feat(images): add OCI source metadata

[kvinwang]

Summary

• add standard OCI source, revision, version, documentation, license, and pinned base-image metadata to the KMS, Gateway, and Verifier image configs
• publish the same metadata as OCI manifest annotations and as /etc/<image-name>/build-info
• pass deterministic metadata values through both release workflows and local image builds
• require release workflows to run from the matching component tag namespace

Testing

• git diff --check
• YAML parsing for all three release workflows
• bash -n for the shared and component image build scripts
• docker buildx build --call=check for the KMS, Gateway, and Verifier Dockerfiles

[Copilot]

🟡 Changes recommended

The Gateway release workflow omits DSTACK_SRC_URL in build args, causing the Docker build stage to clone from a hardcoded default source URL and breaking deterministic source selection on non-github.com server URLs.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adds standardized OCI image metadata (source, revision, version, docs, license, base image) to the KMS, Gateway, and Verifier container images, ensuring the same values are available both as image labels/manifest annotations and inside the image filesystem for runtime inspection.

Changes:

• Add OCI labels and /etc/<image>/build-info files to the KMS, Gateway, and Verifier Dockerfiles.
• Plumb deterministic IMAGE_VERSION and IMAGE_SOURCE_URL build args through the shared local build helper.
• Enhance release workflows to validate tag namespaces and publish OCI manifest annotations matching the in-image metadata.

File summaries

File	Description
dstack/verifier/builder/Dockerfile	Adds OCI labels and writes /etc/dstack-verifier/build-info.
dstack/kms/dstack-app/builder/Dockerfile	Adds OCI labels and writes /etc/dstack-kms/build-info.
dstack/gateway/dstack-app/builder/Dockerfile	Adds OCI labels and writes /etc/dstack-gateway/build-info.
dstack/build/shared/build-lib.sh	Passes IMAGE_VERSION / IMAGE_SOURCE_URL into local builds as build args.
.github/workflows/verifier-release.yml	Validates tag prefix; passes metadata build args; publishes manifest annotations.
.github/workflows/kms-release.yml	Validates tag prefix; passes metadata build args; publishes manifest annotations.
.github/workflows/gateway-release.yml	Validates tag prefix; publishes manifest annotations; (needs one missing build-arg fix).

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.