Fix

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: Continuous Integration
 
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  BIFROEST_VENDOR: engity
+  BIFROEST_VENDOR: "Engity GmbH"
 
 on:
   pull_request:
@@ -142,6 +142,7 @@ jobs:
           go run ./cmd/build build --log.colorMode=always
 
       - name: Archive package results
+        if: needs.evaluate.outputs.stage-publish == 'true'
         uses: actions/upload-artifact@v4
         with:
           retention-days: 1

.github/workflows/release.yml

@@ -2,7 +2,7 @@ name: "Release"
 
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  BIFROEST_VENDOR: engity
+  BIFROEST_VENDOR: "Engity GmbH"
 
 on:
   release:

cmd/build/base.go

@@ -29,6 +29,7 @@ func newBase() *base {
 	result := &base{
 		waitTimeout: time.Second * 3,
 		actor:       currentUserName,
+		title:       "Engity's Bifröst",
 	}
 	result.repo = newRepo(result)
 	result.build = newBuild(result)
@@ -45,6 +46,7 @@ type base struct {
 
 	waitTimeout time.Duration
 	actor       string
+	title       string
 	rawCommit   string
 	rawRef      string
 	rawHeadRef  string
@@ -68,6 +70,10 @@ func (this *base) init(ctx context.Context, app *kingpin.Application) {
 		Envar("GITHUB_ACTOR").
 		PlaceHolder("<actor-name>").
 		StringVar(&this.actor)
+	app.Flag("title", "").
+		Default(this.title).
+		PlaceHolder("<title>").
+		StringVar(&this.title)
 	app.Flag("commit", "").
 		Envar("GITHUB_SHA").
 		PlaceHolder("<sha>").

cmd/build/build-artifact.go

@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"iter"
 	gos "os"
+	"path"
+	"path/filepath"
 	"strings"
 	"sync"
 
@@ -33,7 +35,29 @@ func (this *buildArtifact) toLdFlags(o os) string {
 }
 
 func (this *buildArtifact) String() string {
-	return this.platform.String() + "/" + this.t.String() + ":" + this.filepath
+	return this.platform.String() + "/" + this.t.String() + ":" + this.name()
+}
+
+func (this *buildArtifact) mediaType() string {
+	switch this.t {
+	case buildArtifactTypeDigest:
+		return "text/plain; charset=utf-8"
+	case buildArtifactTypeArchive:
+		switch strings.ToLower(path.Ext(this.name())) {
+		case ".tgz":
+			return "application/tar+gzip"
+		case ".zip":
+			return "application/zip"
+		default:
+			return "application/octet-stream"
+		}
+	default:
+		return "application/octet-stream"
+	}
+}
+
+func (this *buildArtifact) name() string {
+	return filepath.Base(this.filepath)
 }
 
 func (this *buildArtifact) Close() (rErr error) {

cmd/build/build-image.go

@@ -19,11 +19,17 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/partial"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/google/go-containerregistry/pkg/v1/types"
+	"github.com/google/go-github/v65/github"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 
 	"github.com/engity-com/bifroest/pkg/common"
 )
 
+const (
+	ImageAnnotationEdition  = "org.engity.bifroest.edition"
+	ImageAnnotationPlatform = "org.engity.bifroest.platform"
+)
+
 func newBuildImage(b *build) *buildImage {
 	return &buildImage{
 		build: b,
@@ -127,10 +133,7 @@ func (this *buildImage) createPart(ctx context.Context, binary *buildArtifact) (
 	cfg.OSFeatures = ociPlatform.OSFeatures
 	cfg.Variant = ociPlatform.Variant
 
-	cfg.Config.Labels = map[string]string{
-		v1.AnnotationDescription: "Test test",
-		v1.AnnotationSource:      this.repo.fullName(),
-	}
+	cfg.Config.Labels = make(map[string]string)
 	cfg.Config.Env = binary.os.extendPathWith(binary.platform.os.bifroestBinaryDirPath(), cfg.Config.Env)
 	cfg.Config.Entrypoint = []string{binary.platform.os.bifroestBinaryFilePath()}
 	cfg.Config.Cmd = []string{"run"}
@@ -143,9 +146,15 @@ func (this *buildImage) createPart(ctx context.Context, binary *buildArtifact) (
 		return fail(err)
 	}
 
-	img = mutate.Annotations(img, map[string]string{
-		v1.AnnotationDescription: "This is a description " + a.platform.String(),
-	}).(gcv1.Image)
+	annotations, err := this.createAnnotations(ctx, a.edition, func(v version, rm *github.Repository, m map[string]string) error {
+		m[ImageAnnotationPlatform] = a.platform.String()
+		return nil
+	})
+	if err != nil {
+		return fail(err)
+	}
+
+	img = mutate.Annotations(img, annotations).(gcv1.Image)
 
 	binaryLayer, err := binary.toLayer(common.JoinSeq2[imageArtifactLayerItem, error](
 		common.Seq2ErrOf[imageArtifactLayerItem](imageArtifactLayerItem{
@@ -176,12 +185,12 @@ func (this *buildImage) createPart(ctx context.Context, binary *buildArtifact) (
 	return a, nil
 }
 
-func (this *buildImage) merge(_ context.Context, as buildArtifacts) (_ buildArtifacts, rErr error) {
+func (this *buildImage) merge(ctx context.Context, as buildArtifacts) (_ buildArtifacts, rErr error) {
 	result := slices.Collect(as.withoutType(buildArtifactTypeImage))
 
 	success := false
 	for _, e := range allEditionVariants {
-		a, err := this.createdMerged(e, as)
+		a, err := this.createdMerged(ctx, e, as)
 		if err != nil {
 			return nil, err
 		}
@@ -195,19 +204,67 @@ func (this *buildImage) merge(_ context.Context, as buildArtifacts) (_ buildArti
 	return result, nil
 }
 
-func (this *buildImage) createdMerged(e edition, as buildArtifacts) (result *buildArtifact, _ error) {
+func (this *buildImage) createAnnotations(ctx context.Context, e edition, additional func(version, *github.Repository, map[string]string) error) (map[string]string, error) {
+	rm, err := this.repo.meta(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	ver, err := this.version(ctx)
+	if err != nil {
+		return nil, err
+	}
+	commit, err := this.commit(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	result := map[string]string{
+		v1.AnnotationCreated:       this.time().Format(time.RFC3339),
+		v1.AnnotationURL:           rm.GetHTMLURL() + "/pkgs/container/" + this.repo.name.String(),
+		v1.AnnotationDocumentation: rm.GetHomepage(),
+		v1.AnnotationSource:        rm.GetHTMLURL(),
+		v1.AnnotationVersion:       ver.String(),
+		v1.AnnotationRevision:      commit,
+		v1.AnnotationVendor:        this.vendor,
+		v1.AnnotationTitle:         this.title,
+		v1.AnnotationDescription:   rm.GetDescription(),
+		ImageAnnotationEdition:     e.String(),
+	}
+
+	if l := rm.GetLicense(); l != nil {
+		result[v1.AnnotationLicenses] = l.GetSPDXID()
+	}
+
+	for tag := range ver.tags(e.String()+"-", e.String()) {
+		result[v1.AnnotationRefName] = tag
+		break
+	}
+
+	if additional != nil {
+		if err := additional(ver, rm, result); err != nil {
+			return nil, err
+		}
+	}
+
+	return nil, err
+}
+
+func (this *buildImage) createdMerged(ctx context.Context, e edition, as buildArtifacts) (result *buildArtifact, _ error) {
 	l := log.With("edition", e).
 		With("stage", buildStageImage)
 
 	start := time.Now()
 	l.Debug("merge images...")
 
+	annotations, err := this.createAnnotations(ctx, e, nil)
+	if err != nil {
+		return nil, err
+	}
+
 	var manifest gcv1.ImageIndex = empty.Index
 	mutate.IndexMediaType(manifest, types.DockerManifestList)
-	manifest = mutate.Annotations(manifest, map[string]string{
-		v1.AnnotationSource:      this.repo.fullName(),
-		v1.AnnotationDescription: "This is a description",
-	}).(gcv1.ImageIndex)
+	manifest = mutate.Annotations(manifest, annotations).(gcv1.ImageIndex)
 
 	var adds []mutate.IndexAddendum
 	var refA *buildArtifact

cmd/build/build.go

@@ -270,7 +270,7 @@ func (this *build) buildAll(ctx context.Context, forTesting bool) (artifacts bui
 	}
 
 	if stages.contains(buildStagePublish) {
-		if err := this.image.publish(ctx, artifacts); err != nil {
+		if err := this.publish(ctx, artifacts); err != nil {
 			return nil, err
 		}
 	}
@@ -331,6 +331,48 @@ func (this *build) buildSingle(ctx context.Context, p *platform) (artifacts buil
 	return artifacts, nil
 }
 
+func (this *build) publish(ctx context.Context, as buildArtifacts) error {
+	fail := func(err error) error {
+		return fmt.Errorf("cannot publish: %w", err)
+	}
+
+	if err := this.image.publish(ctx, as); err != nil {
+		return fail(err)
+	}
+
+	release, err := this.repo.releases.findCurrent(ctx)
+	if err != nil {
+		return fail(err)
+	}
+
+	if release == nil {
+		log.Info("outside of release; publish artifacts skipped")
+		return nil
+	}
+
+	l := log.With("release", release)
+
+	start := time.Now()
+	l.Debug("publish release...")
+
+	for a := range as.filter(func(candidate *buildArtifact) bool {
+		return candidate.t.canBePublished()
+	}) {
+		if _, err := release.uploadAsset(ctx, a.name(), a.mediaType(), "", a.filepath); err != nil {
+			return fail(err)
+		}
+	}
+
+	ll := l.With("duration", time.Now().Sub(start).Truncate(time.Millisecond))
+	if l.IsDebugEnabled() {
+		ll.Info("publish release...DONE!")
+	} else {
+		ll.Info("release published")
+	}
+
+	return nil
+}
+
 func (this *build) time() time.Time {
 	for {
 		if v := this.timeP.Load(); v != nil {
@@ -501,6 +543,6 @@ func (this buildContext) toLdFlags(testing bool) string {
 	}
 	return "-X main.version=" + testPrefix + this.version.String() + testSuffix +
 		" -X main.revision=" + this.revision +
-		" -X main.vendor=" + this.vendor +
+		" -X " + strconv.Quote("main.vendor="+this.vendor) +
 		" -X main.buildAt=" + this.time.Format(time.RFC3339)
 }

cmd/build/repo-prs.go

@@ -79,7 +79,7 @@ func (this *repoPrs) inspectAction(ctx context.Context, eventAction string, labe
 			With("label", this.testPublishLabel).
 			Info("PR was unlabeled or closed; therefore delete all images that might be related to this PR...")
 
-		if err := this.actions.packages.deleteVersionsWithTags(ctx, fmt.Sprintf("pr-%d", prNumber)); err != nil {
+		if err := pr.deleteRelatedArtifacts(ctx); err != nil {
 			return err
 		}
 	}
@@ -173,3 +173,26 @@ func (this *repoPr) latestWorkflowRun(ctx context.Context, workflowLoader func(c
 	}
 	return nil, nil
 }
+
+func (this *repoPr) deleteRelatedArtifacts(ctx context.Context) error {
+	fail := func(err error) error {
+		return fmt.Errorf("cannot delete artifacts for %v: %w", this, err)
+	}
+
+	do := func(tag string) error {
+		return this.parent.actions.packages.deleteVersionsWithTags(ctx, tag)
+	}
+
+	mainTag := fmt.Sprintf("pr-%d", this.GetID())
+
+	if err := do(mainTag); err != nil {
+		return fail(err)
+	}
+	for _, ed := range allEditionVariants {
+		if err := do(ed.String() + "-" + mainTag); err != nil {
+			return fail(err)
+		}
+	}
+
+	return nil
+}