DEVX-159: fix: push-first strategy in build_image to avoid losing latest tag

Co-authored-by: emil User <emil.simeonov@tutanota.com>

src/devx/tools/build_image.py

@@ -265,20 +265,15 @@ def push_image(
     """Push all tags of a Docker image to the registry.
 
     Returns True if all pushes succeed, False if any fail.
+
+    Push-first strategy: try pushing directly.  Only if the push fails
+    with Gitea #31964 ("package version already exists") do we delete
+    the old manifest and retry.  This avoids losing the existing tag
+    when the push fails for unrelated reasons (e.g. HTTP 500).
     """
     full_tags = [build_full_tag(registry, spec.name, t) for t in spec.tags]
     all_ok = True
     for ft, tag in zip(full_tags, spec.tags, strict=False):
-        # Workaround for Gitea #31964: delete existing tag before push
-        if username and token:
-            delete_remote_manifest(
-                registry,
-                spec.name,
-                tag,
-                username,
-                token,
-                dry_run=dry_run,
-            )
         cmd = ["docker", "push", ft]
         if dry_run:
             click.echo(f"[dry-run] {' '.join(cmd)}")
@@ -290,14 +285,38 @@ def push_image(
             text=True,
             check=False,
         )
-        if result.returncode != 0:
-            click.echo(
-                _("Push failed for {tag}: {error}", tag=ft, error=result.stderr.strip()),
-                err=True,
-            )
-            all_ok = False
-        else:
+        if result.returncode == 0:
             click.echo(f"Pushed {ft}")
+            continue
+        stderr = result.stderr.strip()
+        # Gitea #31964: push fails because tag already exists.
+        # Delete the old manifest and retry once.
+        if username and token and "already exists" in stderr.lower():
+            click.echo("  Tag exists (Gitea #31964), deleting old manifest and retrying...")
+            delete_remote_manifest(
+                registry,
+                spec.name,
+                tag,
+                username,
+                token,
+                dry_run=dry_run,
+            )
+            click.echo(f"  Retrying push {ft}...")
+            result = subprocess.run(  # nosec B603
+                cmd,
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            if result.returncode == 0:
+                click.echo(f"Pushed {ft} (after retry)")
+                continue
+            stderr = result.stderr.strip()
+        click.echo(
+            _("Push failed for {tag}: {error}", tag=ft, error=stderr),
+            err=True,
+        )
+        all_ok = False
     return all_ok