Add created-time OCI annotations to GitLab manifest publishing

[Copilot]

The GitLab manifest jobs were publishing tags without a creation-time annotation. This updates both manifest paths so images created from .gitlab-ci.yml carry a consistent org.opencontainers.image.created timestamp.

• Manifest annotation coverage

  • Add --annotation "index:org.opencontainers.image.created=..." to every docker buildx imagetools create invocation in:
    • base-manifest
    • eic-manifest
  • Covers internal, export, Docker Hub, GitHub Container Registry, and nightly tags.

• Timestamp source

  • Use CI_PIPELINE_CREATED_AT as the primary timestamp so tags produced by the pipeline share the same creation time.
  • Fall back to current UTC time only if the pipeline timestamp is unavailable.

• Compatibility guard

  • Fail early with a clear error if the available docker buildx imagetools create does not support --annotation, instead of silently publishing unannotated manifests.

Example of the change pattern:

CREATED_AT="${CI_PIPELINE_CREATED_AT:-$(date -u +%Y-%m-%dT%H:%M:%SZ)}"
CREATED_ANNOTATION="index:org.opencontainers.image.created=${CREATED_AT}"

docker buildx imagetools create \
  --annotation "${CREATED_ANNOTATION}" \
  --tag "${IMAGE_REPO}:${EXPORT_TAG}" \
  "${IMAGE_REPO}@${DIGEST}"

[Copilot]

🟡 Changes recommended

The new --annotation compatibility guard can mask real docker buildx failures as “flag unsupported”, which undermines the stated goal of failing early with a clear error.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR updates the GitLab CI manifest-publishing jobs to ensure manifests produced via .gitlab-ci.yml include a consistent OCI org.opencontainers.image.created timestamp, improving metadata completeness across published tags.

Changes:

• Add a CI_PIPELINE_CREATED_AT-based org.opencontainers.image.created annotation (with UTC fallback) to docker buildx imagetools create calls in both manifest jobs.
• Add an early guard that checks whether docker buildx imagetools create supports --annotation and fails the job otherwise.

File summaries

File	Description
.gitlab-ci.yml	Adds created-time OCI annotations to manifest tag publishing in base-manifest and eic-manifest, with a buildx compatibility guard.

Review details

Suppressed comments (1)

.gitlab-ci.yml:487

• Same issue as base-manifest: the --help | grep pipeline can turn a real docker buildx failure into a misleading “does not support --annotation” error. Check that the help command succeeded first, then test for the flag (and write errors to stderr).

      docker buildx imagetools create --help | grep -q -- '--annotation' || { echo "ERROR: docker buildx imagetools create does not support --annotation"; exit 1; }

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Capybara summary for PR 428

• rec_dis_10x100_minQ2=1000_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_dis_10x100_minQ2=1_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_dis_18x275_minQ2=1000_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_dis_18x275_minQ2=1_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_dis_5x41_minQ2=1_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_dis_5x41_minQ2=1_epic_craterlake_amd64_vs_arm64 (Δ: 4156)
• rec_dis_5x41_minQ2=1_epic_craterlake_arm64 (Δ: 1) (new artifact) (ref artifact)
• rec_e_1GeV_20GeV_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_e_1GeV_20GeV_epic_craterlake_amd64_vs_arm64 (Δ: 3713)
• rec_e_1GeV_20GeV_epic_craterlake_arm64 (Δ: 1) (new artifact) (ref artifact)
• rec_pi_1GeV_20GeV_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_pi_1GeV_20GeV_epic_craterlake_amd64_vs_arm64 (Δ: 3420)
• rec_pi_1GeV_20GeV_epic_craterlake_arm64 (Δ: 1) (new artifact) (ref artifact)
• sim_dis_10x100_minQ2=1000_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_dis_10x100_minQ2=1_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_dis_18x275_minQ2=1000_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_dis_18x275_minQ2=1_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_dis_5x41_minQ2=1_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_dis_5x41_minQ2=1_epic_craterlake_amd64_vs_arm64 (Δ: 395)
• sim_dis_5x41_minQ2=1_epic_craterlake_arm64 (Δ: 1) (new artifact) (ref artifact)
• sim_e_1GeV_20GeV_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_e_1GeV_20GeV_epic_craterlake_amd64_vs_arm64 (Δ: 395)
• sim_e_1GeV_20GeV_epic_craterlake_arm64 (Δ: 1) (new artifact) (ref artifact)
• sim_pi_1GeV_20GeV_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_pi_1GeV_20GeV_epic_craterlake_amd64_vs_arm64 (Δ: 328)
• sim_pi_1GeV_20GeV_epic_craterlake_arm64 (Δ: 1) (new artifact) (ref artifact)
  ^{_{Last updated 2026-09-17T00:58-04:00 f961967}}