fix(ci): remove SHA tags, use only dev/latest/vX.X.X

Align image tagging with semver convention:
- develop branch → :dev
- main branch → :latest
- git tags → :vX.X.X

Removes commit SHA tags from all 5 pipelines (api, web, orchestrator,
coordinator, infra) and updates Trivy scans to reference branch/tag.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.woodpecker/infra.yml

@@ -28,18 +28,16 @@ steps:
         from_secret: gitea_token
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-      CI_COMMIT_SHA: ${CI_COMMIT_SHA}
     commands:
       - *kaniko_setup
       - |
-        DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-postgres:${CI_COMMIT_SHA:0:8}"
-        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaic/stack-postgres:latest"
-        elif [ "$CI_COMMIT_BRANCH" = "develop" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaic/stack-postgres:dev"
-        fi
+        DESTINATIONS=""
         if [ -n "$CI_COMMIT_TAG" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaic/stack-postgres:$CI_COMMIT_TAG"
+          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-postgres:$CI_COMMIT_TAG"
+        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
+          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-postgres:latest"
+        elif [ "$CI_COMMIT_BRANCH" = "develop" ]; then
+          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-postgres:dev"
         fi
         /kaniko/executor --context docker/postgres --dockerfile docker/postgres/Dockerfile $DESTINATIONS
     when:
@@ -55,18 +53,16 @@ steps:
         from_secret: gitea_token
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-      CI_COMMIT_SHA: ${CI_COMMIT_SHA}
     commands:
       - *kaniko_setup
       - |
-        DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-openbao:${CI_COMMIT_SHA:0:8}"
-        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaic/stack-openbao:latest"
-        elif [ "$CI_COMMIT_BRANCH" = "develop" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaic/stack-openbao:dev"
-        fi
+        DESTINATIONS=""
         if [ -n "$CI_COMMIT_TAG" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaic/stack-openbao:$CI_COMMIT_TAG"
+          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-openbao:$CI_COMMIT_TAG"
+        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
+          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-openbao:latest"
+        elif [ "$CI_COMMIT_BRANCH" = "develop" ]; then
+          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-openbao:dev"
         fi
         /kaniko/executor --context docker/openbao --dockerfile docker/openbao/Dockerfile $DESTINATIONS
     when:
@@ -82,14 +78,22 @@ steps:
         from_secret: gitea_username
       GITEA_TOKEN:
         from_secret: gitea_token
-      CI_COMMIT_SHA: ${CI_COMMIT_SHA}
+      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
+      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
     commands:
       - |
+        if [ -n "$$CI_COMMIT_TAG" ]; then
+          SCAN_TAG="$$CI_COMMIT_TAG"
+        elif [ "$$CI_COMMIT_BRANCH" = "main" ]; then
+          SCAN_TAG="latest"
+        else
+          SCAN_TAG="dev"
+        fi
         mkdir -p ~/.docker
         echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
         trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed \
           --ignorefile .trivyignore \
-          git.mosaicstack.dev/mosaic/stack-postgres:$${CI_COMMIT_SHA:0:8}
+          git.mosaicstack.dev/mosaic/stack-postgres:$$SCAN_TAG
     when:
       - branch: [main, develop]
         event: [push, manual, tag]
@@ -103,14 +107,22 @@ steps:
         from_secret: gitea_username
       GITEA_TOKEN:
         from_secret: gitea_token
-      CI_COMMIT_SHA: ${CI_COMMIT_SHA}
+      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
+      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
     commands:
       - |
+        if [ -n "$$CI_COMMIT_TAG" ]; then
+          SCAN_TAG="$$CI_COMMIT_TAG"
+        elif [ "$$CI_COMMIT_BRANCH" = "main" ]; then
+          SCAN_TAG="latest"
+        else
+          SCAN_TAG="dev"
+        fi
         mkdir -p ~/.docker
         echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
         trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed \
           --ignorefile .trivyignore \
-          git.mosaicstack.dev/mosaic/stack-openbao:$${CI_COMMIT_SHA:0:8}
+          git.mosaicstack.dev/mosaic/stack-openbao:$$SCAN_TAG
     when:
       - branch: [main, develop]
         event: [push, manual, tag]