Built Docker image is always using vcs.sha label with an unspecified value

[fredmaggiowski]

Describe the bug

If I inspect the built docker image it features the vcs.sha always set to

➜  ~ docker inspect ghcr.io/rond-authz/rond | grep "vcs.sha" -B 3
        "org.opencontainers.image.url": "https://github.com/rond-authz/rond",
        "org.opencontainers.image.vendor": "rond authz",
        "org.opencontainers.image.version": "1.12.4",
        "vcs.sha": "<not-specified>"

This happens because the Dockerfile expects the value to be set from the COMMIT_SHA environment variable but the build job is never setting it.

Expected behavior

The label to properly set

Replication info

• Rönd version: any
• run: docker inspect ghcr.io/rond-authz/rond | grep "vcs.sha"