ci(docker): add metadata-action for tags

Generate Docker tags and labels with docker/metadata-action and feed them
into the publish build for consistent tagging.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: pRizz

.github/workflows/docker-publish.yml

@@ -81,6 +81,17 @@ jobs:
           # The Dockerfile is embedded in the Rust source
           cp packages/core/src/docker/Dockerfile .
 
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.IMAGE_NAME_GHCR }}
+            ${{ env.IMAGE_NAME_DOCKERHUB }}
+          tags: |
+            type=semver,pattern={{version}},value=${{ steps.version.outputs.version }}
+            type=raw,value=latest
+
       # Build and test BEFORE authenticating to registries
       # If smoke test fails, we don't waste time on login steps
 
@@ -95,6 +106,8 @@ jobs:
             OPENCODE_CLOUD_VERSION=${{ steps.version.outputs.version }}
           tags: |
             ${{ env.IMAGE_NAME_GHCR }}:test
+          # Separate cache scope to avoid overwriting the main publish build cache.
+          # GHA cache v2 is the recommended backend going forward.
           cache-from: type=gha,scope=opencode-cloud-sandbox-test,version=2
           cache-to: type=gha,scope=opencode-cloud-sandbox-test,mode=max,version=2
 
@@ -177,11 +190,10 @@ jobs:
           platforms: linux/amd64,linux/arm64
           build-args: |
             OPENCODE_CLOUD_VERSION=${{ steps.version.outputs.version }}
-          tags: |
-            ${{ env.IMAGE_NAME_GHCR }}:${{ steps.version.outputs.version }}
-            ${{ env.IMAGE_NAME_GHCR }}:latest
-            ${{ env.IMAGE_NAME_DOCKERHUB }}:${{ steps.version.outputs.version }}
-            ${{ env.IMAGE_NAME_DOCKERHUB }}:latest
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          # Scoped cache prevents thrash between test and publish builds.
+          # GHA cache v2 improves compatibility with the current cache API.
           cache-from: type=gha,scope=opencode-cloud-sandbox,version=2
           cache-to: type=gha,scope=opencode-cloud-sandbox,mode=max,version=2