Initial review #4

Reviewing the contents of this repo should probably be considered part of reviewing Icinga/icinga2#11161, so here are my thoughts/feedback/suggestions. It's probably a bit odd as an issue here, but given that all code is already on the default branch, that's what I came up with.

1. Add a prominent warning to the README stating that this image is not for actual use but only an intermediate build artifact. Otherwise, if someone ends up on https://github.com/Icinga/icinga2-plugins-container or https://github.com/Icinga/icinga2-plugins-container/pkgs/container/icinga2-plugins-container, it says in the text, but I'm not sure if this is immediately clear.
2. .github/workflows/container-image.Containerfile would probably benefit from a build ARG for the image name, see also Containerfile: Use Icinga 2 Plugin Container icinga2#11161 (comment). In this case maybe even without a default value so that it must be specified, given that the current plugins name you use isn't publicly available.
3. The tag naming pattern of the published containers is the other way around compared to what's commonly used, see golang or postgres for example.
4. It would be great if the pinned commit hashes were annotated with a comment specifying the version this corresponds to:

   icinga2-plugins-container/Containerfile

   Lines 8 to 11 in 715b9aa

   	ENV CHECK_MSSQL_HEALTH_REF=937f4f0aa7af90506924cb2b772e092e6538b348
   	ENV CHECK_NWC_HEALTH_REF=22fcf6b5877e2e503316fed500581d538ae8cfea
   	ENV CHECK_POSTGRES_REF=d0bba94836b2029109c487ed0f800fecd61ab2e9
   	ENV CHECK_SSL_CERT_REF=86cbfac35ac339e52baea69a94029ab5b9134f10

5. The following suggests that docker/metadata-action is able to handle some tag logic automatically and we don't really need something complex here. Have you looked into whether the default behavior of that could just work good enough for our use-case so that there doesn't need to be a copy of the "Prepare metadata (release tags)" step?

   icinga2-plugins-container/.github/workflows/container-image.yml

   Lines 90 to 93 in 715b9aa

   	flavor: |
   	# Disable automatic 'latest' tagging as our custom logic is used to
   	# determine when to apply the 'latest' tag.
   	latest=false

6. .github/workflows/container-image.yml builds the containers twice, once for testing it, and then again for pushing it. Any chance of reducing this to a single build so that the same image ist tested and then pushed?