diff --git a/.github/actions/build-and-push-dotnet/action.yaml b/.github/actions/build-and-push-dotnet/action.yaml
index ef0881b..3250461 100644
--- a/.github/actions/build-and-push-dotnet/action.yaml
+++ b/.github/actions/build-and-push-dotnet/action.yaml
@@ -79,70 +79,14 @@ runs:
           exit 1
         fi
 
-    - name: Derive image tags
+    - name: Derive image metadata
       id: vars
       shell: bash
       env:
         IMAGE_NAME: ${{ env.IMAGE_NAME }}
         TAG_INPUT: ${{ inputs.tag }}
       run: |
-        IMAGE="${IMAGE_NAME}"
-        TAGS=()
-
-        if [ -n "${TAG_INPUT}" ]; then
-          TAGS+=("${IMAGE}:${TAG_INPUT}")
-        else
-          TAG_NAME=""
-          REF="${GITHUB_REF:-${GITEA_REF}}"
-          SHA="${GITHUB_SHA:-${GITEA_SHA}}"
-          BRANCH=""
-          SHORT_SHA="$(git rev-parse --short=7 "${SHA}")"
-
-          # Extract tag name when we are on a tag ref (e.g. v1.4)
-          if [[ "${REF}" =~ refs/tags/(.+) ]]; then
-            TAG_NAME="${BASH_REMATCH[1]}"
-          fi
-
-          if [[ "${REF}" =~ refs/heads/(.+) ]]; then
-            BRANCH="${BASH_REMATCH[1]}"
-          else
-            # Tag build: detect which branch contains the tagged commit
-            git fetch --no-tags --depth=1 origin main release develop || true
-            if git branch -r --contains "${SHA}" | grep -q "origin/main"; then
-              BRANCH="main"
-            elif git branch -r --contains "${SHA}" | grep -q "origin/release"; then
-              BRANCH="release"
-            elif git branch -r --contains "${SHA}" | grep -q "origin/develop"; then
-              BRANCH="develop"
-            fi
-          fi
-
-          TAGS+=("${IMAGE}:${SHORT_SHA}")
-          [[ -n "${TAG_NAME}" ]] && TAGS+=("${IMAGE}:${TAG_NAME}")
-
-          case "${BRANCH}" in
-            main)
-              TAGS+=("${IMAGE}:latest")
-              ;;
-            release*)
-              TAGS+=("${IMAGE}:latest-rc")
-              ;;
-            develop)
-              TAGS+=("${IMAGE}:latest-dev")
-              ;;
-            *)
-              TAGS+=("${IMAGE}:latest-snapshot")
-              ;;
-          esac
-        fi
-
-        echo "Computed tags:"
-        printf '%s\n' "${TAGS[@]}"
-        {
-          echo "tags<<EOF"
-          printf '%s\n' "${TAGS[@]}"
-          echo "EOF"
-        } >> "$GITHUB_OUTPUT"
+        bash "${GITHUB_ACTION_PATH}/../shared/derive-image-metadata.sh"
 
     - name: Show build summary
       shell: bash
@@ -153,25 +97,7 @@ runs:
         echo "Image:  ${IMAGE_NAME}"
         echo "Tags:"
         printf '%s\n' "${{ steps.vars.outputs.tags }}"
-
-    - name: Determine deploy target
-      id: deploy
-      shell: bash
-      run: |
-        REF="${GITHUB_REF:-${GITEA_REF}}"
-        SHA="${GITHUB_SHA:-${GITEA_SHA}}"
-        TARGET="dev"
-        if [[ "${REF}" == "refs/heads/main" ]]; then
-          TARGET="prod"
-        elif [[ "${REF}" =~ refs/tags/ ]]; then
-          # Tag builds deploy to prod only if the tagged commit is in main
-          git fetch --no-tags --depth=1 origin main || true
-          if git branch -r --contains "${SHA}" | grep -q "origin/main"; then
-            TARGET="prod"
-          fi
-        fi
-        echo "Deploy target: ${TARGET}"
-        echo "target=${TARGET}" >> "$GITHUB_OUTPUT"
+        echo "Deploy target: ${{ steps.vars.outputs.target }}"
 
     - name: Build and push image
       uses: docker/build-push-action@v5
diff --git a/.github/actions/build-and-push/action.yaml b/.github/actions/build-and-push/action.yaml
index e4dcda1..b9ee01e 100644
--- a/.github/actions/build-and-push/action.yaml
+++ b/.github/actions/build-and-push/action.yaml
@@ -75,70 +75,14 @@ runs:
           exit 1
         fi
 
-    - name: Derive image tags
+    - name: Derive image metadata
       id: vars
       shell: bash
       env:
         IMAGE_NAME: ${{ env.IMAGE_NAME }}
         TAG_INPUT: ${{ inputs.tag }}
       run: |
-        IMAGE="${IMAGE_NAME}"
-        TAGS=()
-
-        if [ -n "${TAG_INPUT}" ]; then
-          TAGS+=("${IMAGE}:${TAG_INPUT}")
-        else
-          TAG_NAME=""
-          REF="${GITHUB_REF:-${GITEA_REF}}"
-          SHA="${GITHUB_SHA:-${GITEA_SHA}}"
-          BRANCH=""
-          SHORT_SHA="$(git rev-parse --short=7 "${SHA}")"
-
-          # Extract tag name when we are on a tag ref (e.g. v1.4)
-          if [[ "${REF}" =~ refs/tags/(.+) ]]; then
-            TAG_NAME="${BASH_REMATCH[1]}"
-          fi
-
-          if [[ "${REF}" =~ refs/heads/(.+) ]]; then
-            BRANCH="${BASH_REMATCH[1]}"
-          else
-            # Tag build: detect which branch contains the tagged commit
-            git fetch --no-tags --depth=1 origin main release develop || true
-            if git branch -r --contains "${SHA}" | grep -q "origin/main"; then
-              BRANCH="main"
-            elif git branch -r --contains "${SHA}" | grep -q "origin/release"; then
-              BRANCH="release"
-            elif git branch -r --contains "${SHA}" | grep -q "origin/develop"; then
-              BRANCH="develop"
-            fi
-          fi
-
-          TAGS+=("${IMAGE}:${SHORT_SHA}")
-          [[ -n "${TAG_NAME}" ]] && TAGS+=("${IMAGE}:${TAG_NAME}")
-
-          case "${BRANCH}" in
-            main)
-              TAGS+=("${IMAGE}:latest")
-              ;;
-            release*)
-              TAGS+=("${IMAGE}:latest-rc")
-              ;;
-            develop)
-              TAGS+=("${IMAGE}:latest-dev")
-              ;;
-            *)
-              TAGS+=("${IMAGE}:latest-snapshot")
-              ;;
-          esac
-        fi
-
-        echo "Computed tags:"
-        printf '%s\n' "${TAGS[@]}"
-        {
-          echo "tags<<EOF"
-          printf '%s\n' "${TAGS[@]}"
-          echo "EOF"
-        } >> "$GITHUB_OUTPUT"
+        bash "${GITHUB_ACTION_PATH}/../shared/derive-image-metadata.sh"
 
     - name: Show build summary
       shell: bash
@@ -149,25 +93,7 @@ runs:
         echo "Image:  ${IMAGE_NAME}"
         echo "Tags:"
         printf '%s\n' "${{ steps.vars.outputs.tags }}"
-
-    - name: Determine deploy target
-      id: deploy
-      shell: bash
-      run: |
-        REF="${GITHUB_REF:-${GITEA_REF}}"
-        SHA="${GITHUB_SHA:-${GITEA_SHA}}"
-        TARGET="dev"
-        if [[ "${REF}" == "refs/heads/main" ]]; then
-          TARGET="prod"
-        elif [[ "${REF}" =~ refs/tags/ ]]; then
-          # Tag builds deploy to prod only if the tagged commit is in main
-          git fetch --no-tags --depth=1 origin main || true
-          if git branch -r --contains "${SHA}" | grep -q "origin/main"; then
-            TARGET="prod"
-          fi
-        fi
-        echo "Deploy target: ${TARGET}"
-        echo "target=${TARGET}" >> "$GITHUB_OUTPUT"
+        echo "Deploy target: ${{ steps.vars.outputs.target }}"
 
     - name: Build and push image
       uses: docker/build-push-action@v5
diff --git a/.github/actions/shared/derive-image-metadata.sh b/.github/actions/shared/derive-image-metadata.sh
new file mode 100755
index 0000000..e40a04b
--- /dev/null
+++ b/.github/actions/shared/derive-image-metadata.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE_NAME="${IMAGE_NAME:-}"
+TAG_INPUT="${TAG_INPUT:-}"
+REF="${GITHUB_REF:-${GITEA_REF:-}}"
+SHA="${GITHUB_SHA:-${GITEA_SHA:-}}"
+
+if [ -z "${IMAGE_NAME}" ]; then
+  echo "::error::IMAGE_NAME is missing"
+  exit 1
+fi
+
+if [ -z "${SHA}" ]; then
+  SHA="$(git rev-parse HEAD)"
+fi
+
+SHORT_SHA="$(git rev-parse --short=7 "${SHA}")"
+BRANCH=""
+TAG_NAME=""
+TAGS=()
+
+if [[ "${REF}" =~ refs/tags/(.+) ]]; then
+  TAG_NAME="${BASH_REMATCH[1]}"
+fi
+
+if [[ "${REF}" =~ refs/heads/(.+) ]]; then
+  BRANCH="${BASH_REMATCH[1]}"
+elif [[ "${REF}" =~ refs/tags/ ]]; then
+  # Tag build: detect which branch contains the tagged commit.
+  git fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*' || true
+  if git branch -r --contains "${SHA}" | grep -q "origin/main"; then
+    BRANCH="main"
+  elif git branch -r --contains "${SHA}" | grep -q "origin/release/"; then
+    BRANCH="release"
+  elif git branch -r --contains "${SHA}" | grep -q "origin/develop"; then
+    BRANCH="develop"
+  fi
+fi
+
+if [ -n "${TAG_INPUT}" ]; then
+  TAGS+=("${IMAGE_NAME}:${TAG_INPUT}")
+else
+  TAGS+=("${IMAGE_NAME}:${SHORT_SHA}")
+  [ -n "${TAG_NAME}" ] && TAGS+=("${IMAGE_NAME}:${TAG_NAME}")
+
+  case "${BRANCH}" in
+    main)
+      TAGS+=("${IMAGE_NAME}:latest")
+      ;;
+    release*)
+      TAGS+=("${IMAGE_NAME}:latest-rc")
+      ;;
+    develop)
+      TAGS+=("${IMAGE_NAME}:latest-dev")
+      ;;
+    *)
+      TAGS+=("${IMAGE_NAME}:latest-snapshot")
+      ;;
+  esac
+fi
+
+TARGET="dev"
+if [[ "${REF}" == "refs/heads/main" ]]; then
+  TARGET="prod"
+elif [[ "${REF}" =~ refs/tags/ ]] && [[ "${BRANCH}" == "main" ]]; then
+  TARGET="prod"
+fi
+
+echo "Computed tags:"
+printf '%s\n' "${TAGS[@]}"
+echo "Deploy target: ${TARGET}"
+
+{
+  echo "tags<<EOF"
+  printf '%s\n' "${TAGS[@]}"
+  echo "EOF"
+  echo "target=${TARGET}"
+} >> "$GITHUB_OUTPUT"