feat(delivery): publish immutable source images and declare release

.gitea/workflows/build-and-push.yml

@@ -108,7 +108,7 @@ jobs:
           SHA: ${{ gitea.sha }}
         run: |
           set -euo pipefail
-          tags=()
+          tags=("$IMAGE_NAME:sha-$SHA")
 
           if [[ "$REF" == refs/tags/* ]]; then
             version="$REF_NAME"
@@ -143,7 +143,7 @@ jobs:
             build_args+=(--tag "$tag")
           done
 
-          docker build "${build_args[@]}" .
+          docker build --label "org.opencontainers.image.revision=$GITHUB_SHA" "${build_args[@]}" .
 
       - name: Push image
         if: ${{ (steps.delivery.outputs.run == 'true') && github.event_name != 'pull_request' }}