build(ci): verify labels of Docker image

Updates the release process to generate the correct labels for the
Docker image, and verify them, failing the release process (and not
pushing the image) if they are wrong.

Ideally, this would be done before the Maven release to avoid wasting
time if the image would produce the wrong labels. Doing this is quite a
bit of refactoring of the CI pipeline unfortunately, and producing the
wrong labels is most likely an issue with the CI pipeline itself, which
should not happen very often. Errors in the Dockerfile itself would be
checked by the GHA pipeline, which should cover the important cases and
runs on each pull.

.ci/pipelines/docker_zeebe.groovy

@@ -66,6 +66,9 @@ spec:
         PUSH = "${params.PUSH}"
         IMAGE = "camunda/zeebe"
         TAG = docker_tag("${params.VERSION}")
+        REVISION = "${params.REVISION}"
+        DATE = "${param.DATE}"
+        VERIFY = "${param.VERIFY}"
     }
 
     stages {
@@ -90,6 +93,15 @@ spec:
             }
         }
 
+        stage('Verify') {
+            when { environment name: 'VERIFY', value: 'true' }
+            steps {
+                container('docker') {
+                    sh "docker/test/verify.sh '${env.IMAGE}:${env.TAG}'"
+                }
+            }
+        }
+
         stage('Upload') {
             when { environment name: 'PUSH', value: 'true' }
             steps {

.ci/pipelines/release_zeebe.groovy

@@ -92,6 +92,9 @@ spec:
                 container('golang') {
                     sh '.ci/scripts/release/prepare-go.sh'
                 }
+                container('docker') {
+                    sh '.ci/scripts/release/prepare-docker.sh'
+                }
             }
         }
 
@@ -151,8 +154,11 @@ spec:
                 build job: 'zeebe-docker', parameters: [
                         string(name: 'BRANCH', value: env.RELEASE_BRANCH),
                         string(name: 'VERSION', value: params.RELEASE_VERSION),
+                        string(name: 'REVISION', value: env.GIT_COMMIT),
+                        string(name: 'DATE', value: java.time.Instant.now().toString()),
                         booleanParam(name: 'IS_LATEST', value: params.IS_LATEST),
-                        booleanParam(name: 'PUSH', value: true)
+                        booleanParam(name: 'PUSH', value: true),
+                        booleanParam(name: 'VERIFY', value: true)
                 ]
             }
         }

.ci/scripts/docker/build.sh

@@ -1,4 +1,9 @@
 #!/bin/sh -eux
 
 echo "Building Zeebe Docker image ${IMAGE}:${TAG}"
-docker build --no-cache --build-arg DISTBALL=camunda-zeebe.tar.gz -t ${IMAGE}:${TAG} --target app .
+docker build --no-cache \
+  --build-arg DISTBALL=camunda-zeebe.tar.gz \
+  --build-arg DATE="${DATE}" \
+  --build-arg REVISION="${REVISION}" \
+  --build-arg VERSION="${VERSION}" \
+  -t "${IMAGE}:${TAG}" --target app .

Jenkinsfile

@@ -119,6 +119,9 @@ pipeline {
                 DOCKER_BUILDKIT = "1"
                 IMAGE = "camunda/zeebe"
                 TAG = 'current-test'
+                VERSION = readMavenPom(file: 'bom/pom.xml').getVersion()
+                REVISION = "${env.GIT_COMMIT}"
+                DATE = java.time.Instant.now().toString()
             }
 
             steps {