docker.yml

name: Build and Push Docker Image

# Description:
# Triggered automatically after the PyPI Upload workflow succeeds, or manually via workflow_dispatch.
# Determines whether the release is stable (vX.Y.Z) or a pre-release.
# Triggers a Jenkins job to publish the Docker image to the public registry.
# For stable releases, the image is tagged with both the version (X.Y.Z) and 'latest'.
# For pre-releases, only the version tag is applied; 'latest' is not updated.

on:
  workflow_run:
    workflows: ["PyPI Upload"]
    types: [completed]
  workflow_dispatch:
    inputs:
      version:
        type: string
        required: true
        description: version tag name

permissions:
  contents: read
  actions: read # Required to download artifacts from other workflow runs

jobs:
  publish-docker-image:
    name: Publish Docker Image (public) via Jenkins
    runs-on: ubuntu-latest
    timeout-minutes: 60
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    steps:
      - name: Download version artifact
        if: github.event_name == 'workflow_run'
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          name: release-version
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}

      - name: Read version from artifact
        if: github.event_name == 'workflow_run'
        id: artifact-version
        run: echo "version=$(cat version.txt)" >> "$GITHUB_OUTPUT"

      - name: Check if stable release
        id: check-stable
        env:
          VERSION: ${{ github.event.inputs.version || steps.artifact-version.outputs.version || github.event.workflow_run.head_branch }}
        run: |
          echo "Checking version: $VERSION"
          if [[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "is_stable=true" >> "$GITHUB_OUTPUT"
            echo "This is a STABLE release: $VERSION"
          else
            echo "is_stable=false" >> "$GITHUB_OUTPUT"
            echo "This is a PRE-RELEASE: $VERSION (will not update 'latest' or major.minor tags)"
          fi

      - name: Trigger Jenkins Job (public registry)
        run: |
          set -eo pipefail
          queued_job_url=$(curl -X POST \
            "$JENKINS_BASE_URL/job/$JOB_NAME/buildWithParameters" \
            -d "PRODUCT=${PRODUCT}" \
            -d "VERSION=${VERSION}" \
            -d "REGISTRY=${REGISTRY}" \
            -d "TAG_LATEST=${TAG_LATEST}" \
            --user "$JENKINS_USER:$JENKINS_API_TOKEN" \
            --fail -s -D - -o /dev/null | grep -i "location:" | cut -d' ' -f2 | tr -d '\r')

          echo "Queued job URL: ${queued_job_url}"

          if [[ "$queued_job_url" =~ ^http: ]]; then
            queued_job_url="https:${queued_job_url:5}"
          fi
          echo "Queued job URL after conversion: ${queued_job_url}"

          echo "Waiting for build to start..."
          build_url=""
          for (( count=0; count<60; count++ )); do
            response=$(curl -s --user "${JENKINS_USER}:${JENKINS_API_TOKEN}" \
              "${queued_job_url}/api/json")

            build_url=$(echo "$response" | jq -r '.executable.url // empty')
            if [ -n "${build_url}" ]; then
              echo "Build URL: ${build_url}"
              break
            fi

            stuck=$(echo "$response" | jq -r '.stuck // false')
            why=$(echo "$response" | jq -r '.why // empty')
            echo "Build not started yet (stuck=${stuck}): ${why}"

            if [[ "${stuck}" == "true" ]]; then
              echo "Jenkins reports the queued item is stuck; giving up."
              echo "Check job status at: ${JENKINS_BASE_URL}/job/${JOB_NAME}"
              exit 1
            fi

            sleep 10
          done

          if [ -z "${build_url}" ]; then
            echo "Unable to determine URL for the jenkins run."
            echo "Check job status at: ${JENKINS_BASE_URL}/job/${JOB_NAME}"
            exit 1
          fi

          echo "Build started. Check progress at: ${build_url}"

          echo "Polling for build completion..."
          while true; do
            response=$(curl -s --user "${JENKINS_USER}:${JENKINS_API_TOKEN}" \
              "${build_url}/api/json")
            building=$(echo "$response" | jq -r .building)

            if [[ "$building" == "false" ]]; then
              result=$(echo "$response" | jq -r .result)
              echo "Build finished with result: ${result}"

              if [[ "$result" != "SUCCESS" ]]; then
                echo "Jenkins build did not succeed. Check details at: ${build_url}"
                exit 1
              fi
              break
            fi

            echo "Still building... checking again in 30 seconds."
            sleep 30
          done
        env:
          JENKINS_BASE_URL: "https://server.jenkins.couchbase.com"
          JENKINS_USER: ${{ secrets.SERVER_JENKINS_USERNAME }}
          JENKINS_API_TOKEN: ${{ secrets.SERVER_JENKINS_PAT }}
          PRODUCT: "mcp-server-couchbase"
          VERSION: ${{ github.event.inputs.version || steps.artifact-version.outputs.version || github.event.workflow_run.head_branch }}
          REGISTRY: "public"
          TAG_LATEST: ${{ steps.check-stable.outputs.is_stable }}
          JOB_NAME: "docker-publish"