fix(ci): skip source-label in annotations

Author: tobiasehlert

.github/workflows/build.yml

@@ -183,32 +183,14 @@ jobs:
         run: |
           # Create the manifest list and push to both registries
           docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(jq -cr '.labels | to_entries | map("--annotation " + ("index:" + .key + "=" + .value | @sh)) | join(" ")' <<<"$DOCKER_METADATA_OUTPUT_JSON") \
+            $(jq -cr '.labels | to_entries | map(select(.key != "org.opencontainers.image.source")) | map("--annotation " + ("index:" + .key + "=" + .value | @sh)) | join(" ")' <<<"$DOCKER_METADATA_OUTPUT_JSON") \
             $(printf '${{ github.repository }}@sha256:%s ' *) \
             $(printf 'ghcr.io/${{ github.repository }}@sha256:%s ' *)
 
           # Get the digest of the created manifest list
           DIGEST=$(docker buildx imagetools inspect ghcr.io/${{ github.repository }}:${{ steps.docker_meta.outputs.version }} --format '{{json .Manifest.Digest}}' | jq -r .)
           echo "digest=$DIGEST" >> $GITHUB_OUTPUT
 
-      - name: Inspect images
-        run: |
-          echo "::group::DockerHub"
-          docker buildx imagetools inspect ${{ github.repository }}:${{ steps.docker_meta.outputs.version }}
-          echo "::endgroup::"
-
-          echo "::group::GitHub Container Registry"
-          docker buildx imagetools inspect ghcr.io/${{ github.repository }}:${{ steps.docker_meta.outputs.version }}
-          echo "::endgroup::"
-
-      - name: Cosign sign images (GitHub OIDC)
-        run: |
-          cosign sign --yes \
-            ${{ github.repository }}@${{ steps.docker_build.outputs.digest }}
-
-          cosign sign --yes \
-            ghcr.io/${{ github.repository }}@${{ steps.docker_build.outputs.digest }}
-
       - name: Attest docker build (DockerHub)
         uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a #v3.0.0
         with:
@@ -223,6 +205,24 @@ jobs:
           subject-digest: ${{ steps.docker_build.outputs.digest }}
           push-to-registry: true
 
+      - name: Cosign sign images (GitHub OIDC)
+        run: |
+          cosign sign --yes \
+            ${{ github.repository }}@${{ steps.docker_build.outputs.digest }}
+
+          cosign sign --yes \
+            ghcr.io/${{ github.repository }}@${{ steps.docker_build.outputs.digest }}
+
+      - name: Inspect images
+        run: |
+          echo "::group::DockerHub"
+          docker buildx imagetools inspect ${{ github.repository }}:${{ steps.docker_meta.outputs.version }}
+          echo "::endgroup::"
+
+          echo "::group::GitHub Container Registry"
+          docker buildx imagetools inspect ghcr.io/${{ github.repository }}:${{ steps.docker_meta.outputs.version }}
+          echo "::endgroup::"
+
   argocd:
     if: github.event_name == 'release' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
     runs-on: ubuntu-latest