fix: use build-push-action with oci-mediatypes=true for Zot compatibility

Switch from docker buildx CLI to docker/build-push-action@v5 with
oci-mediatypes=true to push OCI-format manifests that Zot accepts.
Also type-check all three Python files in CI.

.gitea/workflows/ci-cd.yml

@@ -24,7 +24,7 @@ jobs:
         run: ruff check .
 
       - name: Type check
-        run: mypy check_versions.py --ignore-missing-imports
+        run: mypy check_versions.py request_upgrades.py web.py
 
   build-push:
     runs-on: ubuntu-latest
@@ -37,19 +37,16 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Build and push image
-        run: |
-          if [ -n "${{ secrets.REGISTRY_USERNAME }}" ]; then
-            echo "${{ secrets.REGISTRY_PASSWORD }}" | \
-              docker login ${{ secrets.REGISTRY_URL }} -u ${{ secrets.REGISTRY_USERNAME }} --password-stdin
-          fi
-          docker buildx build \
-            --platform linux/amd64 \
-            --provenance=false \
-            --sbom=false \
-            --tag ${{ secrets.REGISTRY_URL }}/k8s-version-tracker:${{ github.sha }} \
-            --tag ${{ secrets.REGISTRY_URL }}/k8s-version-tracker:latest \
-            --push \
-            .
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64
+          provenance: false
+          sbom: false
+          outputs: type=image,push=true,oci-mediatypes=true
+          tags: |
+            ${{ secrets.REGISTRY_URL }}/k8s-version-tracker:${{ github.sha }}
+            ${{ secrets.REGISTRY_URL }}/k8s-version-tracker:latest
 
       - name: Notify Mattermost
         if: always()