fix deploy pipeline: isolate path-filtered step chains

Split push-images and upload-scan-results into per-image steps so
each chain (build → scan → upload → push) is fully self-contained.
Fixes Woodpecker "depends on unknown step" error when path filters
remove steps from the pipeline.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.woodpecker/deploy.yml

@@ -8,6 +8,7 @@ when:
     branch: main
 
 steps:
+  # ── Python package ──────────────────────────────────────────
   - name: build-package
     image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
     commands:
@@ -30,6 +31,7 @@ steps:
     depends_on:
       - build-package
 
+  # ── Notebooks image ─────────────────────────────────────────
   - name: build-notebooks
     image: docker:cli
     volumes:
@@ -40,16 +42,6 @@ steps:
     when:
       - path: "notebooks/**"
 
-  - name: build-zotero
-    image: docker:cli
-    volumes:
-      - /run/user/1000/docker.sock:/var/run/docker.sock
-    commands:
-      - docker build -t localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8} ./zotero
-      - docker tag localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8} localhost:3000/homelab/zotero:latest
-    when:
-      - path: "zotero/**"
-
   - name: scan-notebooks
     image: aquasec/trivy:latest
     volumes:
@@ -62,6 +54,35 @@ steps:
     when:
       - path: "notebooks/**"
 
+  - name: push-notebooks
+    image: docker:cli
+    volumes:
+      - /run/user/1000/docker.sock:/var/run/docker.sock
+    environment:
+      REGISTRY_USER:
+        from_secret: registry_user
+      REGISTRY_PASS:
+        from_secret: registry_pass
+    commands:
+      - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
+      - docker push localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8}
+      - docker push localhost:3000/homelab/notebooks:latest
+    depends_on:
+      - scan-notebooks
+    when:
+      - path: "notebooks/**"
+
+  # ── Zotero image ────────────────────────────────────────────
+  - name: build-zotero
+    image: docker:cli
+    volumes:
+      - /run/user/1000/docker.sock:/var/run/docker.sock
+    commands:
+      - docker build -t localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8} ./zotero
+      - docker tag localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8} localhost:3000/homelab/zotero:latest
+    when:
+      - path: "zotero/**"
+
   - name: scan-zotero
     image: aquasec/trivy:latest
     volumes:
@@ -74,27 +95,7 @@ steps:
     when:
       - path: "zotero/**"
 
-  - name: upload-scan-results
-    image: woodpeckerci/plugin-s3
-    settings:
-      endpoint: http://rustfs:9000
-      bucket: gitea
-      access_key:
-        from_secret: s3_access_key
-      secret_key:
-        from_secret: s3_secret_key
-      source: "*.json"
-      target: /ci/${CI_REPO}/${CI_COMMIT_SHA:0:8}/
-      path_style: true
-    depends_on:
-      - scan-notebooks
-      - scan-zotero
-    when:
-      - path:
-          - "notebooks/**"
-          - "zotero/**"
-
-  - name: push-images
+  - name: push-zotero
     image: docker:cli
     volumes:
       - /run/user/1000/docker.sock:/var/run/docker.sock
@@ -105,10 +106,44 @@ steps:
         from_secret: registry_pass
     commands:
       - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
-      - docker push localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8} || true
-      - docker push localhost:3000/homelab/notebooks:latest || true
-      - docker push localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8} || true
-      - docker push localhost:3000/homelab/zotero:latest || true
+      - docker push localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8}
+      - docker push localhost:3000/homelab/zotero:latest
+    depends_on:
+      - scan-zotero
+    when:
+      - path: "zotero/**"
+
+  # ── Upload scan results ─────────────────────────────────────
+  - name: upload-notebooks-scan
+    image: woodpeckerci/plugin-s3
+    settings:
+      endpoint: http://rustfs:9000
+      bucket: gitea
+      access_key:
+        from_secret: s3_access_key
+      secret_key:
+        from_secret: s3_secret_key
+      source: "notebooks-scan.json"
+      target: /ci/${CI_REPO}/${CI_COMMIT_SHA:0:8}/
+      path_style: true
     depends_on:
       - scan-notebooks
+    when:
+      - path: "notebooks/**"
+
+  - name: upload-zotero-scan
+    image: woodpeckerci/plugin-s3
+    settings:
+      endpoint: http://rustfs:9000
+      bucket: gitea
+      access_key:
+        from_secret: s3_access_key
+      secret_key:
+        from_secret: s3_secret_key
+      source: "zotero-scan.json"
+      target: /ci/${CI_REPO}/${CI_COMMIT_SHA:0:8}/
+      path_style: true
+    depends_on:
       - scan-zotero
+    when:
+      - path: "zotero/**"