Give each registry its own release leg, so Gitea cannot fail a release

Cloudflare rate limits git.tben.me's blob uploads (429/1015), which failed
the first v0.1.0 image even though GHCR had already pushed every tag.

.github/workflows/release.yml

@@ -14,8 +14,24 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # One leg per registry, so a registry having a bad day (Cloudflare rate
+  # limits git.tben.me's blob uploads) can never fail the release image that
+  # the installer installs from by default.
   image:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - registry: ghcr.io
+            login_username: ${{ github.actor }}
+            login_password: ${{ secrets.GITHUB_TOKEN }}
+            soft: "false"
+          - registry: git.tben.me
+            login_username: ${{ secrets.GITEA_USERNAME }}
+            login_password: ${{ secrets.GITEA_TOKEN }}
+            soft: "true"
+    continue-on-error: ${{ matrix.soft }}
     steps:
       - uses: actions/checkout@v4
 
@@ -23,25 +39,19 @@ jobs:
 
       - uses: docker/setup-buildx-action@v3
 
-      - name: Log in to GHCR
+      - name: Log in to ${{ matrix.registry }}
         uses: docker/login-action@v3
         with:
-          registry: ghcr.io
+          registry: ${{ matrix.registry }}
-          username: ${{ github.actor }}
+          username: ${{ matrix.login_username }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ matrix.login_password }}
-
-      - name: Log in to Gitea
-        uses: docker/login-action@v3
-        with:
-          registry: git.tben.me
-          username: ${{ secrets.GITEA_USERNAME }}
-          password: ${{ secrets.GITEA_TOKEN }}
 
       - name: Work out image tags
         id: tags
         env:
           EVENT: ${{ github.event_name }}
           RELEASE_TAG: ${{ github.event.release.tag_name }}
+          REGISTRY: ${{ matrix.registry }}
         run: |
           set -euo pipefail
           sha="sha-${GITHUB_SHA::12}"
@@ -49,18 +59,13 @@ jobs:
             version="$RELEASE_TAG"
             minor="$(printf '%s' "$version" | sed -E 's/^v?([0-9]+)\.([0-9]+).*/\1.\2/')"
             tags="$(printf '%s\n' \
-              "ghcr.io/moduletrace/cobble:latest" \
+              "${REGISTRY}/moduletrace/cobble:latest" \
-              "ghcr.io/moduletrace/cobble:${version}" \
+              "${REGISTRY}/moduletrace/cobble:${version}" \
-              "ghcr.io/moduletrace/cobble:${minor}" \
+              "${REGISTRY}/moduletrace/cobble:${minor}" \
-              "ghcr.io/moduletrace/cobble:${sha}" \
+              "${REGISTRY}/moduletrace/cobble:${sha}")"
-              "git.tben.me/moduletrace/cobble:latest" \
-              "git.tben.me/moduletrace/cobble:${version}" \
-              "git.tben.me/moduletrace/cobble:${minor}" \
-              "git.tben.me/moduletrace/cobble:${sha}")"
           else
             tags="$(printf '%s\n' \
-              "ghcr.io/moduletrace/cobble:${sha}" \
+              "${REGISTRY}/moduletrace/cobble:${sha}")"
-              "git.tben.me/moduletrace/cobble:${sha}")"
           fi
           {
             echo "tags<<EOF"
@@ -78,5 +83,5 @@ jobs:
           tags: ${{ steps.tags.outputs.tags }}
           provenance: false
           sbom: false
-          cache-from: type=gha
+          cache-from: type=gha,scope=${{ matrix.registry }}
-          cache-to: type=gha,mode=max
+          cache-to: type=gha,mode=max,scope=${{ matrix.registry }}