From 9cbfd7c7cc34f2dfa8680cd271bcfee636d34b16 Mon Sep 17 00:00:00 2001
From: Himanshu Verma <himnshuverma10152006@gmail.com>
Date: Thu, 3 Sep 2026 01:53:22 +0530
Subject: [PATCH] ci(hubble): stamp org.opencontainers.image.revision on the
 image

The pd/store/server publish path passes the resolved source SHA to the
build as --label org.opencontainers.image.revision (and the matching
--set "*.labels...." for the Bake path), so hugegraph/pd:latest,
hugegraph/store:latest and hugegraph/server:latest can be traced back to
the apache/hugegraph commit they were built from.

The standard image path resolves the same SHA in its prepare job and uses
it only as the checkout ref, so hugegraph/hubble:latest carries no
org.opencontainers.image.revision label and a running Hubble container
cannot be tied to a hugegraph-toolchain commit. Hubble is built on its own
nightly schedule, so it can also lag the other three images with nothing
on the image to show it.

Pass the resolved SHA and the source repository URL to
docker/build-push-action as labels, which brings hubble in line with
pd/store/server. Every other wrapper that calls this reusable
workflow gains the same two labels.
---
 .github/workflows/_publish_image_reusable.yml | 8 ++++++++
 README.md                                     | 1 +
 2 files changed, 9 insertions(+)

diff --git a/.github/workflows/_publish_image_reusable.yml b/.github/workflows/_publish_image_reusable.yml
index 8802024..4964125 100644
--- a/.github/workflows/_publish_image_reusable.yml
+++ b/.github/workflows/_publish_image_reusable.yml
@@ -230,6 +230,10 @@ jobs:
     needs: prepare
     if: ${{ needs.prepare.outputs.need_update == 'true' }}
     runs-on: ubuntu-latest
+    env:
+      IMAGE_LABELS: |
+        org.opencontainers.image.revision=${{ needs.prepare.outputs.source_sha }}
+        org.opencontainers.image.source=https://github.com/${{ inputs.source_repository }}
     strategy:
       fail-fast: false
       matrix:
@@ -349,6 +353,7 @@ jobs:
         platforms: linux/amd64
         load: true
         tags: ${{ steps.params.outputs.image_url }}
+        labels: ${{ env.IMAGE_LABELS }}
         cache-from: ${{ steps.params.outputs.cache_from }}
         cache-to: ${{ steps.params.outputs.cache_to_min }}
         build-args: ${{ inputs.mvn_args }}
@@ -362,6 +367,7 @@ jobs:
         platforms: linux/amd64
         load: true
         tags: ${{ steps.params.outputs.image_url }}
+        labels: ${{ env.IMAGE_LABELS }}
         cache-from: ${{ steps.params.outputs.cache_from }}
         cache-to: ${{ steps.params.outputs.cache_to_min }}
 
@@ -392,6 +398,7 @@ jobs:
         platforms: ${{ steps.params.outputs.platforms }}
         push: ${{ needs.prepare.outputs.publish_images == 'true' }}
         tags: ${{ steps.params.outputs.image_url }}
+        labels: ${{ env.IMAGE_LABELS }}
         cache-from: ${{ steps.params.outputs.cache_from }}
         cache-to: ${{ steps.params.outputs.cache_to_max }}
         build-args: ${{ inputs.mvn_args }}
@@ -405,6 +412,7 @@ jobs:
         platforms: ${{ steps.params.outputs.platforms }}
         push: ${{ needs.prepare.outputs.publish_images == 'true' }}
         tags: ${{ steps.params.outputs.image_url }}
+        labels: ${{ env.IMAGE_LABELS }}
         cache-from: ${{ steps.params.outputs.cache_from }}
         cache-to: ${{ steps.params.outputs.cache_to_max }}
 
diff --git a/README.md b/README.md
index 1a97a27..57d7422 100644
--- a/README.md
+++ b/README.md
@@ -205,6 +205,7 @@ Reusable workflows are the real implementation layer.
 - selecting per-module build settings from `build_matrix_json`
 - enabling QEMU and Buildx when needed
 - running optional smoke tests
+- stamping `org.opencontainers.image.revision` and `org.opencontainers.image.source` with the resolved source commit and repository
 - pushing the final image
 - updating the latest-hash variable for `latest` mode only