Bug report: incorrect Docker image labels

[Tom Plant]

Describe the bug
The Docker image manifest is inheriting labels from nginx, rather than the labels generated in CI

To Reproduce

1. View the Docker image manifest on GHCR
2. Compare to the CI labels

Expected behaviour
CI labels:

"labels": {
  "org.opencontainers.image.created": "2024-04-02T20:47:49.230Z",
  "org.opencontainers.image.description": "The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis",
  "org.opencontainers.image.licenses": "Apache-2.0",
  "org.opencontainers.image.revision": "c35557aea5204[62](https://github.com/gchq/CyberChef/actions/runs/8529184419/job/23364409016#step:9:70)28af7c545cf05337c6245e087",
  "org.opencontainers.image.source": "https://github.com/gchq/CyberChef",
  "org.opencontainers.image.title": "CyberChef",
  "org.opencontainers.image.url": "https://github.com/gchq/CyberChef",
  "org.opencontainers.image.version": "10"
}

Manifest labels:

"labels": {
  "org.opencontainers.image.url": "https://hub.docker.com/_/nginx",
  "org.opencontainers.image.source": "https://github.com/nginxinc/docker-nginx.git#1f227619c1f1baa0bed8bed844ea614437ff14fb:mainline/alpine",
  "org.opencontainers.image.revision": "1f227619c1f1baa0bed8bed844ea614437ff14fb",
  "org.opencontainers.image.created": "2024-02-14T18:24:57Z",
  "org.opencontainers.image.version": "1.25.4-alpine",
  "com.docker.official-images.bashbrew.arch": "amd64",
  "org.opencontainers.image.base.digest": "sha256:3bef9528bb5cea997fb7e0f106d2a4a6142cd0e8e8068f4cb54edc148b872fe7",
  "org.opencontainers.image.base.name": "nginx:1.25.4-alpine-slim"
}

[Ashleigh Carr]

Curious!

When inspecting the image with podman inspect ghcr.io/gchq/cyberchef:latest I see that the manifest has both a Labels and an Annotations attribute.

          "Labels": {
               "io.buildah.version": "1.23.1",
               "maintainer": "NGINX Docker Maintainers <[e-mail]>",
               "org.opencontainers.image.created": "2024-04-05T17:27:58.780Z",
               "org.opencontainers.image.description": "The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis",
               "org.opencontainers.image.licenses": "Apache-2.0",
               "org.opencontainers.image.revision": "33a473c09b33360b03c76c2c01eec8c4b0adf714",
               "org.opencontainers.image.source": "https://github.com/gchq/CyberChef",
               "org.opencontainers.image.title": "CyberChef",
               "org.opencontainers.image.url": "https://github.com/gchq/CyberChef",
               "org.opencontainers.image.version": "10"
          },
          "Annotations": {
               "com.docker.official-images.bashbrew.arch": "amd64",
               "org.opencontainers.image.base.digest": "sha256:3bef9528bb5cea997fb7e0f106d2a4a6142cd0e8e8068f4cb54edc148b872fe7",
               "org.opencontainers.image.base.name": "nginx:1.25.4-alpine-slim",
               "org.opencontainers.image.created": "2024-02-14T18:24:57Z",
               "org.opencontainers.image.revision": "1f227619c1f1baa0bed8bed844ea614437ff14fb",
               "org.opencontainers.image.source": "https://github.com/nginxinc/docker-nginx.git#1f227619c1f1baa0bed8bed844ea614437ff14fb:mainline/alpine",
               "org.opencontainers.image.url": "https://hub.docker.com/_/nginx",
               "org.opencontainers.image.version": "1.25.4-alpine"
          },

I think the problem is that the buildah-build action we use to build the image is applying the org.opencontainers metadata to Labels attribute instead of Annotations (where Github and other tools expect this metadata to be). I've raised a PR to add support for annotations to buildah-build here, once thats merged we can fix the CI in this repo.