From 014ce438c14e7ab71467305d21f0c25735d846fe Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sun, 17 May 2026 18:15:19 +0000
Subject: [PATCH] Add OCI `source` and `version` labels to images (#975)

Adds `org.opencontainers.image.source` and `org.opencontainers.image.version` labels to all three image variants (`basic`, `dind`, `dind-rootless`).

- `source` lets tools like renovate retrieve release notes from the source repo.
- `version` exposes the build version on the image itself.

Both `release-tag` and `release-nightly` workflows pass `VERSION` as a build arg so the label reflects the actual git tag (or `git describe` output for nightly).

---
This PR was written with the help of Claude Opus 4.7

---------

Reviewed-on: https://gitea.com/gitea/runner/pulls/975
Reviewed-by: Nicolas <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
---
 .gitea/workflows/release-nightly.yml |  7 +++++++
 .gitea/workflows/release-tag.yml     |  2 ++
 Dockerfile                           | 16 ++++++++++++++++
 3 files changed, 25 insertions(+)

diff --git a/.gitea/workflows/release-nightly.yml b/.gitea/workflows/release-nightly.yml
index 9b8879b2..75e28589 100644
--- a/.gitea/workflows/release-nightly.yml
+++ b/.gitea/workflows/release-nightly.yml
@@ -71,6 +71,11 @@ jobs:
       - name: Echo the tag
         run: echo "${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}"
 
+      - name: Get Meta
+        id: meta
+        run: |
+          echo REPO_VERSION=$(git describe --tags --always | sed 's/-/+/' | sed 's/^v//') >> $GITHUB_OUTPUT
+
       - name: Build and push
         uses: docker/build-push-action@v7
         with:
@@ -83,3 +88,5 @@ jobs:
           push: true
           tags: |
             ${{ env.DOCKER_ORG }}/runner:nightly${{ matrix.variant.tag_suffix }}
+          build-args: |
+            VERSION=${{ steps.meta.outputs.REPO_VERSION }}
diff --git a/.gitea/workflows/release-tag.yml b/.gitea/workflows/release-tag.yml
index aef461d8..0d054ee9 100644
--- a/.gitea/workflows/release-tag.yml
+++ b/.gitea/workflows/release-tag.yml
@@ -96,3 +96,5 @@ jobs:
             linux/arm64
           push: true
           tags: ${{ steps.docker_meta.outputs.tags }}
+          build-args: |
+            VERSION=${{ steps.docker_meta.outputs.version }}
diff --git a/Dockerfile b/Dockerfile
index 707e3be8..63bfc7ba 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,6 +19,11 @@ RUN make clean && make build
 #
 FROM docker:29-dind AS dind
 
+ARG VERSION=dev
+
+LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
+LABEL org.opencontainers.image.version="${VERSION}"
+
 RUN apk add --no-cache s6 bash git tzdata
 
 COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
@@ -34,6 +39,11 @@ ENTRYPOINT ["s6-svscan","/etc/s6"]
 #
 FROM docker:29-dind-rootless AS dind-rootless
 
+ARG VERSION=dev
+
+LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
+LABEL org.opencontainers.image.version="${VERSION}"
+
 USER root
 RUN apk add --no-cache s6 bash git tzdata
 
@@ -54,6 +64,12 @@ ENTRYPOINT ["s6-svscan","/etc/s6"]
 #
 #
 FROM alpine AS basic
+
+ARG VERSION=dev
+
+LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
+LABEL org.opencontainers.image.version="${VERSION}"
+
 RUN apk add --no-cache tini bash git tzdata
 
 COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner