Require MCP_GRAFANA_VERSION build-arg; fix workflow step order and comments

.gitea/workflows/build.yaml

@@ -4,7 +4,7 @@
 # standalone.
 #
 # Triggers:
-#   - push to main (e.g. bumping the Dockerfile default version ARG)
+#   - push to main (runs the same resolve-latest build as the schedule)
 #   - weekly schedule, Mon 06:00 UTC — resolves the newest upstream release
 #     and builds it if not yet published, ~7h BEFORE the cluster0
 #     image-update cron (Mon 13:00 UTC) so the Monday pass picks it up like
@@ -56,23 +56,13 @@ jobs:
           fi
           [ -n "$VER" ] || { echo "could not resolve upstream version"; exit 1; }
           echo "version=$VER" >> "$GITHUB_OUTPUT"
-          # Image tag strips a leading 'v' from the release tag (v1.2.3 -> v1.2.3),
-          # so the tag is always v<semver> regardless of upstream's tag style.
+          # The image tag is always v<semver>: the release tag's leading 'v' is
+          # stripped and re-added, so 'v1.2.3' and '1.2.3' both yield tag v1.2.3.
           # An optional workflow_dispatch suffix (-1) allows rebuilds of the same
           # upstream version (e.g. image fixes) without overwriting the original tag.
           echo "tag=${VER#v}${{ github.event.inputs.suffix }}" >> "$GITHUB_OUTPUT"
           echo "Resolved grafana/mcp-grafana version: $VER"
 
-      - name: Skip if already published
-        id: skip
-        run: |
-          if docker manifest inspect "$IMAGE:v${{ steps.ver.outputs.tag }}" >/dev/null 2>&1; then
-            echo "Image $IMAGE:v${{ steps.ver.outputs.tag }} already exists — nothing to do."
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "skip=false" >> "$GITHUB_OUTPUT"
-          fi
-
       - name: Configure registry credentials
         # Dedicated scoped PAT (repo Actions secret REGISTRY_TOKEN) — Gitea's
         # container registry rejects scope requests from the Actions job token
@@ -84,7 +74,32 @@ jobs:
           chmod 600 "$HOME/.docker/config.json"
           echo "docker config.json written for $REGISTRY"
 
-      - name: Diagnose registry auth (runs only if a later step fails)
+      - name: Skip if already published
+        id: skip
+        run: |
+          if docker manifest inspect "$IMAGE:v${{ steps.ver.outputs.tag }}" >/dev/null 2>&1; then
+            echo "Image $IMAGE:v${{ steps.ver.outputs.tag }} already exists — nothing to do."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build
+        if: steps.skip.outputs.skip != 'true'
+        run: |
+          VER="${{ steps.ver.outputs.version }}"
+          TAG="${{ steps.ver.outputs.tag }}"
+          docker build --build-arg MCP_GRAFANA_VERSION="$VER" \
+            -t "$IMAGE:v$TAG" -t "$IMAGE:latest" .
+
+      - name: Push
+        if: steps.skip.outputs.skip != 'true'
+        run: |
+          TAG="${{ steps.ver.outputs.tag }}"
+          docker push "$IMAGE:v$TAG"
+          docker push "$IMAGE:latest"
+
+      - name: Diagnose registry auth (runs only if an earlier step fails)
         if: failure()
         # Prints only metadata (lengths, status codes) — never the token itself.
         run: |
@@ -102,18 +117,3 @@ jobs:
           curl -s -o /dev/null -w "bearer tags/list: HTTP %{http_code}\n" \
             -H "Authorization: Bearer $BT" \
             "https://gitea.williammiceli.systems/v2/hermes/grafana-mcp/tags/list" || true
-
-      - name: Build
-        if: steps.skip.outputs.skip != 'true'
-        run: |
-          VER="${{ steps.ver.outputs.version }}"
-          TAG="${{ steps.ver.outputs.tag }}"
-          docker build --build-arg MCP_GRAFANA_VERSION="$VER" \
-            -t "$IMAGE:v$TAG" -t "$IMAGE:latest" .
-
-      - name: Push
-        if: steps.skip.outputs.skip != 'true'
-        run: |
-          TAG="${{ steps.ver.outputs.tag }}"
-          docker push "$IMAGE:v$TAG"
-          docker push "$IMAGE:latest"