ci(docker): release-driven tags, drop nightly cron, add 3.x pre-release channel

Remove the scheduled nightly/alpha builds; gate :latest on a single LATEST_MAJOR; publish :beta/:next for pre-releases; keep a transitional :nightly alias on stable. Also fix the production Dockerfile so a stale host public/build can no longer clobber the freshly built frontend (reorder COPY, ignore public/build).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/docker.yaml

@@ -3,9 +3,6 @@ name: Docker Build and Push
 on:
   release:
     types: [published]
-  schedule:
-    # Run nightly at 2 AM UTC
-    - cron: '0 2 * * *'
   workflow_dispatch:
     inputs:
       tag:
@@ -13,10 +10,17 @@ on:
         required: true
         default: 'latest'
 
+# Single source of truth for which major owns the moving stable tags
+# (:latest, :{major}, :{major}.{minor}) and the temporary :nightly alias.
+# Bump to "3" on BOTH the 2.x and 3.x branches when 3.0.0 GA is tagged, and
+# drop the :nightly alias tag at the same time (end of the deprecation window).
+env:
+  LATEST_MAJOR: "2"
+
 jobs:
   php_syntax_errors:
     name: 1️⃣ PHP Code Style errors
-    if: github.event_name == 'release'
+    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
       - name: Set up PHP
@@ -35,7 +39,7 @@ jobs:
 
   tests:
     name: 2️⃣ PHP Tests
-    if: github.event_name == 'release'
+    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
     needs:
       - php_syntax_errors
     runs-on: ubuntu-latest
@@ -144,11 +148,20 @@ jobs:
         uses: docker/metadata-action@v6
         with:
           images: invoiceshelf/invoiceshelf
+          # Pre-release semver (e.g. 3.0.0-beta.1) automatically gets ONLY the exact
+          # {{version}} tag — metadata-action withholds {{major}} / {{major}}.{{minor}}.
+          # The moving stable tags (:latest, etc.) are gated on LATEST_MAJOR so a 2.x
+          # patch can never steal :latest from 3.x after the GA flip, and vice-versa.
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') && startsWith(github.ref_name, format('{0}.', env.LATEST_MAJOR)) }}
+            type=raw,value=beta,enable=${{ contains(github.ref_name, '-beta') }}
+            type=raw,value=next,enable=${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') }}
+            # DEPRECATED transitional alias: keeps existing :nightly deployments converging
+            # onto stable until they migrate. Remove this line at the 3.0.0 GA flip.
+            type=raw,value=nightly,enable=${{ !contains(github.ref_name, '-') && startsWith(github.ref_name, format('{0}.', env.LATEST_MAJOR)) }}
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v7
@@ -165,6 +178,8 @@ jobs:
   manual_docker_build:
     name: 🛠️ Manual Docker Build
     if: github.event_name == 'workflow_dispatch'
+    needs:
+      - tests
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -189,67 +204,3 @@ jobs:
           tags: invoiceshelf/invoiceshelf:${{ github.event.inputs.tag }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-
-  nightly_build:
-    name: 🌙 Nightly Docker Build
-    if: github.event_name == 'schedule'
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        branch: [master, develop]
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ matrix.branch }}
-          fetch-depth: 2
-
-      - name: Check for recent changes
-        id: changes
-        run: |
-          # Check if there are commits in the last 24 hours
-          RECENT_COMMITS=$(git log --since="24 hours ago" --oneline | wc -l)
-          echo "recent_commits=$RECENT_COMMITS" >> $GITHUB_OUTPUT
-          if [ "$RECENT_COMMITS" -gt 0 ]; then
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-          else
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Set up Docker Buildx
-        if: steps.changes.outputs.has_changes == 'true'
-        uses: docker/setup-buildx-action@v4
-
-      - name: Log in to Docker Hub
-        if: steps.changes.outputs.has_changes == 'true'
-        uses: docker/login-action@v4
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_TOKEN }}
-
-      - name: Set Docker tag
-        if: steps.changes.outputs.has_changes == 'true'
-        id: tag
-        run: |
-          if [ "${{ matrix.branch }}" = "master" ]; then
-            echo "tag=nightly" >> $GITHUB_OUTPUT
-          elif [ "${{ matrix.branch }}" = "develop" ]; then
-            echo "tag=alpha" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Build and push Docker image
-        if: steps.changes.outputs.has_changes == 'true'
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: docker/production/Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: invoiceshelf/invoiceshelf:${{ steps.tag.outputs.tag }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: No changes detected
-        if: steps.changes.outputs.has_changes == 'false'
-        run: |
-          echo "No commits found in the last 24 hours for ${{ matrix.branch }} branch. Skipping build."