Skip to content

Commit 4137eed

Browse files
ambient-code[bot]Ambient Code Botclaudejeremyeder
authored
feat: add org.opencontainers.image.revision OCI label to all container images (#1270)
<!-- acp:session_id=session-4e5cb5e4-6117-43bf-aef5-e905685f7425 source=#1269 last_action=2026-04-10T17:23:27Z retry_count=0 --> ## Summary - Adds `ARG GIT_COMMIT=unknown` and `LABEL org.opencontainers.image.revision=$GIT_COMMIT` to the final stage of all 7 production Dockerfiles (backend, frontend, operator, public-api, ambient-runner, state-sync, ambient-api-server) - Passes `GIT_COMMIT=${{ github.sha }}` in `build-args` for both push and PR build steps in `components-build-deploy.yml` - Passes `GIT_COMMIT=${{ github.sha }}` in `build-args` in `prod-release-deploy.yaml` (alongside existing `AMBIENT_VERSION` which is set to the release tag, not a SHA) - Passes `--build-arg GIT_COMMIT=$(git rev-parse HEAD)` in all Makefile build targets (including `kind-reload-*` and `local-reload-api-server`) ## Test plan - [ ] Verify label is present on a locally built image: `podman build --build-arg GIT_COMMIT=$(git rev-parse HEAD) -t test components/backend && podman inspect test | jq '.[0].Config.Labels["org.opencontainers.image.revision"]'` - [ ] Verify CI builds pass with new `build-args` format - [ ] Verify `skopeo inspect docker://quay.io/ambient_code/vteam_backend:<sha> | jq '.Labels["org.opencontainers.image.revision"]'` returns a valid SHA after merge Closes #1269 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- 🤖 [Ambient Session](https://ambient-code.apps.rosa.vteam-uat.0ksl.p3.openshiftapps.com/projects/ambient-platform-and-workflow-feedback-loop-running/sessions/session-4e5cb5e4-6117-43bf-aef5-e905685f7425) Co-authored-by: Ambient Code Bot <bot@ambient-code.local> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Jeremy Eder <jeder@redhat.com>
1 parent 0b84775 commit 4137eed

10 files changed

Lines changed: 48 additions & 5 deletions

File tree

‎.github/workflows/components-build-deploy.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,9 @@ jobs:
124124
platforms: ${{ matrix.arch.platform }}
125125
push: true
126126
tags: ${{ matrix.component.image }}:${{ github.sha }}-${{ matrix.arch.suffix }}
127-
build-args: AMBIENT_VERSION=${{ github.sha }}
127+
build-args: |
128+
AMBIENT_VERSION=${{ github.sha }}
129+
GIT_COMMIT=${{ github.sha }}
128130
cache-from: type=gha,scope=${{ matrix.component.name }}-${{ matrix.arch.suffix }}
129131
cache-to: type=gha,mode=max,scope=${{ matrix.component.name }}-${{ matrix.arch.suffix }}
130132

@@ -137,7 +139,9 @@ jobs:
137139
platforms: ${{ matrix.arch.platform }}
138140
push: true
139141
tags: ${{ matrix.component.image }}:pr-${{ github.event.pull_request.number }}-${{ matrix.arch.suffix }}
140-
build-args: AMBIENT_VERSION=${{ github.sha }}
142+
build-args: |
143+
AMBIENT_VERSION=${{ github.sha }}
144+
GIT_COMMIT=${{ github.sha }}
141145
cache-from: type=gha,scope=${{ matrix.component.name }}-${{ matrix.arch.suffix }}
142146
cache-to: type=gha,mode=max,scope=${{ matrix.component.name }}-${{ matrix.arch.suffix }}
143147

‎.github/workflows/prod-release-deploy.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -315,7 +315,9 @@ jobs:
315315
platforms: ${{ matrix.arch.platform }}
316316
push: true
317317
tags: ${{ matrix.component.image }}:${{ needs.release.outputs.new_tag }}-${{ matrix.arch.suffix }}
318-
build-args: AMBIENT_VERSION=${{ needs.release.outputs.new_tag }}
318+
build-args: |
319+
AMBIENT_VERSION=${{ needs.release.outputs.new_tag }}
320+
GIT_COMMIT=${{ github.sha }}
319321
cache-from: type=gha,scope=${{ matrix.component.name }}-${{ matrix.arch.suffix }}
320322
cache-to: type=gha,mode=max,scope=${{ matrix.component.name }}-${{ matrix.arch.suffix }}
321323

‎Makefile‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -168,43 +168,50 @@ build-all: build-frontend build-backend build-operator build-runner build-state-
168168
build-frontend: ## Build frontend image
169169
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Building frontend with $(CONTAINER_ENGINE)..."
170170
@cd components/frontend && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) $(BUILD_FLAGS) \
171+
--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
171172
-t $(FRONTEND_IMAGE) .
172173
@echo "$(COLOR_GREEN)✓$(COLOR_RESET) Frontend built: $(FRONTEND_IMAGE)"
173174

174175
build-backend: ## Build backend image
175176
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Building backend with $(CONTAINER_ENGINE)..."
176177
@cd components/backend && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) $(BUILD_FLAGS) \
177178
--build-arg AMBIENT_VERSION=$(shell git describe --tags --always --dirty) \
179+
--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
178180
-t $(BACKEND_IMAGE) .
179181
@echo "$(COLOR_GREEN)✓$(COLOR_RESET) Backend built: $(BACKEND_IMAGE)"
180182

181183
build-operator: ## Build operator image
182184
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Building operator with $(CONTAINER_ENGINE)..."
183185
@cd components/operator && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) $(BUILD_FLAGS) \
186+
--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
184187
-t $(OPERATOR_IMAGE) .
185188
@echo "$(COLOR_GREEN)✓$(COLOR_RESET) Operator built: $(OPERATOR_IMAGE)"
186189

187190
build-runner: ## Build Claude Code runner image
188191
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Building runner with $(CONTAINER_ENGINE)..."
189192
@cd components/runners/ambient-runner && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) $(BUILD_FLAGS) \
193+
--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
190194
-t $(RUNNER_IMAGE) .
191195
@echo "$(COLOR_GREEN)✓$(COLOR_RESET) Runner built: $(RUNNER_IMAGE)"
192196

193197
build-state-sync: ## Build state-sync image for S3 persistence
194198
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Building state-sync with $(CONTAINER_ENGINE)..."
195199
@cd components/runners/state-sync && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) $(BUILD_FLAGS) \
200+
--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
196201
-t $(STATE_SYNC_IMAGE) .
197202
@echo "$(COLOR_GREEN)✓$(COLOR_RESET) State-sync built: $(STATE_SYNC_IMAGE)"
198203

199204
build-public-api: ## Build public API gateway image
200205
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Building public-api with $(CONTAINER_ENGINE)..."
201206
@cd components/public-api && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) $(BUILD_FLAGS) \
207+
--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
202208
-t $(PUBLIC_API_IMAGE) .
203209
@echo "$(COLOR_GREEN)✓$(COLOR_RESET) Public API built: $(PUBLIC_API_IMAGE)"
204210

205211
build-api-server: ## Build ambient API server image
206212
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Building ambient-api-server with $(CONTAINER_ENGINE)..."
207213
@cd components/ambient-api-server && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) $(BUILD_FLAGS) \
214+
--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
208215
-t $(API_SERVER_IMAGE) .
209216
@echo "$(COLOR_GREEN)✓$(COLOR_RESET) API server built: $(API_SERVER_IMAGE)"
210217

@@ -347,7 +354,7 @@ local-status: check-kubectl ## Show status of local deployment
347354

348355
local-reload-api-server: check-local-context ## Rebuild and reload ambient-api-server only
349356
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Rebuilding ambient-api-server..."
350-
@$(CONTAINER_ENGINE) build $(PLATFORM_FLAG) -t $(API_SERVER_IMAGE) components/ambient-api-server >/dev/null 2>&1
357+
@$(CONTAINER_ENGINE) build $(PLATFORM_FLAG) --build-arg GIT_COMMIT=$(shell git rev-parse HEAD) -t $(API_SERVER_IMAGE) components/ambient-api-server >/dev/null 2>&1
351358
@$(CONTAINER_ENGINE) tag $(API_SERVER_IMAGE) localhost/$(API_SERVER_IMAGE) 2>/dev/null || true
352359
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Loading image into kind cluster ($(KIND_CLUSTER_NAME))..."
353360
@$(CONTAINER_ENGINE) save localhost/$(API_SERVER_IMAGE) | \
@@ -962,6 +969,7 @@ kind-reload-backend: check-kind check-kubectl check-local-context ## Rebuild and
962969
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Rebuilding backend..."
963970
@cd components/backend && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) \
964971
--build-arg AMBIENT_VERSION=$(shell git describe --tags --always --dirty) \
972+
--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
965973
-t $(BACKEND_IMAGE) . $(QUIET_REDIRECT)
966974
@$(CONTAINER_ENGINE) tag $(BACKEND_IMAGE) localhost/$(BACKEND_IMAGE) 2>/dev/null || true
967975
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Loading image into kind cluster ($(KIND_CLUSTER_NAME))..."
@@ -976,6 +984,7 @@ kind-reload-backend: check-kind check-kubectl check-local-context ## Rebuild and
976984
kind-reload-frontend: check-kind check-kubectl check-local-context ## Rebuild and reload frontend only (kind)
977985
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Rebuilding frontend..."
978986
@cd components/frontend && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) \
987+
--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
979988
-t $(FRONTEND_IMAGE) . $(QUIET_REDIRECT)
980989
@$(CONTAINER_ENGINE) tag $(FRONTEND_IMAGE) localhost/$(FRONTEND_IMAGE) 2>/dev/null || true
981990
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Loading image into kind cluster ($(KIND_CLUSTER_NAME))..."
@@ -990,6 +999,7 @@ kind-reload-frontend: check-kind check-kubectl check-local-context ## Rebuild an
990999
kind-reload-operator: check-kind check-kubectl check-local-context ## Rebuild and reload operator only (kind)
9911000
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Rebuilding operator..."
9921001
@cd components/operator && $(CONTAINER_ENGINE) build $(PLATFORM_FLAG) \
1002+
--build-arg GIT_COMMIT=$(shell git rev-parse HEAD) \
9931003
-t $(OPERATOR_IMAGE) . $(QUIET_REDIRECT)
9941004
@$(CONTAINER_ENGINE) tag $(OPERATOR_IMAGE) localhost/$(OPERATOR_IMAGE) 2>/dev/null || true
9951005
@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Loading image into kind cluster ($(KIND_CLUSTER_NAME))..."

‎components/ambient-api-server/Dockerfile‎

100644100755
Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ RUN go build -ldflags="-s -w" -o ambient-api-server ./cmd/ambient-api-server
1818
# Runtime stage
1919
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
2020

21+
ARG GIT_COMMIT=unknown
22+
2123
RUN \
2224
microdnf install -y \
2325
util-linux \
@@ -33,4 +35,5 @@ ENTRYPOINT ["/usr/local/bin/ambient-api-server", "serve"]
3335
LABEL name="ambient-api-server" \
3436
version="0.0.1" \
3537
summary="Ambient API Server" \
36-
description="REST API server for the Ambient Code Platform"
38+
description="REST API server for the Ambient Code Platform" \
39+
org.opencontainers.image.revision=$GIT_COMMIT

‎components/backend/Dockerfile‎

100644100755
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X main.GitVersion=${AMBIE
2121
# Final stage
2222
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
2323

24+
ARG GIT_COMMIT=unknown
25+
2426
RUN microdnf install -y git && microdnf clean all
2527
WORKDIR /app
2628

@@ -39,4 +41,6 @@ USER 1001
3941
EXPOSE 8080
4042

4143
# Command to run the executable
44+
LABEL org.opencontainers.image.revision=$GIT_COMMIT
45+
4246
CMD ["./main"]

‎components/frontend/Dockerfile‎

100644100755
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ RUN npm run build
3232
# Production image, copy all the files and run next
3333
FROM registry.access.redhat.com/ubi9/nodejs-20-minimal AS runner
3434

35+
ARG GIT_COMMIT=unknown
36+
3537
WORKDIR /app
3638

3739
ENV NODE_ENV=production
@@ -64,4 +66,6 @@ ENV HOSTNAME="0.0.0.0"
6466

6567
# server.js is created by next build from the standalone output
6668
# https://nextjs.org/docs/pages/api-reference/next-config-js/output
69+
LABEL org.opencontainers.image.revision=$GIT_COMMIT
70+
6771
CMD ["node", "server.js"]

‎components/operator/Dockerfile‎

100644100755
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o operator .
2727
# Final stage
2828
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
2929

30+
ARG GIT_COMMIT=unknown
31+
3032
WORKDIR /app
3133

3234
RUN microdnf install -y procps && microdnf clean all
@@ -37,6 +39,8 @@ COPY --from=builder /app/operator .
3739
# Set executable permissions and make accessible to any user
3840
RUN chmod +x ./operator && chmod 775 /app
3941

42+
LABEL org.opencontainers.image.revision=$GIT_COMMIT
43+
4044
USER 1001
4145

4246
# Use ENTRYPOINT so that args from K8s are appended, not replaced

‎components/public-api/Dockerfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o public-api .
1818
# Runtime stage
1919
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7
2020

21+
ARG GIT_COMMIT=unknown
22+
2123
WORKDIR /app
2224

2325
# Copy binary from builder
@@ -36,4 +38,6 @@ HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
3638
CMD curl -sf http://localhost:8081/health || exit 1
3739

3840
# Run the binary
41+
LABEL org.opencontainers.image.revision=$GIT_COMMIT
42+
3943
ENTRYPOINT ["./public-api"]

‎components/runners/ambient-runner/Dockerfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
FROM registry.access.redhat.com/ubi10/ubi@sha256:f573194e8e5231f1c9340c497e1f8d9aa9dbb42b2849e60341e34f50eec9477e
22

3+
ARG GIT_COMMIT=unknown
4+
35
USER 0
46

57
# --- Pinned tool versions (bumped by runner-tool-versions workflow) ---
@@ -69,4 +71,6 @@ EXPOSE 8001
6971

7072
# Start FastAPI AG-UI server using uvicorn
7173
# The main module is installed as part of the package
74+
LABEL org.opencontainers.image.revision=$GIT_COMMIT
75+
7276
CMD ["/bin/bash", "-c", "umask 0022 && cd /app/ambient-runner && uvicorn main:app --host 0.0.0.0 --port 8001"]

‎components/runners/state-sync/Dockerfile‎

100644100755
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
FROM alpine:3.21
22

3+
ARG GIT_COMMIT=unknown
4+
35
RUN apk add --no-cache rclone git jq bash sqlite
46

57
# Copy scripts
@@ -10,4 +12,6 @@ COPY sync.sh /usr/local/bin/sync.sh
1012
RUN chmod +x /usr/local/bin/hydrate.sh /usr/local/bin/sync.sh
1113

1214
# Default to sync.sh (used by sidecar)
15+
LABEL org.opencontainers.image.revision=$GIT_COMMIT
16+
1317
ENTRYPOINT ["/usr/local/bin/sync.sh"]

0 commit comments

Comments
 (0)