chore(Dockerfile): add metadata labels to define source

[secustor]

Description

Adds OCI metadata labels to the server and machine-learning docker images.

This allows to find the source github repository based on the OCI / Docker image, which in turn allows tools like Renovate to find changelogs for example

How Has This Been Tested?

No test run

Screenshots (if appropriate)

Checklist:

• I have performed a self-review of my own code
• I have made corresponding changes to the documentation if applicable
• I have no unrelated changes in the PR.
• I have confirmed that any new dependencies are strictly necessary.
• I have written tests for new code (if applicable)
• I have followed naming conventions/patterns in the surrounding code
• All code in src/services/ uses repositories implementations for database calls, filesystem operations, etc.
• All code in src/repositories/ is pretty basic/simple and does not have any immich specific logic (that belongs in src/services/)

[bo0tzz]

I would prefer if this was set from the docker/metadata-action output in the build workflow (eg at https://github.com/immich-app/immich/blob/main/.github/workflows/docker.yml#L419).

[secustor]

I have not been aware of that action. Changed the an approach which only modifies the action input.

[bo0tzz]

Sorry, I should have been clearer. That action already outputs appropriate labels, but the next step doesn't currently apply them.

[secustor]

Sry for the chatter, but I have a hard time read your CI setup. 😅
Ever considered setting tags directly on build-and-push or using docker bake? I think that could reduce logic here.

I had to switch to annotations as docker buildx imagetools create does not support labels because of the multi-arch focus.

[bo0tzz]

setting tags directly on build-and-push

We do, but those don't carry through into the merged manifest.

using docker bake

I briefly looked into this, but I don't think it has a way to express the merging that we do, right?

[zackpollard]

The merge jobs are failing as you can see here: https://github.com/immich-app/immich/actions/runs/14262939935/job/39978651017?pr=17378

[secustor]

setting tags directly on build-and-push

We do, but those don't carry through into the merged manifest.

using docker bake

I briefly looked into this, but I don't think it has a way to express the merging that we do, right?

As I understand you mean with merging simply publishing to different images registries, correct? So GHCR.io and Docker hub.

Take a look a this example

Immich server, machine-learning and such would the equivalent to slim and full

[bo0tzz]

you mean with merging simply publishing to different images registries, correct?

No, I mean the docker buildx imagetools create step where we take the images from the different runners and merge them into one multi-arch manifest.

[zackpollard]

After a lot of pain I fixed this in #17378. Closing this PR in favor of that one