add some OCI labels

.tangled/workflows/release.yml

···
       buildah bud \
         --arch amd64 \
         --build-arg TARGETARCH=amd64 \
+        --build-arg VERSION=${TANGLED_REF_NAME} \
+        --build-arg CREATED=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
+        --build-arg REVISION=${TANGLED_COMMIT_SHA} \
+        --build-arg TANGLED_REPO_DID=${TANGLED_REPO_DID} \
+        --build-arg TANGLED_REPO_NAME=${TANGLED_REPO_NAME} \
         --tag ${IMAGE_NAME}:${TANGLED_REF_NAME}-amd64 \
         --file ./Dockerfile \
         .
···
       buildah bud \
         --arch arm64 \
         --build-arg TARGETARCH=arm64 \
+        --build-arg VERSION=${TANGLED_REF_NAME} \
+        --build-arg CREATED=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
+        --build-arg REVISION=${TANGLED_COMMIT_SHA} \
+        --build-arg TANGLED_REPO_DID=${TANGLED_REPO_DID} \
+        --build-arg TANGLED_REPO_NAME=${TANGLED_REPO_NAME} \
         --tag ${IMAGE_NAME}:${TANGLED_REF_NAME}-arm64 \
         --file ./Dockerfile \
         .

Dockerfile

···
 
 FROM alpine:3.20
 
-# Only need ca-certificates for HTTPS cloning
+ARG VERSION=dev
+ARG CREATED
+ARG REVISION
+ARG TANGLED_REPO_DID
+ARG TANGLED_REPO_NAME
+
+LABEL org.opencontainers.image.title="git-summarizer" \
+      org.opencontainers.image.description="AI-powered git change summarizer using agentic tool-calling with self-hosted LLMs" \
+      org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.created="${CREATED}" \
+      org.opencontainers.image.revision="${REVISION}" \
+      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.source="https://tangled.sh/${TANGLED_REPO_DID}/${TANGLED_REPO_NAME}"
+
 RUN apk add --no-cache ca-certificates
 
 COPY --from=builder /app/git-summarizer /usr/local/bin/
 
-# For SSH cloning (optional - mount your keys)
 RUN mkdir -p /root/.ssh && chmod 700 /root/.ssh
 
 EXPOSE 8000