fix: move cleanup to post-build job, keep 2 SHA tags

.forgejo/workflows/build.yaml

@@ -46,22 +46,6 @@ jobs:
             -t "$REGISTRY_HOSTPORT/nxtgauge-ai-assistant:main-latest" \
             .
 
-      - name: Prune old image tags (keep latest 1 SHA)
-        if: success()
-        continue-on-error: true
-        env:
-          REGISTRY_HOST: ${{ secrets.REGISTRY_HOSTPORT }}
-          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: |
-          set -euo pipefail
-          python3 .forgejo/scripts/registry_prune.py \
-            --registry "$REGISTRY_HOST" \
-            --repo "nxtgauge-ai-assistant" \
-            --username "$REGISTRY_USERNAME" \
-            --password "$REGISTRY_PASSWORD" \
-            --keep 1
-
       - name: Update GitOps and trigger deployment
         if: success()
         continue-on-error: true
@@ -93,3 +77,28 @@ jobs:
             --message "chore: deploy ai-assistant@${SHA}"
 
           rm -rf "$GITEOPS_DIR"
+
+  cleanup-after-build:
+    needs: build
+    if: always() && needs.build.result == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Cleanup old image tags (keep 2 SHA tags)
+        continue-on-error: true
+        env:
+          REGISTRY_HOST: ${{ secrets.REGISTRY_HOSTPORT }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          set -euo pipefail
+          echo "AI Assistant post-build cleanup: keeping only 2 SHA tags"
+          python3 .forgejo/scripts/registry_prune.py \
+            --registry "$REGISTRY_HOST" \
+            --repo "nxtgauge-ai-assistant" \
+            --username "$REGISTRY_USERNAME" \
+            --password "$REGISTRY_PASSWORD" \
+            --keep 2 || echo "Warning: cleanup failed (continuing)"
+          echo "Cleanup completed"