feat(apps): enrich DockerHub images with OCI labels and Overview sync#36
Merged
Conversation
build-image.sh centralises the ten org.opencontainers.image.* labels so a label change is one edit instead of duplicated flags drifting across every project.json; it derives revision/created and passes buildx flags through so each call site owns --platform and --push/--load. update-description.sh syncs a DockerHub repo Overview from a source-controlled README.docker.md and fails loudly on any non-2xx so a broken sync surfaces in CI rather than passing silently. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
One file per image, the source of truth update-description.sh pushes to each DockerHub repo so the Overview never drifts from the repo. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Route the six buildx images through scripts/build-image.sh (both build-image and local-build-image, so labels are inspectable on local --load builds) and set the same org.opencontainers.image.* set on usersrole via jib.container .labels. Add an update-description postTarget to every image's version target to sync each DockerHub Overview on release. authdb build-image now pushes: it previously built to cache only, so its labels never reached the registry. Its Dockerfile LABELs are dropped in favour of the shared OCI set, correcting the stale MIT license to the org's actual PolyForm-Noncommercial-1.0.0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The `java` plugin extension shadows the java package inside build.gradle.kts, so `java.time.Instant.now()` failed to resolve. Import Instant and reference it unqualified. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Prettier expands the multi-item postTargets arrays to one entry per line. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the approved DockerHub Image Enrichment design (
docs/superpowers/specs/2026-06-30-dockerhub-image-enrichment-design.md) across all sevenjdwlabs/*images.Before: images were bare — only
authdbhad labels, and they were ad-hoc with a wrongMITlicense; DockerHub repos had no Overview; no way to trace a pull back to a version/commit/build.After: every image carries the full
org.opencontainers.image.*set (incl. dynamic version/revision/created), and every DockerHub repo's Overview is synced from a source-controlledREADME.docker.mdon release.Components
scripts/build-image.sh— centralises the ten OCI labels and hands off todocker buildx. Callers pass--platformand--push/--load, so one script serves release (multi-arch push), local (--load), and authdb. A label change is now one edit instead of ten flags drifting across sixproject.jsonfiles.scripts/update-description.sh— logs into the DockerHub API with the existingDOCKERHUB_USERNAME/DOCKERHUB_PASSWORDand PATCHes the repo Overview fromREADME.docker.md; fails loudly on any non-2xx.build-imageandlocal-build-imagethrough the script;usersrole(Jib) sets the same labels viajib.container.labelsinbuild.gradle.kts. Each image'sversiontarget gains anupdate-descriptionpostTarget, so it fires only for affected/released apps.README.docker.md×7 — the Overview source of truth (badges, quick start, ports, env, tags, license).Notable
build-imagepreviously built to cache only (no--push/--load), so labels never reached the registry — corrected. Its DockerfileLABELs are dropped in favour of the shared OCI set, fixing the staleMIT→PolyForm-Noncommercial-1.0.0.build-image.shuses buildx-arg passthrough instead of a fixed positional signature, because real configs need per-image--pushvs no-push vs--loadand variable platforms — the positional form couldn't express that.Verification
bash -nclean on both scripts; all 7project.jsonparse.build-image.shshim test: 10 labels + both tags + multi-word description + git revision + flag passthrough all correct.docker inspectshows all 10 labels resolved correctly (license fixed, revision = HEAD).🤖 Generated with Claude Code