Merge branch 'hotfix/1.41.1' #127

	# Build and push the production image only when a version tag is pushed on main.
	# Pushing to main itself no longer deploys — releases are gated on tagging.
	# Tag format matches the project convention (e.g. 2.39.2).

	name: Deploy Live

	on:
	push:
	tags:
	- '[0-9]+.[0-9]+.[0-9]+'
	workflow_dispatch:

	jobs:
	build:
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v4

	- name: Verify package.json version matches tag
	run: \|
	PKG=$(jq -r .version package.json)
	TAG=${GITHUB_REF_NAME}
	if [ "$PKG" != "$TAG" ]; then
	echo "::error::package.json version ($PKG) does not match git tag ($TAG). Did you forget 'npm version'?"
	exit 1
	fi

	- name: Create env file
	run: \|
	cat << EOF >> .env.production.local
	${{ secrets.ENV_FILE }}
	EOF

	- name: Log in to GitHub Container Registry
	uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
	with:
	registry: ghcr.io
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

	- name: Extract image metadata
	id: meta
	uses: docker/metadata-action@v5
	with:
	images: ghcr.io/harmlesskey/harmlesskey
	tags: \|
	type=semver,pattern={{version}}
	type=semver,pattern={{major}}.{{minor}}
	type=raw,value=latest

	- name: Build and push
	uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
	with:
	context: .
	push: true
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}
	cache-from: type=gha,scope=live
	cache-to: type=gha,scope=live,mode=max

Provide feedback