fix(ci): emit GHCR package description as index annotation

[strausmann]

The problem

GHCR shows "No description provided" on the package pages for both label-printer-hub-backend and label-printer-hub-frontend, even though docker/metadata-action is configured with labels: org.opencontainers.image.description=….

Why

The description labels are baked into each per-platform image manifest, but GHCR's package UI reads the description from a separate place: the org.opencontainers.image.description annotation on the multi-arch manifest index (the OCI image-index that points at the per-arch manifests).

docker/metadata-action decides which manifest levels to annotate via the DOCKER_METADATA_ANNOTATIONS_LEVELS env var. Its default is manifest only, so the index never gets annotated — hence the empty GHCR page.

Quote from a previous run's logs (run 25638802588):

DOCKER_METADATA_OUTPUT_ANNOTATIONS:
  manifest:org.opencontainers.image.description=...
  manifest:org.opencontainers.image.title=...

→ Only manifest:, no index:.

The fix

Two small changes to .github/workflows/docker-publish.yml:

1. At the workflow root: DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index — tells metadata-action to emit annotations for both levels.
2. In the build step: annotations: \${{ steps.meta.outputs.annotations }} — forwards the resulting list to build-push-action, which translates it into --annotation manifest:* --annotation index:* calls on the underlying buildx invocation.

Verification (after merge)

gh workflow run docker-publish.yml -f tag=0.2.0 --ref main
# Wait for run to finish, then:
TOKEN=\$(curl -fsSL 'https://ghcr.io/token?scope=repository:strausmann/label-printer-hub-backend:pull&service=ghcr.io' | jq -r .token)
curl -fsSL -H \"Authorization: Bearer \$TOKEN\" \
  -H 'Accept: application/vnd.oci.image.index.v1+json' \
  https://ghcr.io/v2/strausmann/label-printer-hub-backend/manifests/0.2.0 \
  | jq '.annotations'

Should show org.opencontainers.image.description populated on the index.

GHCR package page will then display the description automatically — no further config needed.

Test plan

• CI green.
• Merge.
• Re-run docker-publish for tag=0.2.0.
• GHCR pages for both packages show the description.

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[Copilot]

Pull request overview

Updates the Docker publish workflow so GHCR package pages display the intended OCI description by ensuring the org.opencontainers.image.description annotation is applied to the multi-arch image index (not just per-platform manifests).

Changes:

• Configure docker/metadata-action to emit annotations for both manifest and index levels via DOCKER_METADATA_ANNOTATIONS_LEVELS.
• Forward steps.meta.outputs.annotations into docker/build-push-action so buildx actually applies those index annotations during push.