From b78666282042f85183a5ee44149d12ef03cee1de Mon Sep 17 00:00:00 2001
From: David Gamez Diaz <1192523+davidgamez@users.noreply.github.com>
Date: Thu, 20 Aug 2026 13:46:27 -0400
Subject: [PATCH] fix docker labels

---
 .github/workflows/docker.yml | 20 +++++++++++++++++++-
 Dockerfile                   |  8 ++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 67c14d1..8ae8f42 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -62,9 +62,14 @@ jobs:
           VALIDATOR_VERSION=$(mvn -q -N $PROFILE_ARG help:evaluate -Dexpression=gtfs-validator.version -DforceStdout)
           IMAGE=$(echo "${REGISTRY}/${IMAGE_NAME}" | tr '[:upper:]' '[:lower:]')
           # Fork-aware OCI source URL (lower-cased) so the package links to the
-          # repo it was built from, not a hardcoded upstream.
+          # repo it was built from, not a hardcoded upstream. Two forms:
+          #   image_source - clone URL, for the Dockerfile LABEL (single-arch builds)
+          #   image_url    - bare repo URL, for the index annotation. GHCR matches
+          #                  the plain https://github.com/OWNER/REPO form when it
+          #                  links a package to its repository.
           REPO_LC=$(echo "${GITHUB_REPOSITORY}" | tr '[:upper:]' '[:lower:]')
           echo "image_source=https://github.com/${REPO_LC}.git" >> "$GITHUB_OUTPUT"
+          echo "image_url=https://github.com/${REPO_LC}" >> "$GITHUB_OUTPUT"
           # Self-documenting tag: <apiVersion>-validator<validatorCoreVersion>.
           # The `validator` infix scopes the trailing version to the validator
           # core, not the API (the two versions evolve independently).
@@ -103,6 +108,19 @@ jobs:
           build-args: |
             MAVEN_PROFILES=${{ matrix.maven_profiles }}
             IMAGE_SOURCE=${{ steps.tags.outputs.image_source }}
+          # A Dockerfile LABEL only reaches the per-platform image configs, never
+          # the OCI image index that a multi-platform push produces - and the index
+          # is what GHCR reads to link a package to its source repository. Without
+          # these `index:` annotations the package stays unlinked and the repo's
+          # Packages section never appears. The LABEL is kept as well: it is what
+          # single-arch and local builds carry.
+          annotations: |
+            index:org.opencontainers.image.source=${{ steps.tags.outputs.image_url }}
+            index:org.opencontainers.image.url=${{ steps.tags.outputs.image_url }}
+            index:org.opencontainers.image.title=gtfs-validator-api
+            index:org.opencontainers.image.description=REST API wrapping the MobilityData GTFS validator.
+            index:org.opencontainers.image.licenses=Apache-2.0
+            index:org.opencontainers.image.revision=${{ github.sha }}
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.tags.outputs.tags }}
diff --git a/Dockerfile b/Dockerfile
index 3eefa65..f477f0c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,6 +29,14 @@ FROM eclipse-temurin:17-jre
 ARG IMAGE_SOURCE="https://github.com/mobilitydata/gtfs-validator-api.git"
 LABEL org.opencontainers.image.source="${IMAGE_SOURCE}"
 
+# Override the metadata inherited from the base image, which otherwise leaves the
+# published image advertising itself as Ubuntu. CI repeats these as index
+# annotations (see docker.yml) because a LABEL does not reach the OCI index of a
+# multi-platform build.
+LABEL org.opencontainers.image.title="gtfs-validator-api"
+LABEL org.opencontainers.image.description="REST API wrapping the MobilityData GTFS validator."
+LABEL org.opencontainers.image.licenses="Apache-2.0"
+
 RUN groupadd -r spring && useradd -r -g spring spring
 
 WORKDIR /app