fix(ci): use Gitea actor for registry publishing

.gitea/workflows/container.yml

@@ -13,6 +13,10 @@ concurrency:
   group: container-${{ gitea.workflow }}-${{ gitea.ref }}
   cancel-in-progress: true
 
+env:
+  REGISTRY: git.sechmachine.io.vn
+  IMAGE_NAME: sechmachine/labtimesheet
+
 jobs:
   verify:
     runs-on: ubuntu-latest
@@ -66,6 +70,9 @@ jobs:
     needs: verify
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Check out source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -78,22 +85,18 @@ jobs:
       - name: Select image tags
         id: image
         env:
-          CONFIGURED_IMAGE: ${{ vars.CONTAINER_IMAGE }}
           EVENT_NAME: ${{ gitea.event_name }}
           GITEA_REF: ${{ gitea.ref }}
           GITEA_SHA: ${{ gitea.sha }}
         run: |
           publish=false
-          image=labtimesheet
+          image="$REGISTRY/$IMAGE_NAME"
           if [ "$EVENT_NAME" = "push" ] && [ "$GITEA_REF" = "refs/heads/main" ]; then
-            test -n "$CONFIGURED_IMAGE" || { echo "Repository variable CONTAINER_IMAGE is required" >&2; exit 1; }
             publish=true
-            image="$CONFIGURED_IMAGE"
           fi
           {
             echo "publish=$publish"
             echo "image=$image"
-            echo "registry=${image%%/*}"
             echo "tags<<EOF"
             echo "$image:sha-${GITEA_SHA}-amd64"
             if [ "$publish" = "true" ]; then
@@ -107,8 +110,8 @@ jobs:
         if: steps.image.outputs.publish == 'true'
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
-          registry: ${{ steps.image.outputs.registry }}
-          username: ${{ secrets.REGISTRY_USERNAME }}
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build AMD64 image and publish main
@@ -128,6 +131,9 @@ jobs:
     needs: verify
     runs-on: ubuntu-latest-arm
     timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Check out source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -140,28 +146,24 @@ jobs:
       - name: Select image tag
         id: image
         env:
-          CONFIGURED_IMAGE: ${{ vars.CONTAINER_IMAGE }}
           EVENT_NAME: ${{ gitea.event_name }}
           GITEA_REF: ${{ gitea.ref }}
           GITEA_SHA: ${{ gitea.sha }}
         run: |
           publish=false
-          image=labtimesheet
+          image="$REGISTRY/$IMAGE_NAME"
           if [ "$EVENT_NAME" = "push" ] && [ "$GITEA_REF" = "refs/heads/main" ]; then
-            test -n "$CONFIGURED_IMAGE" || { echo "Repository variable CONTAINER_IMAGE is required" >&2; exit 1; }
             publish=true
-            image="$CONFIGURED_IMAGE"
           fi
           echo "publish=$publish" >> "$GITHUB_OUTPUT"
-          echo "registry=${image%%/*}" >> "$GITHUB_OUTPUT"
           echo "tag=$image:sha-${GITEA_SHA}-arm64" >> "$GITHUB_OUTPUT"
 
       - name: Log in to registry
         if: steps.image.outputs.publish == 'true'
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
-          registry: ${{ steps.image.outputs.registry }}
-          username: ${{ secrets.REGISTRY_USERNAME }}
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build native ARM64 image
@@ -179,28 +181,23 @@ jobs:
     needs: [amd64, arm64]
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Set up Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
-      - name: Resolve registry
-        id: image
-        env:
-          CONFIGURED_IMAGE: ${{ vars.CONTAINER_IMAGE }}
-        run: |
-          test -n "$CONFIGURED_IMAGE" || { echo "Repository variable CONTAINER_IMAGE is required" >&2; exit 1; }
-          echo "registry=${CONFIGURED_IMAGE%%/*}" >> "$GITHUB_OUTPUT"
-
       - name: Log in to registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
-          registry: ${{ steps.image.outputs.registry }}
-          username: ${{ secrets.REGISTRY_USERNAME }}
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Publish combined manifest
         env:
-          IMAGE: ${{ vars.CONTAINER_IMAGE }}
+          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           GITEA_SHA: ${{ gitea.sha }}
         run: |
           docker buildx imagetools create \