feat: ensure the entire /app directory is owned by 65532

also only build stable on tag pushes; build canary images by default

Author: twaslowski

.github/workflows/build-artifacts.yml

@@ -30,4 +30,4 @@ jobs:
           version: latest
           args: release --clean
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build-image.yml

@@ -23,7 +23,7 @@ ENV SERVER_ADDR=dns:localhost:5230
 ENV BOT_TOKEN=your_telegram_bot_token
 
 # Copy files with proper ownership
-COPY --from=builder --chown=65532:65532 /app/memogram .
+COPY --from=builder --chown=65532:65532 /app /app
 COPY --chown=65532:65532 .env.example .env
 
 CMD ["./memogram"]