ci: auto-bump semver tags on main push

.github/workflows/publish.yml

@@ -1,16 +1,64 @@
-name: Publish
+name: Docker
 
 on:
   push:
     branches: [main]
-    tags: ["v*"]
+    tags: ['v*']
   workflow_dispatch:
 
-env:
-  REGISTRY: ghcr.io
+permissions:
+  contents: write
+  packages: write
 
 jobs:
+  version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.bump.outputs.version }}
+      is_tag: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Compute version
+        id: bump
+        run: |
+          set -e
+          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
+            VERSION="${GITHUB_REF#refs/tags/v}"
+            echo "Using tag version: $VERSION"
+          else
+            # Auto-bump patch from last v-tag
+            LAST=$(git tag -l 'v*' --sort=-v:refname | head -1)
+            if [ -z "$LAST" ]; then
+              NEW="0.1.0"
+            else
+              MAJOR=$(echo "${LAST#v}" | cut -d. -f1)
+              MINOR=$(echo "${LAST#v}" | cut -d. -f2)
+              PATCH=$(echo "${LAST#v}" | cut -d. -f3)
+              # feat: → minor bump, else → patch bump
+              MSG=$(git log -1 --pretty=%s)
+              if [[ "$MSG" =~ ^feat[\(:] ]]; then
+                NEW="$MAJOR.$((MINOR+1)).0"
+              elif [[ "$MSG" =~ ^BREAKING|!: ]]; then
+                NEW="$((MAJOR+1)).0.0"
+              else
+                NEW="$MAJOR.$MINOR.$((PATCH+1))"
+              fi
+            fi
+            VERSION="$NEW"
+            # Tag the commit
+            git config user.name 'github-actions[bot]'
+            git config user.email 'github-actions[bot]@users.noreply.github.com'
+            git tag "v$VERSION"
+            git push origin "v$VERSION" || echo "tag push skipped"
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
   build-push:
+    needs: version
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -20,15 +68,18 @@ jobs:
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
-          registry: ${{ env.REGISTRY }}
+          registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - uses: docker/metadata-action@v5
         id: meta
         with:
-          images: ${{ env.REGISTRY }}/${{ github.repository }}-web
+          images: ghcr.io/${{ github.repository }}
           tags: |
             type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=main,enable={{is_default_branch}}
+            type=raw,value=v${{ needs.version.outputs.version }}
+            type=raw,value=${{ needs.version.outputs.version }}
             type=sha,prefix=,suffix=,format=short
       - uses: docker/build-push-action@v6
         with: