fix(ci): derive image name from $GITHUB_REPOSITORY, not the event payload

The weekly cron build has been failing at "Build & push" with:
  invalid tag "192.168.0.2:1234/justin/:2026.08.03": invalid reference format

github.event.repository.name is EMPTY on Gitea `schedule` events (only
workflow_dispatch populates the event payload), so the image name collapsed
to ".../justin/" with no repo — invalid tag. That's why the manual dispatch
runs passed but every weekly cron run failed.

Derive owner/repo from $GITHUB_REPOSITORY (set on all event types) in a new
"Resolve repo identity" step and reference steps.repo.outputs.{owner,name}
in the metadata images, OCI labels, package-link, and prune steps. Drop the
now-unused IMAGE env. Same fix applied to image-only.yml for consistency
(it's dispatch-only so not currently failing, but same latent footgun).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01LFowQzJu7k97QLCRDSAeh1

.gitea/workflows/refresh.yml

@@ -25,9 +25,11 @@ env:
   REGISTRY_PUSH: 192.168.0.2:1234
   REGISTRY_PULL: git.jpaul.io
 
-  # Image name derives from the repo at runtime — clones don't need to
-  # edit this. github.* is the Gitea-Actions inherited namespace.
-  IMAGE: ${{ github.repository_owner }}/${{ github.event.repository.name }}
+  # Image name is derived at runtime by the "Resolve repo identity" step
+  # from $GITHUB_REPOSITORY. Do NOT use github.event.repository.name — Gitea
+  # leaves it EMPTY on schedule events (only workflow_dispatch populates it),
+  # which produced invalid tags like ".../justin/:latest" and failed the
+  # weekly cron build. $GITHUB_REPOSITORY is set on every event type.
 
   # Two GPU-pinned Ollama containers on the Gitea host — same infra
   # zerto-docs uses (deploy/ollama-rag.docker-compose.yml over there).
@@ -67,6 +69,16 @@ jobs:
           # commits back. Persist them across the run.
           token: ${{ secrets.GITEA_TOKEN }}
 
+      # Derive owner/repo from $GITHUB_REPOSITORY (set on ALL event types),
+      # NOT from github.event.repository.name (empty on schedule events in
+      # Gitea). Everything downstream references these outputs.
+      - name: Resolve repo identity
+        id: repo
+        run: |
+          echo "owner=${GITHUB_REPOSITORY%%/*}" >> "$GITHUB_OUTPUT"
+          echo "name=${GITHUB_REPOSITORY##*/}"  >> "$GITHUB_OUTPUT"
+          echo "resolved repo identity: ${GITHUB_REPOSITORY}"
+
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -187,7 +199,7 @@ jobs:
         with:
           # Tag with the LAN hostname so the push goes over LAN.
           # docker-compose on the deploy host pulls via git.jpaul.io.
-          images: 192.168.0.2:1234/${{ github.repository_owner }}/${{ github.event.repository.name }}
+          images: 192.168.0.2:1234/${{ steps.repo.outputs.owner }}/${{ steps.repo.outputs.name }}
           tags: |
             type=raw,value=latest
             type=sha,prefix=,format=short
@@ -196,8 +208,8 @@ jobs:
           # Override auto-derived labels with the PUBLIC URL so Gitea
           # can auto-link the package back to this repo.
           labels: |
-            org.opencontainers.image.source=https://git.jpaul.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
-            org.opencontainers.image.url=https://git.jpaul.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
+            org.opencontainers.image.source=https://git.jpaul.io/${{ steps.repo.outputs.owner }}/${{ steps.repo.outputs.name }}
+            org.opencontainers.image.url=https://git.jpaul.io/${{ steps.repo.outputs.owner }}/${{ steps.repo.outputs.name }}
 
       - name: Build & push (amd64)
         if: steps.commit.outputs.changed == 'true' || inputs.force_build == true
@@ -219,8 +231,8 @@ jobs:
         env:
           GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          OWNER="${{ github.repository_owner }}"
-          PKG="${{ github.event.repository.name }}"
+          OWNER="${{ steps.repo.outputs.owner }}"
+          PKG="${{ steps.repo.outputs.name }}"
           code=$(curl -s -o /tmp/link.out -w "%{http_code}" -X POST \
             -H "Authorization: token ${GITEA_TOKEN}" \
             "https://git.jpaul.io/api/v1/packages/${OWNER}/container/${PKG}/-/link/${PKG}")
@@ -239,7 +251,7 @@ jobs:
           GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           python scripts/registry_gc.py \
-            --owner "${{ github.repository_owner }}" \
-            --package "${{ github.event.repository.name }}" \
+            --owner "${{ steps.repo.outputs.owner }}" \
+            --package "${{ steps.repo.outputs.name }}" \
             --keep-days 90 \
             --keep-latest 5