fix(ci): publish valid worker images

Normalize registry and release tag references before Buildx runs. Use process-local liveness so a control-plane outage does not restart a healthy worker container.

.github/workflows/docker.yml

@@ -26,28 +26,46 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Normalize Harbor registry
+        id: registry
+        shell: bash
+        run: |
+          REGISTRY="${HARBOR_REGISTRY,,}"
+          REGISTRY="${REGISTRY#http://}"
+          REGISTRY="${REGISTRY#https://}"
+          while [ "${REGISTRY%/}" != "${REGISTRY}" ]; do
+            REGISTRY="${REGISTRY%/}"
+          done
+          if [[ ! "${REGISTRY}" =~ ^[a-z0-9.-]+(:[0-9]+)?$ ]]; then
+            echo "HARBOR_REGISTRY must contain only a registry host and optional port" >&2
+            exit 1
+          fi
+          echo "host=${REGISTRY}" >> "${GITHUB_OUTPUT}"
+
       - name: Log in to Harbor
         uses: docker/login-action@v3
         with:
-          registry: ${{ env.HARBOR_REGISTRY }}
+          registry: ${{ steps.registry.outputs.host }}
           username: ${{ secrets.HARBOR_USER }}
           password: ${{ secrets.HARBOR_PASSWORD }}
 
       - name: Compute image metadata
         id: vars
         env:
+          REGISTRY: ${{ steps.registry.outputs.host }}
           REF_NAME: ${{ gitea.ref_name }}
           REF_TYPE: ${{ gitea.ref_type }}
           SHA: ${{ gitea.sha }}
         run: |
-          IMAGE="${HARBOR_REGISTRY}/${HARBOR_PROJECT}/${IMAGE_NAME}"
+          IMAGE="${REGISTRY}/${HARBOR_PROJECT}/${IMAGE_NAME}"
           SHORT_SHA="$(printf '%s' "${SHA}" | cut -c1-12)"
           TAGS="${IMAGE}:sha-${SHORT_SHA}"
           if [ "${REF_TYPE}" = "branch" ] && [ "${REF_NAME}" = "master" ]; then
             TAGS="${TAGS},${IMAGE}:latest"
           fi
           if [ "${REF_TYPE}" = "tag" ]; then
-            TAGS="${TAGS},${IMAGE}:${REF_NAME}"
+            RELEASE_TAG="$(printf '%s' "${REF_NAME}" | tr -c 'A-Za-z0-9_.-' '-' | cut -c1-128)"
+            TAGS="${TAGS},${IMAGE}:${RELEASE_TAG}"
           fi
           {
             echo "image=${IMAGE}"