fix(ci): resolve image tag via Gitea API instead of artifact

upload/download-artifact@v4 is not supported on Gitea (GHES). Replace
with a direct Gitea API call in gitops-update: look up the tag name
whose commit SHA matches workflow_run.head_sha. Reverts the artifact
upload from build.yaml; no changes to build.yaml logic.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -63,11 +63,3 @@ jobs:
             --build-arg BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
             -t $IMAGE go/
           docker push $IMAGE
-          echo "$IMAGE" > /tmp/go-image-tag.txt
-
-      - name: Upload Go image tag for gitops workflow
-        uses: actions/upload-artifact@v4
-        with:
-          name: go-image-tag
-          path: /tmp/go-image-tag.txt
-          retention-days: 1

.gitea/workflows/gitops-update.yaml

@@ -39,10 +39,10 @@ jobs:
       GITEA_TOKEN: ${{ secrets.GITOPS_TOKEN }}
 
     steps:
-      - name: Install git, curl, ca-certificates
+      - name: Install git, curl, ca-certificates, jq
         run: |
           apt-get update -qq
-          apt-get install -y --no-install-recommends git curl ca-certificates
+          apt-get install -y --no-install-recommends git curl ca-certificates jq
 
       - name: Install tea
         run: |
@@ -58,21 +58,20 @@ jobs:
             -o /usr/local/bin/uh-cli
           chmod +x /usr/local/bin/uh-cli
 
-      - name: Download image tag artifact (workflow_run trigger)
-        if: github.event_name == 'workflow_run'
-        uses: actions/download-artifact@v4
-        with:
-          name: go-image-tag
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Resolve image tag
         id: resolve
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             IMAGE="gitea.home.hrajfrisbee.cz/${{ github.repository }}:${{ inputs.tag }}-go"
           else
-            IMAGE="$(cat go-image-tag.txt)"
+            # workflow_run: head_branch is not populated for tag pushes in Gitea Actions.
+            # Look up the tag name that points to the triggering commit SHA via the API.
+            SHA="${{ github.event.workflow_run.head_sha }}"
+            GIT_TAG=$(curl -fsSL \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              "https://gitea.home.hrajfrisbee.cz/api/v1/repos/${{ github.repository }}/tags?limit=50" \
+              | jq -r --arg sha "$SHA" '.[] | select(.commit.sha == $sha) | .name')
+            IMAGE="gitea.home.hrajfrisbee.cz/${{ github.repository }}:${GIT_TAG}-go"
           fi
           echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
           echo "Resolved image: ${IMAGE}"