feat: add custom image labels via CLI

- New `--label KEY=VALUE` CLI flag (repeatable) for adding custom OCI image config labels
- New `-l` short alias for `--label`
- CLI labels override config labels from rebar.config or mix.exs
- Shared `parse_cli_kv_list/2` helper eliminates code duplication
- Added `ocibuild_validate.erl` module for shared validation (null bytes, path traversal)
- Updated documentation and version to 0.10.0

Closes #39

Author: rhblind

AGENTS.md

@@ -94,6 +94,7 @@ src/
     ├── ocibuild_digest.erl       # SHA256 digest utilities
     ├── ocibuild_json.erl         # JSON encode/decode (OTP 27 native + fallback)
     ├── ocibuild_time.erl         # Timestamp utilities (SOURCE_DATE_EPOCH)
+    ├── ocibuild_validate.erl     # Shared validation (null bytes, path traversal)
     └── ocibuild_progress.erl     # Progress reporting
 
 lib/

CHANGELOG.md

@@ -1,13 +1,19 @@
 # Changelog
 
-## [Unreleased]
+## 0.10.0 - 2026-01-15
 
 ### Breaking Changes
 
 - **Removed `--desc` CLI option and `description` config option**: Use `--annotation "org.opencontainers.image.description=Your description"` or the `annotations` config map instead. This consolidates description handling into the more flexible annotations system.
 
 ### Features
 
+- **Custom image labels** ([#39](https://github.com/intility/erlang-oci-builder/issues/39)):
+  - New `--label KEY=VALUE` CLI flag (repeatable) for adding custom OCI image config labels
+  - New `-l` short alias for `--label`
+  - CLI labels override config labels from rebar.config or mix.exs
+  - Shared `parse_cli_kv_list/2` helper eliminates code duplication between annotation and label parsing
+
 - **Custom manifest annotations** ([#37](https://github.com/intility/erlang-oci-builder/issues/37)):
   - New `--annotation KEY=VALUE` CLI flag (repeatable) for adding custom OCI manifest annotations
   - New `-a` short alias for `--annotation`

CLAUDE.md

@@ -95,6 +95,7 @@ src/
     ├── ocibuild_digest.erl       → SHA256 utilities
     ├── ocibuild_json.erl         → JSON encode/decode
     ├── ocibuild_time.erl         → Timestamp utilities
+    ├── ocibuild_validate.erl     → Shared validation (null bytes, path traversal)
     └── ocibuild_progress.erl     → Progress reporting
 
 lib/

README.md

@@ -40,7 +40,7 @@ It works from any BEAM language (Erlang, Elixir, Gleam, LFE) and has no dependen
 
 ```erlang
 {project_plugins, [
-    {ocibuild, "~> 0.9"}
+    {ocibuild, "~> 0.10"}
 ]}.
 ```
 
@@ -49,7 +49,7 @@ It works from any BEAM language (Erlang, Elixir, Gleam, LFE) and has no dependen
 ```elixir
 def deps do
   [
-    {:ocibuild, "~> 0.9", runtime: false}
+    {:ocibuild, "~> 0.10", runtime: false}
   ]
 end
 ```
@@ -63,7 +63,7 @@ The easiest way to use `ocibuild` with Elixir:
 ```elixir
 # mix.exs
 def deps do
-  [{:ocibuild, "~> 0.9", runtime: false}]
+  [{:ocibuild, "~> 0.10", runtime: false}]
 end
 
 def project do
@@ -116,7 +116,7 @@ The easiest way to use `ocibuild` with Erlang:
 
 ```erlang
 %% rebar.config
-{project_plugins, [{ocibuild, "~> 0.9"}]}.
+{project_plugins, [{ocibuild, "~> 0.10"}]}.
 
 {ocibuild, [
     {base_image, "debian:stable-slim"},

src/ocibuild.app.src

@@ -1,6 +1,6 @@
 {application, ocibuild, [
     {description, "Build and publish OCI container images from the BEAM"},
-    {vsn, "0.9.1"},
+    {vsn, "0.10.0"},
     {registered, []},
     {applications, [kernel, stdlib, crypto, ssl, inets]},
     {env, []},