fix(ci): improve nightly build sync process by fetching both branches and preventing non-fast-forward errors

.github/workflows/nightly-build.yml

@@ -46,11 +46,16 @@ jobs:
       - name: Sync development to nightly
         id: sync
         run: |
-          # Fetch development branch
+          # Fetch both branches to ensure we have the latest remote state
           git fetch origin development
+          git fetch origin nightly
 
-          # Check if there are differences
-          if git diff --quiet nightly origin/development; then
+          # Sync local nightly with remote nightly to prevent non-fast-forward errors
+          echo "Syncing local nightly with remote nightly..."
+          git reset --hard origin/nightly
+
+          # Check if there are differences between remote branches
+          if git diff --quiet origin/nightly origin/development; then
             echo "No changes to sync from development to nightly"
             echo "has_changes=false" >> $GITHUB_OUTPUT
           else

.github/workflows/security-pr.yml

@@ -176,7 +176,10 @@ jobs:
               echo "❌ ERROR: Branch name is empty for push build"
               exit 1
             fi
-            IMAGE_REF="ghcr.io/${IMAGE_NAME}:${BRANCH_NAME}"
+            # Normalize branch name for Docker tag (replace / and other special chars with -)
+            # This matches docker/metadata-action behavior: type=ref,event=branch
+            TAG_SAFE_BRANCH="${BRANCH_NAME//\//-}"
+            IMAGE_REF="ghcr.io/${IMAGE_NAME}:${TAG_SAFE_BRANCH}"
           elif [[ -n "${{ steps.pr-info.outputs.pr_number }}" ]]; then
             IMAGE_REF="ghcr.io/${IMAGE_NAME}:pr-${{ steps.pr-info.outputs.pr_number }}"
           else