ci: build main twice a day for testing

- Moves the main tag on ghcr.io when main changed since the last build, versioned after the stable version like 4.5.0.20261028.1
- Pushes no version tag, so the clean manifests workflow deletes the build it replaces
- version.sh --main picks the version from MAIN_VERSION and MAIN_REVISION, the labels of the build main points at

.github/workflows/main.yaml

@@ -0,0 +1,84 @@
+name: Main
+
+on:
+  schedule:
+    - cron: "50 9,21 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+cache-mode: none
+
+concurrency:
+  group: main
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  version:
+    name: Select the main build
+    if: ${{ github.repository == 'coollabsio/coolify' }}
+    permissions:
+      contents: read
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 10
+    outputs:
+      build: ${{ steps.version.outputs.build }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # https://github.com/actions/checkout/releases/tag/v7.0.1
+        with:
+          ref: main
+          fetch-depth: 0
+          persist-credentials: false
+
+      - id: version
+        env:
+          BRANCH: main
+        run: |
+          labels="$(docker buildx imagetools inspect ghcr.io/coollabsio/coolify:main --format '{{ json (index .Image "linux/amd64").Config.Labels }}')" || labels='{}'
+          MAIN_VERSION="$(jq -r '.["org.opencontainers.image.version"] // empty' <<< "$labels")"
+          MAIN_REVISION="$(jq -r '.["org.opencontainers.image.revision"] // empty' <<< "$labels")"
+          export MAIN_VERSION MAIN_REVISION
+          build="$(scripts/version.sh --main)"
+          echo "build=$build" | tee -a "$GITHUB_OUTPUT"
+
+  build:
+    name: Build
+    needs: version
+    if: ${{ needs.version.outputs.build != '' }}
+    permissions:
+      contents: read
+    uses: $/.github/workflows/build.yaml
+    with:
+      ref: ${{ fromJSON(needs.version.outputs.build).revision }}
+      coolify: ${{ fromJSON(needs.version.outputs.build).image }}
+
+  publish:
+    name: Move the main tag
+    needs: build
+    permissions:
+      packages: write # push the built main to ghcr.io and move the main tag
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 30
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # https://github.com/actions/download-artifact/releases/tag/v8.0.2
+        with:
+          pattern: image-*
+          path: ${{ runner.temp }}/images
+
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # https://github.com/docker/login-action/releases/tag/v4.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push the built main
+        run: |
+          sources=()
+          for index in "$RUNNER_TEMP"/images/*/index.json; do
+            sources+=("oci-layout://${index%/index.json}@$(jq -r '.manifests[0].digest' "$index")")
+          done
+          docker buildx imagetools create --tag ghcr.io/coollabsio/coolify:main "${sources[@]}"