docker: add OCI image labels for version and build date

[ssam18]

Running a container and not knowing which version you're on is a frustrating experience, especially when trying to decide whether to pull a newer image. This adds org.opencontainers.image.created and org.opencontainers.image.version labels to all published Docker images, populated from the build timestamp and the existing version tag generated during CI. Users can now run docker inspect <image> to instantly see what version they're running. Fixes #21645

[ssam18]

heads up! The labeler failure is not from this PR, it is a broken config in labeler.yml that's been failing on every PR. fix is included here, just needs a merge.

[taronaeo]

Seems like a good addition to me :)

[candrews]

Can you also some other image labels?

• org.opencontainers.image.source which would be https://github.com/ggml-org/llama.cpp
• org.opencontainers.image.revision which would be the git commit
• org.opencontainers.image.title
• org.opencontainers.image.url which would be https://github.com/ggml-org/llama.cpp
• org.opencontainers.image.description

These labels are documented at https://github.com/opencontainers/image-spec/blob/main/annotations.md#pre-defined-annotation-keys They're useful for both people to use manually and for automated systems to use (for example, Renovate uses this information to create better PR descriptions).

[CISC]

Add id: checkout to the checkout step so we can get the right SHA.

Please provide a successful run of the job (disable s390x).

[ssam18]

can we merge this PR?

[CISC]

can we merge this PR?

Where's the successful run?

[ssam18]

Successful run here: https://github.com/ssam18/llama.cpp/actions/runs/24752990085

Triggered from a throwaway branch off this PR with the s390x matrix entry removed (since the s390x runner isn't available on the fork). The PR branch itself is unchanged.

[CISC]

The labels don't seem to be applied:
https://github.com/ssam18/llama.cpp/pkgs/container/llama.cpp/812998280?tag=server-vulkan-ci-oci-labels-test-run-b8739-71dfdce

[ssam18]

The labels don't seem to be applied: https://github.com/ssam18/llama.cpp/pkgs/container/llama.cpp/812998280?tag=server-vulkan-ci-oci-labels-test-run-b8739-71dfdce

please check now.

[CISC]

The labels don't seem to be applied: https://github.com/ssam18/llama.cpp/pkgs/container/llama.cpp/812998280?tag=server-vulkan-ci-oci-labels-test-run-b8739-71dfdce

please check now.

You forgot to disable s390x.

[ssam18]

The labels don't seem to be applied: https://github.com/ssam18/llama.cpp/pkgs/container/llama.cpp/812998280?tag=server-vulkan-ci-oci-labels-test-run-b8739-71dfdce

please check now.

You forgot to disable s390x.

Thanks for calling that out. The earlier test image only had the Dockerfile LABEL changes, and GHCR does not show those on the package page because they live in the image config. The follow-up commit is the one that propagates the OCI metadata to the manifest and multi-arch index, which is what GHCR actually displays. Also, s390x was removed only on the temporary test branch to work around fork runner limits; the PR branch intentionally keeps it unchanged.