build: bind candidate identity to images

deploy/backend.Dockerfile

@@ -33,6 +33,12 @@ RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w \
     CGO_ENABLED=0 go build -trimpath -o /out/mock-alert-receiver ./cmd/mock-alert-receiver
 
 FROM gcr.io/distroless/static-debian12:nonroot
+ARG VERSION=dev
+ARG COMMIT=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.revision="${COMMIT}" \
+      org.opencontainers.image.created="${BUILD_TIME}"
 WORKDIR /app
 COPY --from=build /out/ /app/
 EXPOSE 8080 8081 8082 8083 8084

deploy/web.Dockerfile

@@ -7,6 +7,12 @@ COPY web ./
 RUN npm run generate:api && npm run build
 
 FROM nginxinc/nginx-unprivileged:1.30.4-alpine
+ARG VERSION=dev
+ARG COMMIT=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.revision="${COMMIT}" \
+      org.opencontainers.image.created="${BUILD_TIME}"
 USER root
 RUN apk upgrade --no-cache
 COPY --chown=101:101 deploy/web.nginx.conf /etc/nginx/conf.d/default.conf