context   = "backend"
-  target    = "runner"
-  tags      = ["${DOCKER_USER}/libnovel-runner:latest"]
+  inherits   = ["_defaults"]
+  context    = "backend"
+  target     = "runner"
+  tags       = img_tags("${DOCKER_USER}/libnovel-runner")
   cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-runner:latest"]
   args = {
-    VERSION = VERSION
+    VERSION = local.version
     COMMIT  = COMMIT
   }
 }
 
 target "pocketbase" {
-  inherits  = ["_defaults", "_cache"]
-  context   = "backend"
-  target    = "pocketbase"
-  tags      = ["${DOCKER_USER}/libnovel-pocketbase:latest"]
+  inherits   = ["_defaults"]
+  context    = "backend"
+  target     = "pocketbase"
+  tags       = img_tags("${DOCKER_USER}/libnovel-pocketbase")
   cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-pocketbase:latest"]
 }
 
 # ── UI (SvelteKit — separate context) ────────────────────────────────────────
 
 target "ui" {
-  inherits  = ["_defaults", "_cache"]
-  context   = "ui"
-  tags      = ["${DOCKER_USER}/libnovel-ui:latest"]
+  inherits   = ["_defaults"]
+  context    = "ui"
+  tags       = img_tags("${DOCKER_USER}/libnovel-ui")
   cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-ui:latest"]
   args = {
-    BUILD_VERSION = VERSION
+    BUILD_VERSION = local.version
     BUILD_COMMIT  = COMMIT
     BUILD_TIME    = BUILD_TIME
     PREBUILT      = "1"
@@ -83,9 +107,9 @@ target "ui" {
 # ── Caddy (custom plugins — separate context) ─────────────────────────────────
 
 target "caddy" {
-  inherits  = ["_defaults", "_cache"]
-  context   = "caddy"
-  tags      = ["${DOCKER_USER}/libnovel-caddy:latest"]
+  inherits   = ["_defaults"]
+  context    = "caddy"
+  tags       = img_tags("${DOCKER_USER}/libnovel-caddy")
   cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-caddy:latest"]
 }