feature: add opencontainers annotations

.github/workflows/publish-image.yml

@@ -61,6 +61,7 @@ jobs:
           IMAGE_REF="${IMAGE_NAME:-$GITHUB_REPOSITORY}"
           CANONICAL_IMAGE="${REGISTRY}/${IMAGE_REF,,}"
           echo "canonical=${CANONICAL_IMAGE}" >> "$GITHUB_OUTPUT"
+          echo "source_url=https://github.com/${GITHUB_REPOSITORY}" >> "$GITHUB_OUTPUT"
 
       - name: Extract Docker metadata (tags, labels) with arch suffix
         id: meta
@@ -77,6 +78,9 @@ jobs:
           flavor: |
             latest=auto
             suffix=-${{ matrix.arch }}
+          labels: |
+            org.opencontainers.image.source=${{ steps.vars.outputs.source_url }}
+            org.opencontainers.image.licenses=MIT
 
       - name: Build and push (${{ matrix.platform }})
         id: build
@@ -84,6 +88,9 @@ jobs:
         with:
           context: .
           file: Dockerfile
+          build-args: |
+            OCI_SOURCE=${{ steps.vars.outputs.source_url }}
+            OCI_LICENSE=MIT
           platforms: ${{ matrix.platform }}
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
@@ -110,6 +117,7 @@ jobs:
     env:
       REGISTRY: ghcr.io
       IMAGE_NAME: ${{ github.repository }}
+      IMAGE_DESCRIPTION: Campfire is a web-based chat application with multiple rooms, DMs, file attachments, search, web push notifications, @mentions, and bot integrations. Single-tenant; production-ready image with web app, background jobs, caching, file serving, and SSL.
     steps:
       - name: Set up Docker Buildx (for imagetools)
         uses: docker/setup-buildx-action@v3.11.1
@@ -129,6 +137,7 @@ jobs:
           IMAGE_REF="${IMAGE_NAME:-$GITHUB_REPOSITORY}"
           CANONICAL_IMAGE="${REGISTRY}/${IMAGE_REF,,}"
           echo "canonical=${CANONICAL_IMAGE}" >> "$GITHUB_OUTPUT"
+          echo "source_url=https://github.com/${GITHUB_REPOSITORY}" >> "$GITHUB_OUTPUT"
 
       - name: Compute base tags (no suffix)
         id: meta
@@ -144,6 +153,9 @@ jobs:
             type=semver,pattern={{major}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
           flavor: |
             latest=auto
+          labels: |
+            org.opencontainers.image.source=${{ steps.vars.outputs.source_url }}
+            org.opencontainers.image.licenses=MIT
 
       - name: Create multi-arch manifests
         shell: bash
@@ -157,6 +169,7 @@ jobs:
             echo "Creating manifest for $tag"
             docker buildx imagetools create \
               --tag "$tag" \
+              --annotation "org.opencontainers.image.description=${IMAGE_DESCRIPTION}" \
               "${tag}-amd64" \
               "${tag}-arm64"
           done <<< "$tags"