ci: repair build pipeline for the zo forge fork

The workflows were still the upstream GitHub ones and never ran here:
Deploy triggered on `main` (this fork's branch is `dev`), pushed to
`ghcr.io/jnsgruk/brewlog` (unreachable from this forge), and deployed to
jnsgruk's Fly.io.

- Deploy → build on push to `dev`, publish to this forge's own registry
  (git.ziemlichoptimal.de/uberbau/brewlog:{sha,dev}) via the auto GITHUB_TOKEN.
- Drop the Fly.io deploy step and the dead version-extract step; the moby
  homelab deploys the image via Flux GitOps, not from this pipeline.
- Retarget PR CI (push.yml) from `main` to `dev`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -1,12 +1,23 @@
-name: Deploy
+name: Build & Publish
+# Fork build pipeline for the "zo" forge (git.ziemlichoptimal.de/uberbau/brewlog).
+# On every push to `dev` this checks the code, then builds the container and
+# publishes it to this forge's own container registry. The moby homelab
+# (git.ziemlichoptimal.de/moby/cluster-moby) deploys the resulting image via
+# Flux GitOps — this pipeline does NOT deploy anything itself (the upstream
+# Fly.io deploy step was removed).
 on:
   push:
-    branches: ["main"]
+    branches: ["dev"]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  # This forge's built-in container registry, same host as the git server.
+  REGISTRY: git.ziemlichoptimal.de
+  IMAGE: git.ziemlichoptimal.de/uberbau/brewlog
+
 jobs:
   check:
     name: Check
@@ -46,44 +57,36 @@ jobs:
       - name: Run tests
         run: cargo test -- --show-output
 
-  deploy:
-    name: Deploy
+  build:
+    name: Build & Publish
     runs-on: ubuntu-latest
     needs: [check]
     steps:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Install mise
-        uses: jdx/mise-action@v4
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
-      - name: Login to GitHub Container Registry
+      - name: Login to the forge container registry
         uses: docker/login-action@v4
         with:
-          registry: ghcr.io
+          # Forgejo auto-provides GITHUB_TOKEN to the job; it can push packages
+          # for this repo's owner (uberbau). No external registry / PAT needed.
+          registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract version from Cargo.toml
-        id: version
-        run: echo "version=$(grep '^version = ' Cargo.toml | head -1 | cut -d'"' -f2)" >> "$GITHUB_OUTPUT"
-
       - name: Build and push container
         uses: docker/build-push-action@v7
         with:
           context: .
           push: true
+          # `dev` is the moving branch tag; the commit SHA is the immutable
+          # reference. The moby Deployment pins the image by digest, so bump it
+          # there per release (a floating tag never re-rolls the pod on its own).
           tags: |
-            ghcr.io/jnsgruk/brewlog:${{ github.sha }}
-            ghcr.io/jnsgruk/brewlog:latest
+            ${{ env.IMAGE }}:${{ github.sha }}
+            ${{ env.IMAGE }}:dev
           cache-from: type=gha
           cache-to: type=gha,mode=max
-
-      - name: Deploy to Fly.io
-        run: |
-          flyctl deploy -i "ghcr.io/jnsgruk/brewlog:${{ github.sha }}"
-        env:
-          FLY_ACCESS_TOKEN: ${{ secrets.FLY_API_TOKEN }}

.github/workflows/push.yml

@@ -1,7 +1,7 @@
 name: CI
 on:
   pull_request:
-    branches: ["main"]
+    branches: ["dev"]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}