[wass08]

What does this PR do?

Prepares the first GHCR publish of ghcr.io/pascalorg/pascal-editor after #1032.

• OCI labels on the runtime image: title, description, source (links the GHCR package to this repository, so the package page shows the README and inherits access), documentation, url, vendor, licenses: MIT. The release job also stamps version and revision.
• Hermetic build context: .dockerignore now drops *.tsbuildinfo. A stale host file copied into the context made tsc --build trust it and skip emitting core's new geometry-metadata module (Blender (bpy) modules as a second geometry-script language #1033), so docker build on main failed with "Cannot resolve extensionless ESM import ./geometry-metadata". CI never saw it because runners start clean.
• README: a "Self-host it" section with the one-line docker run and a link to SETUP.md.

How to test

1. docker build -t pascal-editor:labels . on this branch succeeds (it fails on main from a checkout that has built locally).
2. docker inspect pascal-editor:labels --format '{{json .Config.Labels}}' shows the seven org.opencontainers.image.* labels.
3. docker run -d -p 3000:3000 -e PASCAL_ADMIN_PASSWORD=x -e PASCAL_PUBLIC_URL=http://pascal.test:3000 pascal-editor:labels: /api/health 200, / with a Host: pascal.test:3000 header redirects to /login.
4. Steps 1 to 3 were run locally on arm64.

Screenshots / screen recording

N/A — non-visual change

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

🤖 Generated with Claude Code

---

Note

Low Risk
Packaging, CI metadata, and documentation only; no application runtime or security logic changes.

Overview
Prepares ghcr.io/pascalorg/pascal-editor for GHCR by adding OCI image metadata and tightening the Docker build context.

The runtime Dockerfile now sets standard org.opencontainers.image.* labels (title, description, source/repo link, docs, URL, vendor, MIT license) so the GHCR package page can show README and inherit repo access. The release workflow also stamps version and revision on each per-arch build.

.dockerignore excludes *.tsbuildinfo so a stale host incremental-build cache is not copied into the image; without that, tsc --build could skip emitting new outputs (e.g. core’s geometry-metadata) and docker build fails locally while CI stays clean.

README adds a Self-host it section with a one-line docker run, env vars (PASCAL_ADMIN_PASSWORD, PASCAL_PUBLIC_URL, /data volume), and a pointer to SETUP.md.

^{Reviewed by Cursor Bugbot for commit d0f798d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d0f798d. Configure here.}

[cursor]

Revision label uses trigger SHA

Medium Severity

The org.opencontainers.image.revision label records github.sha, the workflow_dispatch commit, while the image is built from the @pascal-app/cli@* tag checkout. Those commits diverge whenever the release job writes a version-bump commit, and a none republish can label an unrelated later main SHA.

 

^{Reviewed by Cursor Bugbot for commit d0f798d. Configure here.}