Introduce tagging per major, minor, patch version. Add OCI labels.

Author: TrafeX

.github/workflows/build.yaml

@@ -67,18 +67,39 @@ jobs:
             --push \
             -t $IMAGE_NAME:latest \
             --platform linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6 \
+            --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') \
+            --build-arg VCS_REF=${{ github.sha }} \
+            --build-arg VERSION=latest \
             .
 
       - name: Set tag in environment
         if: contains(github.ref, 'refs/tags/')
         run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
 
-      - name: Build multi-arch image and push release tag
+      - name: Parse version components
+        if: contains(github.ref, 'refs/tags/')
+        id: parse_version
+        run: |
+          VERSION=${GITHUB_REF#refs/tags/}
+          echo "FULL_VERSION=$VERSION" >> $GITHUB_ENV
+          # Extract major version (e.g., 3 from 3.9.1)
+          MAJOR=$(echo $VERSION | cut -d. -f1)
+          echo "MAJOR_VERSION=$MAJOR" >> $GITHUB_ENV
+          # Extract minor version (e.g., 3.9 from 3.9.1)
+          MINOR=$(echo $VERSION | cut -d. -f1,2)
+          echo "MINOR_VERSION=$MINOR" >> $GITHUB_ENV
+
+      - name: Build multi-arch image and push release tags
         if: contains(github.ref, 'refs/tags/')
         run: |-
           docker buildx build \
             --cache-from=$IMAGE_NAME:latest \
             --push \
-            -t $IMAGE_NAME:$RELEASE_VERSION \
+            -t $IMAGE_NAME:$FULL_VERSION \
+            -t $IMAGE_NAME:$MINOR_VERSION \
+            -t $IMAGE_NAME:$MAJOR_VERSION \
             --platform linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6 \
+            --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') \
+            --build-arg VCS_REF=${{ github.sha }} \
+            --build-arg VERSION=$FULL_VERSION \
             .

Dockerfile

@@ -1,7 +1,23 @@
 ARG ALPINE_VERSION=3.23
 FROM alpine:${ALPINE_VERSION}
-LABEL Maintainer="Tim de Pater <[email protected]>"
-LABEL Description="Lightweight container with Nginx 1.28 & PHP 8.4 based on Alpine Linux."
+
+# Build metadata arguments
+ARG BUILD_DATE
+ARG VCS_REF
+ARG VERSION
+
+# OCI annotations for supply chain security
+LABEL org.opencontainers.image.created="${BUILD_DATE}"
+LABEL org.opencontainers.image.authors="Tim de Pater <[email protected]>"
+LABEL org.opencontainers.image.url="https://github.com/TrafeX/docker-php-nginx"
+LABEL org.opencontainers.image.documentation="https://github.com/TrafeX/docker-php-nginx"
+LABEL org.opencontainers.image.source="https://github.com/TrafeX/docker-php-nginx"
+LABEL org.opencontainers.image.version="${VERSION}"
+LABEL org.opencontainers.image.revision="${VCS_REF}"
+LABEL org.opencontainers.image.vendor="TrafeX"
+LABEL org.opencontainers.image.title="PHP-FPM 8.4 & Nginx on Alpine Linux"
+LABEL org.opencontainers.image.description="Lightweight container with Nginx 1.28 & PHP 8.4 based on Alpine Linux."
+
 # Setup document root
 WORKDIR /var/www/html
 

README.md

@@ -40,8 +40,13 @@ Or mount your own code to be served by PHP-FPM & Nginx
     docker run -p 80:8080 -v ~/my-codebase:/var/www/html trafex/php-nginx
 
 ## Versioning
-Major or minor changes are always published as a [release](https://github.com/TrafeX/docker-php-nginx/releases) with correspondending changelogs.
-The `latest` tag is automatically updated weekly to include the latests patches from Alpine Linux.
+
+This image follows semantic versioning;
+
+- `latest` - Automatically updated weekly with the latest patches from Alpine Linux
+- `3` - Latest major version 3.x (follows minor and patch updates)
+- `3.9` - Latest version 3.9.x (follows patch updates only)
+- `3.9.1` - Specific patch version (immutable)
 
 ## Configuration
 In [config/](config/) you'll find the default configuration files for Nginx, PHP and PHP-FPM.