feat: add build-and-push and ssh-deploy composite actions with image tagging support

README.md

@@ -35,7 +35,7 @@ jobs:
 | `image` | ✅ | — | Full image reference without tag |
 | `registry_password` | ✅ | — | Registry password/token (use secrets) |
 | `ssh_key` | ✅ | — | SSH private key for the remote builder (use secrets) |
-| `image_tag` | ❌ | `latest` | Tag to apply to the built image |
+| `image_tag` | ❌ | `latest` | Comma-separated tag(s) to apply to the built image (e.g. `latest,abc1234`). Pushing a commit-pinned tag alongside `:latest` is how Docker-only deploys consume per-commit tags. |
 | `registry_host` | ❌ | `git.ivanch.me` | Container registry hostname |
 | `registry_username` | ❌ | `ivanch` | Registry username |
 | `platforms` | ❌ | `linux/amd64,linux/arm64` | Target build platforms |
@@ -91,6 +91,8 @@ jobs:
           # optional:
           # ssh_port: "22"
           # compose_files: docker-compose.yml compose.override.yml
+          # image: git.ivanch.me/ivanch/my-app   # pins matching services
+          # image_tag: latest                     # Docker-only custom tag
 ```
 
 | Input | Required | Default | Description |
@@ -101,6 +103,8 @@ jobs:
 | `remote_dir` | ✅ | — | Directory on the remote server with `docker-compose.yml` |
 | `ssh_port` | ❌ | `22` | SSH port |
 | `compose_files` | ❌ | _(empty)_ | Space-separated compose file paths (applied via `-f` flags; when empty docker compose uses default detection) |
+| `image` | ❌ | _(empty)_ | Image base (host/path/name, **without tag**). When set, every compose service whose image matches this base is pinned to `image_tag` at deploy time. **Docker-only** — k8s deploys use `deploy-restart`, not this. |
+| `image_tag` | ❌ | `latest` | Tag applied to `image` when `image` is set. (Single tag — comma-lists are not supported for deploys.) |
 
 ---