Serialize image builds across refs

A tag push and a main push can land together and both want to build the same
version and move the same :latest. A per-ref concurrency group let them run in
parallel, which is exactly the race the group is supposed to prevent.

.gitea/workflows/dependency-check.yml

@@ -37,6 +37,20 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # The toolchain comes from the repo rather than being hard-coded here, so
+      # the check runs on the same compiler the image ships with and this file
+      # can be copied between repos unchanged.
+      - name: Resolve the pinned Rust version
+        id: rust
+        run: |
+          set -eu
+          FILE=deploy/docker/Dockerfile
+          [ -f "$FILE" ] || FILE=Dockerfile
+          VERSION=$(grep -E '^ARG RUST_VERSION=' "$FILE" | head -1 | cut -d= -f2)
+          [ -n "$VERSION" ] || { echo "::error::no ARG RUST_VERSION in $FILE"; exit 1; }
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "checking with rust ${VERSION}"
+
       # The workspace is streamed into the container over stdin rather than
       # bind-mounted, so this works whether the runner shares a filesystem with
       # the daemon or not. The official rust image already carries the
@@ -53,9 +67,9 @@ jobs:
         run: |
           set -eu
           tar cf - --exclude=./.git --exclude=./target . | docker run --rm -i \
-            -e RUSTUP_TOOLCHAIN=1.95 \
+            -e RUSTUP_TOOLCHAIN="${{ steps.rust.outputs.version }}" \
             -e CARGO_TERM_COLOR=never \
-            rust:1.95-bookworm \
+            "rust:${{ steps.rust.outputs.version }}-bookworm" \
             sh -ec 'mkdir -p /work && cd /work && tar xf - && exec node .gitea/scripts/dependency-report.mjs' \
             > /tmp/report.md 2> /tmp/report.err || {
               echo "::error::the dependency report failed to generate"

.gitea/workflows/release.yml

@@ -28,8 +28,12 @@ on:
         required: false
         default: ''
 
+# One release at a time regardless of ref. A tag push and a main push can land
+# together and both want to build the same version and move the same `:latest`;
+# serializing them is the only way to avoid two runs pushing identical tags
+# concurrently.
 concurrency:
-  group: release-${{ github.ref }}
+  group: release
   cancel-in-progress: false
 
 permissions: