Publish one release image digest from a modernised workflow

The push job called build-push-action twice, once for the ref tag and once
for latest. Two builds meant the two tags could resolve to different manifest
digests. Build once and let docker/metadata-action supply both tags and the
OCI labels for that single build.

Replace the deprecated actions/checkout@v2 and docker/build-push-action@v1,
default workflow permissions to contents: read so pull requests cannot reach
publication credentials, and authenticate with a scoped DOCKER_TOKEN through
docker/login-action instead of DOCKER_PASSWORD.

The test job's docker-compose.test.yml branch was dead; that file does not
exist in the repository.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/docker-publish.yml

@@ -9,24 +9,29 @@ on:
 
   pull_request:
 
+permissions:
+  contents: read
+
+env:
+  IMAGE: snegov/seafile-client
+
 jobs:
   test:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - name: Validate compose example
         run: docker compose --file compose.example.yaml config --quiet
 
-      - name: Run tests
-        run: |
-          if [ -f docker-compose.test.yml ]; then
-            docker-compose --file docker-compose.test.yml build
-            docker-compose --file docker-compose.test.yml run sut
-          else
-            docker build . --file Dockerfile
-          fi
+      - name: Build image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          load: true
+          tags: ${{ env.IMAGE }}:ci
 
   push:
     needs: test
@@ -35,22 +40,30 @@ jobs:
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
-      - uses: docker/build-push-action@v1
+      # Every tag of a release must resolve to one manifest digest, so the
+      # image is built once and all tags are attached to that single build.
+      - name: Collect tags and labels
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE }}
+          tags: |
+            type=ref,event=tag
+          flavor: |
+            latest=true
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-          repository: snegov/seafile-client
-          tag_with_ref: true
-          add_git_labels: true
-          push: ${{ startsWith(github.ref, 'refs/tags/') }}
+          password: ${{ secrets.DOCKER_TOKEN }}
 
-      - uses: docker/build-push-action@v1
+      - name: Build and push
+        uses: docker/build-push-action@v6
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-          repository: snegov/seafile-client
-          tags: latest
-          add_git_labels: true
-          push: ${{ startsWith(github.ref, 'refs/tags/') }}
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}