add labels to the docker image + pin the docker pipeline install version

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.github/workflows/release.yaml

@@ -83,7 +83,7 @@ jobs:
     needs: [wait-for-checks]
     runs-on: macos-latest # Due to our code signing process, it's vital that we run our release steps on macOS.
     steps:
-      - uses: docker-practice/actions-setup-docker@master
+      - uses: docker-practice/actions-setup-docker@v1
 
       - uses: actions/setup-go@v2
         with:

.goreleaser.yaml

@@ -101,3 +101,9 @@ dockers:
       - "anchore/syft:{{ .Tag }}"
       - "anchore/syft:v{{ .Major }}"
       - "anchore/syft:v{{ .Major }}.{{ .Minor }}"
+
+    build_flag_templates:
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"

Dockerfile

@@ -11,4 +11,18 @@ WORKDIR /tmp
 
 COPY syft /
 
+ARG BUILD_DATE
+ARG BUILD_VERSION
+ARG VCS_REF
+ARG VCS_URL
+
+LABEL org.label-schema.schema-version="1.0"
+LABEL org.label-schema.build-date=$BUILD_DATE
+LABEL org.label-schema.name="syft"
+LABEL org.label-schema.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems"
+LABEL org.label-schema.vcs-url=$VCS_URL
+LABEL org.label-schema.vcs-ref=$VCS_REF
+LABEL org.label-schema.vendor="Anchore, Inc."
+LABEL org.label-schema.version=$BUILD_VERSION
+
 ENTRYPOINT ["/syft"]