Separate frontend image build from publish, gate publish on tests

Build step now pushes to a staging tag (build-N) in parallel with
test shards. A new publish step uses skopeo to copy the manifest to
the final tags (:N and :latest) only after all tests pass. This is
a server-side manifest copy with no layer re-upload.

.drone.yml

@@ -93,10 +93,9 @@ steps:
       enable_cache: true
       cache_repo: viktorbarzin/immoweb-cache
       tags:
-        - latest
+        - "build-${DRONE_BUILD_NUMBER}"
-        - "${DRONE_BUILD_NUMBER}"
 
-  - name: Update deployment
+  - name: publish-frontend-image
     image: alpine
     depends_on:
       - test-shard-1
@@ -104,6 +103,18 @@ steps:
       - test-shard-3
       - test-shard-4
       - build-frontend-image
+    environment:
+      DOCKERHUB_TOKEN:
+        from_secret: dockerhub-token
+    commands:
+      - apk add --no-cache skopeo
+      - 'skopeo copy --src-creds "viktorbarzin:$DOCKERHUB_TOKEN" --dest-creds "viktorbarzin:$DOCKERHUB_TOKEN" "docker://docker.io/viktorbarzin/immoweb:build-${DRONE_BUILD_NUMBER}" "docker://docker.io/viktorbarzin/immoweb:${DRONE_BUILD_NUMBER}"'
+      - 'skopeo copy --src-creds "viktorbarzin:$DOCKERHUB_TOKEN" --dest-creds "viktorbarzin:$DOCKERHUB_TOKEN" "docker://docker.io/viktorbarzin/immoweb:build-${DRONE_BUILD_NUMBER}" "docker://docker.io/viktorbarzin/immoweb:latest"'
+
+  - name: Update deployment
+    image: alpine
+    depends_on:
+      - publish-frontend-image
     commands:
       - apk add curl
       - 'curl -s -X PATCH "https://kubernetes:6443/apis/apps/v1/namespaces/realestate-crawler/deployments/realestate-crawler-ui" -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" -H "Content-Type: application/json-patch+json" -k -d ''[{"op":"replace","path":"/spec/template/spec/containers/0/image","value":"viktorbarzin/immoweb:''"$DRONE_BUILD_NUMBER"''"}]'' | head'