Fix expiry time for Git SHA tagged Docker images

[eguzki]

Summary

Docker images tagged with Git SHA are not expiring as expected on Quay.io. Currently, SHA-tagged images are set to never expire, leading to storage accumulation.

Current Behavior

Looking at quay.io/kuadrant/developer-portal-controller, images with Git SHA tags (e.g., b2ab687...) do not have an expiry time set.

Expected Behavior

Images should automatically expire based on their tags:

• Images with main tag: Never expire
• Images with latest tag: Never expire
• Release tag images (e.g., v0.4.0, v1.2.3-alpha.1): Never expire
• Git SHA tagged images: Expire after 3 weeks
• Branch tagged images (non-main branches): Expire after 3 weeks ✅ (already working correctly)

Root Cause

The issue is in .github/workflows/build-image.yaml. When a push to the main branch occurs:

1. The metadata action generates multiple tags for a single build: main, latest, and the Git SHA
2. The expiry logic evaluates to expiry=never because github.ref_name == "main"
3. The Docker build uses a single QUAY_IMAGE_EXPIRY value for all tags via the LABEL quay.expires-after directive
4. Result: All tags including the Git SHA inherit quay.expires-after=never

This is a Docker/Quay limitation - you cannot set different expiry times for different tags in the same image build because the label is set at the image layer level, not per-tag.

Possible Solutions

Option 1: Separate Builds for Different Expiry Requirements

Split the image building into separate jobs with different QUAY_IMAGE_EXPIRY build args:

• Job 1: Build and tag with main and latest (expiry = never)
• Job 2: Build and tag with Git SHA (expiry = 3w)

Option 2: Use Quay API to Set Tag Expiry Post-Build

After the image is built and pushed, use the Quay API to programmatically set expiration time for the Git SHA tag only.

Additional Context

• Current Makefile setting: QUAY_IMAGE_EXPIRY ?= 3w
• Dockerfile label: LABEL quay.expires-after=$QUAY_IMAGE_EXPIRY
• Quay.io documentation on image expiration: https://docs.quay.io/guides/image-expiration.html