How to Add OCI Labels to an Image in CI

Standard OCI labels record where an image came from, which commit built it, and when.

Let docker/metadata-action generate org.opencontainers.image.* labels, then pass its labels output to docker/build-push-action. You can also hardcode labels in the Dockerfile.

Steps

• Add docker/metadata-action to produce OCI labels.
• Forward steps.meta.outputs.labels to the build step.
• Optionally add static LABEL lines in the Dockerfile.

Workflow

steps:
  - id: meta
    uses: docker/metadata-action@v5
    with:
      images: ghcr.io/${{ github.repository }}
  - uses: docker/build-push-action@v6
    with:
      context: .
      push: true
      tags: ${{ steps.meta.outputs.tags }}
      labels: ${{ steps.meta.outputs.labels }}

Dockerfile labels

LABEL org.opencontainers.image.source="https://github.com/acme/app"
LABEL org.opencontainers.image.licenses="Apache-2.0"

Related guides