fix(edu): deploy reviewed application release with Redis authentication

.gitea/workflows/ci.yaml

@@ -387,9 +387,6 @@ jobs:
               homepages/*)
                 add_service homepages
                 ;;
-              edu_master/phpsessid-bot/*|edu_master/webinar-checker/*|edu_master/compose.yaml)
-                add_service edu_master
-                ;;
             esac
           done
 
@@ -496,32 +493,6 @@ jobs:
                   done
                 done
                 ;;
-              edu_master)
-                for variant in session-keeper webinar-checker; do
-                  case "$variant" in
-                    session-keeper)
-                      context="edu_master/phpsessid-bot"
-                      image="${REGISTRY}/forust/session-keeper"
-                      ;;
-                    webinar-checker)
-                      context="edu_master/webinar-checker"
-                      image="${REGISTRY}/forust/webinar-checker"
-                      ;;
-                  esac
-                  set_tags
-                  build_args=()
-                  for tag in "${tags[@]}"; do
-                    build_args+=(-t "${image}:${tag}")
-                  done
-                  docker build \
-                    --cache-from "type=registry,ref=${image}:buildcache" \
-                    --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
-                    "${build_args[@]}" "$context"
-                  for tag in "${tags[@]}"; do
-                    docker push "${image}:${tag}"
-                  done
-                done
-                ;;
             esac
           done
 
@@ -552,6 +523,11 @@ jobs:
           fi
           echo "pinning ${#repos[@]} image(s) to $commit_tag"
           for repo in "${repos[@]}"; do
+            # EDU images are released by the application repository and pinned
+            # directly by digest in edu_master manifests. Never retag them here.
+            case "$repo" in
+              */session-keeper|*/webinar-checker) continue ;;
+            esac
             if docker buildx imagetools inspect "$repo:$commit_tag" >/dev/null 2>&1; then
               echo "  already built by this push: ${repo##*/}"
               continue