Adopt shared ci-actions for publishing

Replace inline publish step(s) with the canonical shell-only composite
actions in andras/ci-actions. Switches the publish jobs to the registered
'docker' runner.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.forgejo/workflows/publish-cli-docker.yml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   publish-docker:
-    runs-on: ubuntu-docker
+    runs-on: docker
 
     steps:
       - name: Checkout repository
@@ -17,35 +17,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Extract registry hostname
-        id: registry
-        run: echo "host=$(echo '${{ github.server_url }}' | sed 's|https\?://||')" >> "$GITHUB_OUTPUT"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log into container registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ steps.registry.outputs.host }}
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ steps.registry.outputs.host }}/${{ github.repository }}-cli
-
-      - name: Build and push Docker image
-        id: build-and-push
-        uses: docker/build-push-action@v5
+      - name: Build and publish CLI image
+        uses: http://forgejo:3000/andras/ci-actions/docker-publish@main
         with:
           context: frontend
-          file: frontend/local-client-cli/Dockerfile
-          platforms: linux/amd64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=registry,ref=${{ steps.registry.outputs.host }}/${{ github.repository }}-cli:buildcache
-          cache-to: type=registry,ref=${{ steps.registry.outputs.host }}/${{ github.repository }}-cli:buildcache,mode=max
+          dockerfile: frontend/local-client-cli/Dockerfile
+          image-suffix: -cli
+          push: ${{ github.event_name != 'pull_request' }}
+          token: ${{ secrets.GITHUB_TOKEN }}