v5.0.0

.github/workflows/close-stale-invalid-titles.yml

@@ -11,6 +11,7 @@ jobs:
   close-stale:
     if: github.repository == 'liketrek/TREK'
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - name: Close stale invalid-title issues
         uses: actions/github-script@v7

.github/workflows/close-stale-wrong-branch.yml

@@ -12,6 +12,7 @@ jobs:
   close-stale:
     if: github.repository == 'liketrek/TREK'
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - name: Close stale wrong-base-branch PRs
         uses: actions/github-script@v7

.github/workflows/close-untitled-issues.yml

@@ -11,6 +11,7 @@ jobs:
   check-title:
     if: github.repository == 'liketrek/TREK'
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - name: Flag or redirect issue
         uses: actions/github-script@v7

.github/workflows/docker-dev.yml

@@ -20,6 +20,7 @@ jobs:
   version-bump:
     if: github.repository == 'liketrek/TREK'
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     outputs:
       version: ${{ steps.bump.outputs.VERSION }}
       sha: ${{ steps.bump.outputs.SHA }}
@@ -68,6 +69,7 @@ jobs:
 
   build:
     runs-on: ${{ matrix.runner }}
+    timeout-minutes: 120
     needs: version-bump
     strategy:
       fail-fast: false
@@ -92,6 +94,12 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Image metadata
+        id: meta
+        run: |
+          echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+
       - name: Build and push by digest
         id: build
         uses: docker/build-push-action@v6
@@ -102,6 +110,9 @@ jobs:
           no-cache: true
           build-args: |
             APP_VERSION=${{ needs.version-bump.outputs.version }}
+          labels: |
+            org.opencontainers.image.revision=${{ steps.meta.outputs.revision }}
+            org.opencontainers.image.created=${{ steps.meta.outputs.created }}
 
       - name: Export digest
         run: |
@@ -119,6 +130,7 @@ jobs:
 
   merge:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     needs: [version-bump, build]
     steps:
       - uses: actions/checkout@v4
@@ -163,7 +175,12 @@ jobs:
               digests+=("mauriceboe/trek@sha256:$(basename "$f")")
             done
           done
+          # The labels live on each platform image; the index gets the ones a
+          # client reads before it picks a platform (#1498).
           docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.source=https://github.com/liketrek/TREK" \
+            --annotation "index:org.opencontainers.image.version=$VERSION" \
+            --annotation "index:org.opencontainers.image.licenses=AGPL-3.0-only" \
             -t "mauriceboe/trek:latest-pre" \
             -t "mauriceboe/trek:$MAJOR_TAG" \
             -t "mauriceboe/trek:$VERSION" \

.github/workflows/docker.yml

@@ -24,6 +24,7 @@ jobs:
   version-bump:
     if: github.repository == 'liketrek/TREK'
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     outputs:
       version: ${{ steps.bump.outputs.VERSION }}
     steps:
@@ -114,6 +115,7 @@ jobs:
 
   build:
     runs-on: ${{ matrix.runner }}
+    timeout-minutes: 120
     needs: version-bump
     strategy:
       fail-fast: false
@@ -138,6 +140,12 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Image metadata
+        id: meta
+        run: |
+          echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+
       - name: Build and push by digest
         id: build
         uses: docker/build-push-action@v6
@@ -148,6 +156,9 @@ jobs:
           no-cache: true
           build-args: |
             APP_VERSION=${{ needs.version-bump.outputs.version }}
+          labels: |
+            org.opencontainers.image.revision=${{ steps.meta.outputs.revision }}
+            org.opencontainers.image.created=${{ steps.meta.outputs.created }}
 
       - name: Export digest
         run: |
@@ -165,6 +176,7 @@ jobs:
 
   merge:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     needs: [version-bump, build]
     steps:
       - uses: actions/checkout@v4
@@ -207,7 +219,12 @@ jobs:
               digests+=("mauriceboe/trek@sha256:$(basename "$f")")
             done
           done
+          # The labels live on each platform image; the index gets the ones a
+          # client reads before it picks a platform (#1498).
           docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.source=https://github.com/liketrek/TREK" \
+            --annotation "index:org.opencontainers.image.version=$VERSION" \
+            --annotation "index:org.opencontainers.image.licenses=AGPL-3.0-only" \
             -t "mauriceboe/trek:latest" \
             -t "mauriceboe/trek:$MAJOR_TAG" \
             -t "mauriceboe/trek:$VERSION" \
@@ -218,6 +235,7 @@ jobs:
 
   release-helm:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     needs: version-bump
     steps:
       - name: Checkout

.github/workflows/enforce-target-branch.yml

@@ -8,6 +8,7 @@ jobs:
   check-target:
     if: github.repository == 'liketrek/TREK'
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     permissions:
       pull-requests: write
       issues: write

.github/workflows/lint-prettier.yml

@@ -10,6 +10,7 @@ concurrency:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     permissions:
       pull-requests: write
     steps:

.github/workflows/publish-plugin-sdk.yml

@@ -16,6 +16,7 @@ jobs:
   publish:
     if: github.repository == 'liketrek/TREK'
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     defaults:
       run:
         working-directory: plugin-sdk

.github/workflows/security.yml

@@ -19,6 +19,7 @@ jobs:
     # Scout login can never succeed there.
     if: github.repository == 'liketrek/TREK' && github.event.pull_request.head.repo.fork != true
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@v4