feat(images): add OCI source metadata

.github/workflows/docker-build-check.yml

@@ -16,19 +16,32 @@
       - 'dstack/**'
       - 'rust-toolchain.toml'
       - '.github/workflows/docker-build-check.yml'
+      - '.github/workflows/kms-release.yml'
+      - '.github/workflows/gateway-release.yml'
+      - '.github/workflows/verifier-release.yml'
   pull_request:
     branches: [ next, 'release/**' ]
     paths:
       - 'dstack/**'
       - 'rust-toolchain.toml'
       - '.github/workflows/docker-build-check.yml'
+      - '.github/workflows/kms-release.yml'
+      - '.github/workflows/gateway-release.yml'
+      - '.github/workflows/verifier-release.yml'
 
 env:
   DSTACK_REV: ${{ github.event.pull_request.head.sha || github.sha }}
   DSTACK_SRC_URL: ${{ github.event.pull_request.head.repo.clone_url || format('{0}/{1}', github.server_url, github.repository) }}
 
 jobs:
+  build-script-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Test release build orchestration
+        run: python3 -m unittest discover -s dstack/build/shared/tests -v
+
   gateway:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5

.github/workflows/gateway-release.yml

@@ -6,6 +6,11 @@ name: Gateway Release
 
 on:
   workflow_dispatch:
+    inputs:
+      version:
+        description: Existing release tag version without the gateway-v prefix
+        required: true
+        type: string
   push:
     tags:
       - 'gateway-v*'
@@ -19,15 +24,30 @@ jobs:
   build-and-release:
     runs-on: ubuntu-latest
     steps:
+      - name: Parse and check version
+        env:
+          DISPATCH_VERSION: ${{ inputs.version }}
+        run: |
+          if [ "$GITHUB_EVENT_NAME" = workflow_dispatch ]; then
+            VERSION=$DISPATCH_VERSION
+          else
+            case "$GITHUB_REF" in
+              refs/tags/gateway-v*) VERSION=${GITHUB_REF#refs/tags/gateway-v} ;;
+              *) echo "Expected a gateway-v* tag" >&2; exit 1 ;;
+            esac
+          fi
+          if [[ ! "$VERSION" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]]; then
+            echo "Version must be a valid Docker tag" >&2
+            exit 1
+          fi
+          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
+          echo "RELEASE_TAG=gateway-v$VERSION" >> "$GITHUB_ENV"
+
+      # Manual runs rebuild an existing release tag, not the selected branch.
       - name: Checkout repository
         uses: actions/checkout@v5
-
-      - name: Parse version from tag
-        run: |
-          # Extract version from tag (e.g., gateway-v1.2.3 -> 1.2.3)
-          VERSION=${GITHUB_REF#refs/tags/gateway-v}
-          echo "VERSION=$VERSION" >> $GITHUB_ENV
-          echo "Parsed version: $VERSION"
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && env.RELEASE_TAG || github.sha }}
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
@@ -38,27 +58,31 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Get Git commit timestamps
-        run: |
-          echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
-          echo "GIT_REV=$(git rev-parse HEAD)" >> $GITHUB_ENV
+      - name: Resolve the revision to build
+        run: echo "GIT_REV=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
 
+      # Release images are built through the same script contributors run by
+      # hand, so a published image can be reproduced and checked digest-for-digest.
+      # See the builder README for the reproduction recipe.
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v5
         env:
-          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
-        with:
-          context: dstack/gateway/dstack-app/builder
-          push: true
-          tags: ${{ vars.DOCKERHUB_ORG }}/dstack-gateway:${{ env.VERSION }}
-          platforms: linux/amd64
-          provenance: false
-          build-contexts: |
-            build-shared=dstack/build/shared
-          build-args: |
-            DSTACK_REV=${{ env.GIT_REV }}
-            SOURCE_DATE_EPOCH=${{ env.TIMESTAMP }}
+          PUSH: "1"
+          METADATA_FILE: ${{ runner.temp }}/build-metadata.json
+          GIT_REV: ${{ env.GIT_REV }}
+          IMAGE_VERSION: ${{ env.VERSION }}
+          IMAGE_NAME: ${{ vars.DOCKERHUB_ORG }}/dstack-gateway:${{ env.VERSION }}
+          IMAGE_SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}
+          DSTACK_SRC_URL: ${{ github.server_url }}/${{ github.repository }}.git
+        run: |
+          dstack/gateway/dstack-app/builder/build-image.sh \
+            "$IMAGE_NAME"
+          digest=$(jq -r '."containerimage.digest"' "$METADATA_FILE")
+          if [ -z "$digest" ] || [ "$digest" = null ]; then
+            echo "the build did not report an image digest" >&2
+            exit 1
+          fi
+          echo "digest=$digest" >> "$GITHUB_OUTPUT"
 
       - name: Generate artifact attestation
         uses: actions/attest-build-provenance@v1
@@ -70,6 +94,8 @@ jobs:
       - name: GitHub Release
         uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ env.RELEASE_TAG }}
+          target_commitish: ${{ env.GIT_REV }}
           name: "Gateway Release v${{ env.VERSION }}"
           body: |
             ## Docker Image Information

.github/workflows/kms-release.yml

@@ -6,6 +6,11 @@ name: KMS Release
 
 on:
   workflow_dispatch:
+    inputs:
+      version:
+        description: Existing release tag version without the kms-v prefix
+        required: true
+        type: string
   push:
     tags:
       - 'kms-v*'
@@ -19,8 +24,30 @@ jobs:
   build-and-release:
     runs-on: ubuntu-latest
     steps:
+      - name: Parse and check version
+        env:
+          DISPATCH_VERSION: ${{ inputs.version }}
+        run: |
+          if [ "$GITHUB_EVENT_NAME" = workflow_dispatch ]; then
+            VERSION=$DISPATCH_VERSION
+          else
+            case "$GITHUB_REF" in
+              refs/tags/kms-v*) VERSION=${GITHUB_REF#refs/tags/kms-v} ;;
+              *) echo "Expected a kms-v* tag" >&2; exit 1 ;;
+            esac
+          fi
+          if [[ ! "$VERSION" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]]; then
+            echo "Version must be a valid Docker tag" >&2
+            exit 1
+          fi
+          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
+          echo "RELEASE_TAG=kms-v$VERSION" >> "$GITHUB_ENV"
+
+      # Manual runs rebuild an existing release tag, not the selected branch.
       - name: Checkout repository
         uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && env.RELEASE_TAG || github.sha }}
 
       - name: Checkout contract dependencies
         run: |
@@ -29,13 +56,6 @@ jobs:
             dstack/kms/auth-eth/lib/openzeppelin-contracts-upgradeable \
             dstack/kms/auth-eth/lib/openzeppelin-foundry-upgrades
 
-      - name: Parse version from tag
-        run: |
-          # Extract version from tag (e.g., kms-v1.2.3 -> 1.2.3)
-          VERSION=${GITHUB_REF#refs/tags/kms-v}
-          echo "VERSION=$VERSION" >> $GITHUB_ENV
-          echo "Parsed version: $VERSION"
-
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
         with:
@@ -45,28 +65,31 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Get Git commit timestamps
-        run: |
-          echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
-          echo "GIT_REV=$(git rev-parse HEAD)" >> $GITHUB_ENV
+      - name: Resolve the revision to build
+        run: echo "GIT_REV=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
 
+      # Release images are built through the same script contributors run by
+      # hand, so a published image can be reproduced and checked digest-for-digest.
+      # See the builder README for the reproduction recipe.
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v5
         env:
-          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
-        with:
-          context: dstack/kms/dstack-app/builder
-          push: true
-          tags: ${{ vars.DOCKERHUB_ORG }}/dstack-kms:${{ env.VERSION }}
-          platforms: linux/amd64
-          provenance: false
-          build-contexts: |
-            build-shared=dstack/build/shared
-          build-args: |
-            DSTACK_REV=${{ env.GIT_REV }}
-            DSTACK_SRC_URL=${{ github.server_url }}/${{ github.repository }}
-            SOURCE_DATE_EPOCH=${{ env.TIMESTAMP }}
+          PUSH: "1"
+          METADATA_FILE: ${{ runner.temp }}/build-metadata.json
+          GIT_REV: ${{ env.GIT_REV }}
+          IMAGE_VERSION: ${{ env.VERSION }}
+          IMAGE_NAME: ${{ vars.DOCKERHUB_ORG }}/dstack-kms:${{ env.VERSION }}
+          IMAGE_SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}
+          DSTACK_SRC_URL: ${{ github.server_url }}/${{ github.repository }}.git
+        run: |
+          dstack/kms/dstack-app/builder/build-image.sh \
+            "$IMAGE_NAME"
+          digest=$(jq -r '."containerimage.digest"' "$METADATA_FILE")
+          if [ -z "$digest" ] || [ "$digest" = null ]; then
+            echo "the build did not report an image digest" >&2
+            exit 1
+          fi
+          echo "digest=$digest" >> "$GITHUB_OUTPUT"
 
       - name: Generate artifact attestation
         uses: actions/attest-build-provenance@v1
@@ -87,6 +110,8 @@ jobs:
       - name: GitHub Release
         uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ env.RELEASE_TAG }}
+          target_commitish: ${{ env.GIT_REV }}
           name: "KMS Release v${{ env.VERSION }}"
           files: |
             dstack/kms/auth-eth/out/DstackKms.sol/DstackKms.json

.github/workflows/verifier-release.yml

@@ -6,6 +6,11 @@ name: Verifier Release
 
 on:
   workflow_dispatch:
+    inputs:
+      version:
+        description: Existing release tag version without the verifier-v prefix
+        required: true
+        type: string
   push:
     tags:
       - 'verifier-v*'
@@ -19,14 +24,30 @@ jobs:
   build-and-release:
     runs-on: ubuntu-latest
     steps:
+      - name: Parse and check version
+        env:
+          DISPATCH_VERSION: ${{ inputs.version }}
+        run: |
+          if [ "$GITHUB_EVENT_NAME" = workflow_dispatch ]; then
+            VERSION=$DISPATCH_VERSION
+          else
+            case "$GITHUB_REF" in
+              refs/tags/verifier-v*) VERSION=${GITHUB_REF#refs/tags/verifier-v} ;;
+              *) echo "Expected a verifier-v* tag" >&2; exit 1 ;;
+            esac
+          fi
+          if [[ ! "$VERSION" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]]; then
+            echo "Version must be a valid Docker tag" >&2
+            exit 1
+          fi
+          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
+          echo "RELEASE_TAG=verifier-v$VERSION" >> "$GITHUB_ENV"
+
+      # Manual runs rebuild an existing release tag, not the selected branch.
       - name: Checkout repository
         uses: actions/checkout@v5
-
-      - name: Parse version from tag
-        run: |
-          VERSION=${GITHUB_REF#refs/tags/verifier-v}
-          echo "VERSION=$VERSION" >> $GITHUB_ENV
-          echo "Parsed version: $VERSION"
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && env.RELEASE_TAG || github.sha }}
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
@@ -37,31 +58,33 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Get Git commit timestamps
-        run: |
-          echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
-          echo "GIT_REV=$(git rev-parse HEAD)" >> $GITHUB_ENV
+      - name: Resolve the revision to build
+        run: echo "GIT_REV=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
 
+      # Release images are built through the same script contributors run by
+      # hand, so a published image can be reproduced and checked digest-for-digest.
+      # See the builder README for the reproduction recipe.
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v5
         env:
-          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
-        with:
-          context: dstack/verifier
-          file: dstack/verifier/builder/Dockerfile
-          push: true
-          tags: |
-            ${{ vars.DOCKERHUB_ORG }}/dstack-verifier:${{ env.VERSION }}
-            ${{ vars.DOCKERHUB_ORG }}/dstack-verifier:latest
-          platforms: linux/amd64
-          provenance: false
-          build-contexts: |
-            build-shared=dstack/build/shared
-          build-args: |
-            DSTACK_REV=${{ env.GIT_REV }}
-            DSTACK_SRC_URL=${{ github.server_url }}/${{ github.repository }}.git
-            SOURCE_DATE_EPOCH=${{ env.TIMESTAMP }}
+          PUSH: "1"
+          METADATA_FILE: ${{ runner.temp }}/build-metadata.json
+          GIT_REV: ${{ env.GIT_REV }}
+          IMAGE_VERSION: ${{ env.VERSION }}
+          IMAGE_NAME: ${{ vars.DOCKERHUB_ORG }}/dstack-verifier:${{ env.VERSION }}
+          LATEST_IMAGE_NAME: ${{ vars.DOCKERHUB_ORG }}/dstack-verifier:latest
+          IMAGE_SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}
+          DSTACK_SRC_URL: ${{ github.server_url }}/${{ github.repository }}.git
+        run: |
+          dstack/verifier/builder/build-image.sh \
+            "$IMAGE_NAME" \
+            "$LATEST_IMAGE_NAME"
+          digest=$(jq -r '."containerimage.digest"' "$METADATA_FILE")
+          if [ -z "$digest" ] || [ "$digest" = null ]; then
+            echo "the build did not report an image digest" >&2
+            exit 1
+          fi
+          echo "digest=$digest" >> "$GITHUB_OUTPUT"
 
       - name: Generate artifact attestation
         uses: actions/attest-build-provenance@v1
@@ -73,6 +96,8 @@ jobs:
       - name: GitHub Release
         uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ env.RELEASE_TAG }}
+          target_commitish: ${{ env.GIT_REV }}
           name: "Verifier Release v${{ env.VERSION }}"
           body: |
             ## Docker Image Information