Use docker Github actions to tag containers

[dpw13]

Fixes prometheus/prometheus#16238
Rewrite of #41

This PR changes promci to use docker/metadata-action to generate tags for the generated docker containers. We also get nice labels pulled from the Github project metadata for free. The PR also replaces calls to make docker, make docker-publish and make docker-manifest with docker/build-push-action which will build the specified Dockerfile for all specified platforms and push them with the specified tags.

Please note that I'm certainly not a Github actions expert and this is just my first attempt at implementing what I understand to be best practices for building and pushing docker images using GH actions. Please review carefully!

Of particular note: using docker/build-push-action may not be strictly necessary. It is likely possible to modify the Makefile in the prometheus project to accept the set of tags produced by docker/metadata-action. It seemed that using build-push-action was a better solution though as it requires less synchronization between the two repos and that restructuring the Makefile to consume a set of tags instead of just one was going to be more trouble than it's worth, as the Makefile target is only one or two docker commands. Keeping the changes only in the promci repo seemed easier and simpler.

If this change is accepted, the prometheus repo will need a follow-up PR to update the SHA of the promci action and will also need to specify the github_token input when calling publish_main in addition to publish_release.

I had quite a bit of difficulty testing this change locally. I was able to locally verify the tags and labels generated by metadata-action when called with a push action to refs/tags/v3.5.0 using act:

[CI/Publish release artefacts]   ⚙  ::set-output:: tags=docker.io/prom/prometheus:3.5.0
docker.io/prom/prometheus:3.5
docker.io/prom/prometheus:3
docker.io/prom/prometheus:latest
[CI/Publish release artefacts]   ⚙  ::set-output:: labels=org.opencontainers.image.created=2025-09-10T04:45:19.579Z
org.opencontainers.image.description=The Prometheus monitoring system and time series database.
org.opencontainers.image.licenses=Apache-2.0
org.opencontainers.image.revision=8be3a9560fbdd18a94dedec4b747c35178177202
org.opencontainers.image.source=https://github.com/prometheus/prometheus
org.opencontainers.image.title=prometheus
org.opencontainers.image.url=https://github.com/prometheus/prometheus
org.opencontainers.image.version=3.5.0

I was not able to successfully test actually building and pushing the docker image though, as I wasn't able to get the full CI build and test system running without error locally. I would love some advice on how to properly test these changes using the full CI pipeline, if possible.

[dpw13]

Fixed the repository setting, the default image name (now tracks the repository name), and only sets the latest tag if pushing a v3 release. I haven't verified whether pushing e.g. prometheus 3.4.99 still tags the image with latest or not, but at least this change does tag {major} and {major}.{minor}.

[SuperQ]

This looks good in general.

[SuperQ]

These CI actions are used all over the Prometheus ecosystem. We have v0, v1, etc releases stil.

Maybe we should parameterize this, with something like: refs/tags/${{ inputs.latest_tag_prefix }},

Then set the default to just v, and then when we update Prometheus, we can specify v3.

Also, how does this avoid prerelease?

[SuperQ]

This may still be a useful change, but we've fixed the immediate issue in #65