ci: split dev image publishing by registry

.github/workflows/_docker-build-push.yml

@@ -2,11 +2,11 @@ name: Docker build & push (reusable)
 
 # Reusable workflow that builds the three image targets defined in
 # deploy/docker/Dockerfile (backend, worker, frontend) and optionally pushes
-# them to both ghcr.io and Docker Hub under the 3252a8/ namespace.
+# them to the selected registries under the 3252a8/ namespace.
 #
 # Called by:
 #   - docker-dev.yml      (tag_mode: dev,     push: true)  on pushes to dev
-#   - docker-release.yml  (tag_mode: release, push: true)  on pushes to main
+#   - docker-release.yml  (tag_mode: release, push: true)  on release tags
 #   - ci.yml              (tag_mode: dev,     push: false) on pull requests
 
 on:
@@ -20,6 +20,10 @@ on:
         description: "Tagging strategy: 'dev' or 'release'"
         type: string
         required: true
+      publish_dockerhub:
+        description: "Include Docker Hub tags and login when pushing"
+        type: boolean
+        default: true
 
 # No permissions block here on purpose: a reusable workflow cannot request more
 # than its caller grants, so the token scope is set by each caller
@@ -78,7 +82,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Log in to Docker Hub
-        if: inputs.push
+        if: inputs.push && inputs.publish_dockerhub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -89,8 +93,8 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: |
-            3252a8/${{ matrix.image }}
-            ghcr.io/3252a8/${{ matrix.image }}
+            name=3252a8/${{ matrix.image }},enable=${{ inputs.publish_dockerhub }}
+            name=ghcr.io/3252a8/${{ matrix.image }},enable=true
           tags: |
             type=raw,value=dev,enable=${{ inputs.tag_mode == 'dev' }}
             type=raw,value=latest,enable=${{ inputs.tag_mode == 'release' }}

.github/workflows/docker-dev.yml

@@ -1,7 +1,7 @@
 name: Dev images
 
 # On every push to the dev branch, build all three images and push them to
-# ghcr.io and Docker Hub tagged `dev` and `dev-<short-sha>`.
+# GHCR tagged `dev`. Docker Hub dev images are published by GitLab CI.
 
 on:
   push:
@@ -22,4 +22,5 @@ jobs:
     with:
       push: true
       tag_mode: dev
+      publish_dockerhub: false
     secrets: inherit

.gitlab-ci.yml

@@ -0,0 +1,51 @@
+stages:
+  - docker
+
+workflow:
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "dev"'
+    - when: never
+
+variables:
+  DOCKER_BUILDKIT: "1"
+  DOCKER_DRIVER: overlay2
+  DOCKER_HOST: tcp://docker:2375
+  DOCKER_TLS_CERTDIR: ""
+  GIT_DEPTH: "0"
+
+docker-dev:
+  stage: docker
+  image: docker:27.5.1
+  services:
+    - name: docker:27.5.1-dind
+      alias: docker
+  interruptible: true
+  parallel:
+    matrix:
+      - TARGET: backend
+        IMAGE: remnawave-minishop-backend
+      - TARGET: worker
+        IMAGE: remnawave-minishop-worker
+      - TARGET: frontend
+        IMAGE: remnawave-minishop-frontend
+  before_script:
+    - apk add --no-cache git
+    - test -n "$DOCKERHUB_USERNAME"
+    - test -n "$DOCKERHUB_TOKEN"
+    - echo "$DOCKERHUB_TOKEN" | docker login --username "$DOCKERHUB_USERNAME" --password-stdin
+    - docker buildx create --name gitlab-builder --use
+  script:
+    - git fetch origin dev --tags
+    - |
+      if [ "$(git rev-parse HEAD)" != "$(git rev-parse origin/dev)" ]; then
+        echo "A newer dev commit exists; skipping Docker Hub build for $IMAGE."
+        exit 0
+      fi
+    - docker buildx build --load --platform linux/amd64 --file deploy/docker/Dockerfile --target "$TARGET" --build-arg "CI_COMMIT_REF_NAME=$CI_COMMIT_REF_NAME" --tag "3252a8/$IMAGE:dev" .
+    - git fetch origin dev --tags
+    - |
+      if [ "$(git rev-parse HEAD)" != "$(git rev-parse origin/dev)" ]; then
+        echo "A newer dev commit exists; skipping Docker Hub push for $IMAGE."
+        exit 0
+      fi
+    - docker push "3252a8/$IMAGE:dev"