chore: Use PAT for registry push.

See:
- https://github.com/go-gitea/gitea/issues/23642
- https://github.com/go-gitea/gitea/issues/29398

.github/workflows/docker.yml

@@ -2,40 +2,54 @@ name: Docker
 
 on:
   push:
+    branches:
+    - "handmade"
+  pull_request:
+    branches:
+    - "handmade"
+  release:
+    types:
+    - published
 
 jobs:
     publish:
         runs-on: ubuntu-latest
-        # NOTE: Running on pull requests for now, but without pushing.
-        # if: github.event_name != 'pull_request'
+        permissions:
+            contents: read
         steps:
             - name: Checkout
               uses: actions/checkout@v4
               with:
                   submodules: "recursive"
-            - name: Set up QEMU
-              uses: docker/setup-qemu-action@v3
             - name: Set up Docker Buildx
               uses: docker/setup-buildx-action@v3
+            - name: Resolve registry host
+              id: registry
+              run: echo "host=${GITHUB_SERVER_URL#*://}" >> "$GITHUB_OUTPUT"
             - name: Docker meta
               id: meta
               uses: docker/metadata-action@v5
               with:
-                  images: handmadecities/handmade-revolt-web-client
+                  images: ${{ steps.registry.outputs.host }}/${{ github.repository_owner }}/handmade-revolt-web-client
+                  tags: |
+                      type=semver,pattern={{version}}
+                      type=semver,pattern={{major}}.{{minor}}
+                      type=raw,value=latest
               env:
                   DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
-            - name: Login to DockerHub
-              uses: docker/login-action@v1
-              if: github.event_name != 'pull_request'
+            - name: Login to registry
+              uses: docker/login-action@v3
+              if: github.event_name == 'release'
               with:
-                  username: ${{ secrets.DOCKERHUB_USERNAME }}
-                  password: ${{ secrets.DOCKERHUB_TOKEN }}
+                  registry: ${{ steps.registry.outputs.host }}
+                  username: ${{ secrets.PACKAGE_PUBLISH_USERNAME }}
+                  password: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}
             - name: Build and publish
               uses: docker/build-push-action@v6
               with:
                   context: .
-                  push: ${{ github.event_name != 'pull_request' }}
-                  platforms: linux/amd64,linux/arm64
+                  push: ${{ github.event_name == 'release' }}
+                  platforms: linux/amd64
                   tags: ${{ steps.meta.outputs.tags }}
                   annotations: ${{ steps.meta.outputs.annotations }}
                   labels: ${{ steps.meta.outputs.labels }}