fix(release): add OCI labels so GHCR image binds to repo Packages

Root cause of the persistent 403 from `helm install`:

1. The image was being pushed to ghcr.io without
   `org.opencontainers.image.source` labels.
2. Without that label GHCR creates the package as orphaned — the buildx
   `--push` step reports success, but the package never appears in the
   repository's Packages sidebar and inherits no visibility from the repo
   (so it stays effectively private and anonymous pulls 403).
3. The Helm chart push (`helm push oci://...`) automatically writes the
   source label, which is why `charts/chainplane` showed up in the UI but
   the operator container did not.

Fix:
- Dockerfile: explicit OCI labels on the final stage (source, url, title,
  description, licenses, documentation).
- release.yml: same labels added via docker/build-push-action `labels:`,
  plus dynamic `version` / `revision` derived from `github.ref_name` /
  `github.sha`. Disabled `provenance` and `sbom` attestations as they
  produce extra manifests that confuse the Packages UI auto-binding.

Bumped to v0.2.2 since the previous tag's image is unrecoverable (already
pushed without labels — has to be republished as a new tag).

Context: spent ~30min reproducing — confirmed via /v2 API that the image
exists (401 unauthorized, not 404), but the GitHub UI didn't index it
because of missing repo association via the `image.source` label.

Signed-off-by: tazhate <hate@tazhate.ru>

Author: tazhate

.github/workflows/release.yml

@@ -46,9 +46,20 @@ jobs:
           context: .
           platforms: linux/amd64,linux/arm64
           push: true
+          provenance: false
+          sbom: false
           tags: |
             ghcr.io/tazhate/chainplane:${{ github.ref_name }}
             ghcr.io/tazhate/chainplane:latest
+          labels: |
+            org.opencontainers.image.source=https://github.com/tazhate/chainplane
+            org.opencontainers.image.url=https://github.com/tazhate/chainplane
+            org.opencontainers.image.documentation=https://github.com/tazhate/chainplane
+            org.opencontainers.image.title=chainplane
+            org.opencontainers.image.description=Kubernetes operator for blockchain full nodes
+            org.opencontainers.image.licenses=Apache-2.0
+            org.opencontainers.image.version=${{ github.ref_name }}
+            org.opencontainers.image.revision=${{ github.sha }}
 
       - name: Package and push Helm chart to GHCR
         run: |

CHANGELOG.md

@@ -10,6 +10,20 @@ release until the API is promoted to `v1beta1`.
 
 ## [Unreleased]
 
+## [0.2.2] - 2026-04-29
+
+### Fixed
+
+- Operator container image now carries `org.opencontainers.image.source`
+  and other OCI labels, so the GHCR package gets correctly associated with
+  the GitHub repository and becomes visible in the repo Packages sidebar.
+  Without this label, GHCR creates the package as orphaned/private — even
+  though `docker buildx --push` reports success — and `helm install` fails
+  with `403 Forbidden` from the anonymous pull token endpoint.
+- `release.yml`: disabled `provenance` and `sbom` attestations (they create
+  extra manifests unrelated to package association). Added explicit OCI
+  labels via `docker/build-push-action` `labels:` input as belt-and-braces.
+
 ## [0.2.1] - 2026-04-29
 
 ### Fixed
@@ -45,7 +59,7 @@ release until the API is promoted to `v1beta1`.
 Migration: edit existing manifests to use the new `apiVersion`, `kind` and the
 new file/folder paths; the spec and status field shapes are unchanged.
 
-
+## [0.1.0] - 2026-04-28
 
 Initial OSS release.
 

Dockerfile

@@ -26,6 +26,14 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -ldfl
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
 FROM gcr.io/distroless/static:nonroot
+
+LABEL org.opencontainers.image.source="https://github.com/tazhate/chainplane"
+LABEL org.opencontainers.image.url="https://github.com/tazhate/chainplane"
+LABEL org.opencontainers.image.documentation="https://github.com/tazhate/chainplane"
+LABEL org.opencontainers.image.title="chainplane"
+LABEL org.opencontainers.image.description="Kubernetes operator for blockchain full nodes"
+LABEL org.opencontainers.image.licenses="Apache-2.0"
+
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 65532:65532

README.md

@@ -65,7 +65,7 @@ spec:
 
 ```sh
 helm install chainplane oci://ghcr.io/tazhate/charts/chainplane \
-  --version 0.2.1 \
+  --version 0.2.2 \
   --namespace chainplane-system \
   --create-namespace
 ```
@@ -74,10 +74,10 @@ Or from a specific tag:
 
 ```sh
 helm install chainplane oci://ghcr.io/tazhate/charts/chainplane \
-  --version 0.2.1 \
+  --version 0.2.2 \
   --namespace chainplane-system \
   --create-namespace \
-  --set image.tag=v0.2.1
+  --set image.tag=v0.2.2
 ```
 
 ### Install from source

charts/chainplane/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: chainplane
 description: A Kubernetes operator for managing blockchain node lifecycle
 type: application
-version: 0.2.1
-appVersion: "v0.2.1"
+version: 0.2.2
+appVersion: "v0.2.2"
 kubeVersion: ">=1.26.0-0"
 home: https://github.com/tazhate/chainplane
 sources: