fix: never replace an unreadable database file with an empty one

.github/workflows/docker.yml

@@ -44,8 +44,11 @@ jobs:
   # One image per plugin profile (docker/bundled-plugins.json). standard keeps
   # the plain tags; minimal and full add a suffix.
   build:
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
     strategy:
       fail-fast: false
       matrix:
@@ -67,21 +70,15 @@ jobs:
         if: ${{ inputs.build_type == 'Beta' }}
         run: node scripts/sync-version.cjs --version "${{ inputs.version }}"
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-        with:
-          platforms: linux/amd64,linux/arm64
-
       - name: Setup Docker Buildx
-        uses: useblacksmith/setup-docker-builder@v2
-        with:
-          cache-key: termix-ssh/termix
+        uses: docker/setup-buildx-action@v3
 
       - name: Determine tags
         id: tags
         run: |
           VERSION=${{ inputs.version }}
           BUILD_TYPE=${{ inputs.build_type }}
+          IMAGE="ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
 
           TAGS=()
           ALL_TAGS=()
@@ -92,19 +89,15 @@ jobs:
           fi
 
           if [ "$BUILD_TYPE" = "Production" ]; then
-            TAGS+=("$VERSION$SUFFIX" "latest$SUFFIX")
+            TAGS+=("release-$VERSION$SUFFIX" "$VERSION$SUFFIX" "latest$SUFFIX")
           elif [ "$BUILD_TYPE" = "Beta" ]; then
-            TAGS+=("beta$SUFFIX" "$VERSION$SUFFIX")
+            TAGS+=("beta$SUFFIX" "beta-$VERSION$SUFFIX")
           else
             TAGS+=("dev-$VERSION$SUFFIX")
           fi
 
           for tag in "${TAGS[@]}"; do
-            ALL_TAGS+=("ghcr.io/lukegus/termix:$tag")
-            ALL_TAGS+=("ghcr.io/termix-ssh/termix:$tag")
-            if [ "$BUILD_TYPE" != "Development" ]; then
-              ALL_TAGS+=("docker.io/bugattiguy527/termix:$tag")
-            fi
+            ALL_TAGS+=("$IMAGE:$tag")
           done
 
           echo "ALL_TAGS=$(IFS=,; echo "${ALL_TAGS[*]}")" >> $GITHUB_ENV
@@ -115,23 +108,16 @@ jobs:
         uses: docker/login-action@v4
         with:
           registry: ghcr.io
-          username: lukegus
-          password: ${{ secrets.TERMIX_PAT }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Login to Docker Hub (prod and beta only)
-        if: ${{ (inputs.build_type == 'Production' || inputs.build_type == 'Beta') && !inputs.dry_run }}
-        uses: docker/login-action@v4
-        with:
-          username: bugattiguy527
-          password: ${{ secrets.DOCKERHUB_BUGATTIGUY527_TOKEN }}
-
-      - name: Build and push multi-arch image
-        uses: useblacksmith/build-push-action@v2
+      - name: Build and push image
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./docker/Dockerfile
           push: ${{ !inputs.dry_run }}
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64
           tags: ${{ env.ALL_TAGS }}
           build-args: |
             BUILDKIT_CONTEXT_KEEP_GIT_DIR=1
@@ -142,26 +128,6 @@ jobs:
             org.opencontainers.image.created=${{ env.BUILD_CREATED }}
           outputs: ${{ inputs.dry_run && 'type=cacheonly' || 'type=registry,compression=zstd' }}
 
-      - name: Login to Docker Hub as termixssh
-        id: termix_hub
-        if: ${{ (inputs.build_type == 'Production' || inputs.build_type == 'Beta') && !inputs.dry_run }}
-        env:
-          TOKEN: ${{ secrets.DOCKERHUB_TERMIXSSH_TOKEN }}
-        run: |
-          if [ -z "$TOKEN" ]; then
-            echo "DOCKERHUB_TERMIXSSH_TOKEN is not set, skipping docker.io/termixssh"
-            exit 0
-          fi
-          echo "$TOKEN" | docker login docker.io --username termixssh --password-stdin
-          echo "ready=true" >> "$GITHUB_OUTPUT"
-
-      - name: Copy image to docker.io/termixssh
-        if: ${{ steps.termix_hub.outputs.ready == 'true' }}
-        run: |
-          for tag in $TAGS; do
-            docker buildx imagetools create --tag "docker.io/termixssh/termix:$tag" "ghcr.io/termix-ssh/termix:$tag"
-          done
-
       - name: Cleanup Docker
         if: always()
         run: |