name: Docker Publish
# Build and publish Docker image when a GitHub release is created.
# This provides a reliable signal that the release (and PyPI publish) is complete.
on:
release:
types: [published]
workflow_dispatch:
inputs:
tag_name:
description: 'Specific tag to build and publish (optional, e.g., v1.0.0)'
required: false
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: false
env:
REGISTRY: ghcr.io
IMAGE_NAME: mcp-souschef
jobs:
validate:
if: |
(github.event_name == 'release')
|| (github.event_name == 'workflow_dispatch')
runs-on: ubuntu-latest
timeout-minutes: 5
permissions:
contents: read
outputs:
version: ${{ steps.version.outputs.version }}
tag: ${{ steps.version.outputs.tag }}
steps:
- name: Checkout repository
uses: actions/checkout@v6
with:
fetch-depth: 0
fetch-tags: true
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: "3.12"
- name: Determine version
id: version
run: |
# Use provided tag if manual dispatch
if [ -n "${{ github.event.inputs.tag_name }}" ]; then
TAG="${{ github.event.inputs.tag_name }}"
VERSION="${TAG#v}"
# Use release tag from release event
elif [ -n "${{ github.event.release.tag_name }}" ]; then
TAG="${{ github.event.release.tag_name }}"
VERSION="${TAG#v}"
# Fallback to pyproject.toml
else
VERSION=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['tool']['poetry']['version'])")
TAG="v${VERSION}"
fi
# Validate version format
if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
printf 'ERROR: Invalid version format: %s\n' "$VERSION" >&2
exit 1
fi
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
echo "Version: ${VERSION}, Tag: ${TAG}"
- name: Verify release exists
if: github.event_name == 'release'
env:
TAG: ${{ steps.version.outputs.tag }}
run: |
echo "Release $TAG published, proceeding with Docker build"
build-and-push:
runs-on: ubuntu-latest
needs: validate
if: needs.validate.result == 'success'
timeout-minutes: 30
permissions:
contents: read
packages: write
id-token: write
outputs:
image-digest: ${{ steps.build.outputs.digest }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
image-pushed: ${{ steps.build.outputs.digest != '' }}
steps:
- name: Checkout repository
uses: actions/checkout@v6
with:
fetch-depth: 0
fetch-tags: true
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
with:
platforms: linux/amd64,linux/arm64
- name: Generate build metadata
id: meta
uses: docker/metadata-action@v5
with:
images: |
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=semver,pattern={{version}},value=${{ needs.validate.outputs.version }}
type=semver,pattern={{major}}.{{minor}},value=${{ needs.validate.outputs.version }}
type=semver,pattern={{major}},value=${{ needs.validate.outputs.version }}
type=raw,value=latest
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and push Docker image
id: build
uses: docker/build-push-action@v6
with:
context: .
platforms: linux/amd64,linux/arm64
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
build-args: |
PYTHON_VERSION=3.13.1
POETRY_VERSION=1.8.3
provenance: true
sbom: true
- name: Verify image digest
run: |
DIGEST="${{ steps.build.outputs.digest }}"
if [ -z "$DIGEST" ]; then
echo "ERROR: Image digest is empty"
exit 1
fi
echo "Image pushed successfully with digest: $DIGEST"
scan-image:
runs-on: ubuntu-latest
timeout-minutes: 15
needs: [validate, build-and-push]
if: needs.build-and-push.result == 'success' && needs.build-and-push.outputs.image-pushed == 'true'
permissions:
packages: read
security-events: write
steps:
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Run Trivy vulnerability scan
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.validate.outputs.version }}
format: sarif
output: trivy-results.sarif
severity: CRITICAL,HIGH
exit-code: '0'
- name: Upload Trivy results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: trivy-results.sarif
category: trivy-image-scan
- name: Display vulnerability report
if: always()
run: |
echo "Vulnerability scan results:"
echo "See GitHub Security tab for detailed report"
test-image:
runs-on: ubuntu-latest
timeout-minutes: 15
needs: [validate, build-and-push]
if: needs.build-and-push.result == 'success' && needs.build-and-push.outputs.image-pushed == 'true'
permissions:
packages: read
steps:
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Run container and verify it starts
run: |
set -e
# Pull the image first to ensure it's available
docker pull "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.validate.outputs.version }}"
# Test if container can start (with 10-second timeout)
timeout 10 docker run --rm \
-e STREAMLIT_SERVER_HEADLESS=true \
-e STREAMLIT_BROWSER_GATHER_USAGE_STATS=false \
"${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.validate.outputs.version }}" \
/bin/true || true
echo "Container started successfully"
- name: Verify health check works
run: |
set -e
OUTPUT=$(docker run --rm \
"${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.validate.outputs.version }}" \
python -m souschef.ui.health_check)
echo "Health check output: $OUTPUT"
if echo "$OUTPUT" | grep -q "healthy"; then
echo "Health check passed"
else
echo "Health check failed"
exit 1
fi
notify-deployments:
runs-on: ubuntu-latest
timeout-minutes: 5
needs: [validate, build-and-push, scan-image, test-image]
if: |
needs.validate.result == 'success'
&& needs.build-and-push.result == 'success'
&& needs.scan-image.result == 'success'
&& needs.test-image.result == 'success'
permissions:
contents: read
issues: write
steps:
- name: Create deployment notification issue
uses: actions/github-script@v7
with:
script: |
const version = "${{ needs.validate.outputs.version }}";
const registry = "${{ env.REGISTRY }}";
const imageName = "${{ env.IMAGE_NAME }}";
const digest = "${{ needs.build-and-push.outputs.image-digest }}";
const tag = "${{ needs.validate.outputs.tag }}";
const versionParts = version.split('.');
const majorMinor = versionParts.length >= 2
? versionParts[0] + "." + versionParts[1]
: versionParts[0];
const major = versionParts[0];
let body = "## Docker Image Published\n\n";
body += "**Image:** `" + registry + "/" + imageName + ":" + version + "`\n\n";
body += "**Digest:** " + digest + "\n\n";
body += "**Available Tags:**\n";
body += "- `" + version + "` (exact version)\n";
body += "- `" + majorMinor + "` (minor version)\n";
body += "- `" + major + "` (major version)\n";
body += "- `latest` (most recent release)\n\n";
body += "**Container Registry:** [GitHub Container Registry](https://github.com/${{ github.repository }}/pkgs/container/" + imageName + ")\n\n";
body += "**Pull Commands:**\n";
body += "```bash\n";
body += "# Pull specific version\n";
body += "docker pull " + registry + "/" + imageName + ":" + version + "\n\n";
body += "# Pull latest\n";
body += "docker pull " + registry + "/" + imageName + ":latest\n\n";
body += "# Pull major version\n";
body += "docker pull " + registry + "/" + imageName + ":" + major + "\n";
body += "```\n\n";
body += "**Security:** Vulnerability scan results available in [GitHub Security](https://github.com/${{ github.repository }}/security/dependabot)\n\n";
body += "**Related Release:** " + tag + "\n\n";
body += "## Build Information\n";
body += "- **Release Event:** ${{ github.event.release.id || 'manual dispatch' }}\n";
body += "- **Docker Workflow:** ${{ github.run_id }}";
github.rest.issues.create({
owner: context.repo.owner,
repo: context.repo.repo,
title: "Docker Image Published: " + tag,
body: body,
labels: ['deployment', 'docker', 'release']
});
summary:
runs-on: ubuntu-latest
timeout-minutes: 5
needs: [validate, build-and-push, scan-image, test-image, notify-deployments]
if: always()
permissions:
contents: read
steps:
- name: Workflow Summary
run: |
cat > /tmp/summary.md << 'EOF'
# Docker Publishing Summary
## Workflow Status
- **Validation:** ${{ needs.validate.result }}
- **Build & Push:** ${{ needs.build-and-push.result }}
- **Security Scan:** ${{ needs.scan-image.result }}
- **Image Test:** ${{ needs.test-image.result }}
- **Notification:** ${{ needs.notify-deployments.result }}
## Release Information
- **Version:** ${{ needs.validate.outputs.version || 'N/A' }}
- **Tag:** ${{ needs.validate.outputs.tag || 'N/A' }}
## Image Information
- **Registry:** ${{ env.REGISTRY }}
- **Repository:** ${{ env.IMAGE_NAME }}
- **Digest:** ${{ needs.build-and-push.outputs.image-digest || 'No image pushed' }}
## Available Tags
${{ needs.build-and-push.outputs.tags || 'No tags generated' }}
## Next Steps
- Image is ready for deployment
- See security scan results in [GitHub Security](https://github.com/${{ github.repository }}/security/dependabot)
- Pull the image with: \`docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.validate.outputs.version || 'latest' }}\`
## Workflow Run Details
- **Workflow:** ${{ github.workflow }}
- **Run ID:** ${{ github.run_id }}
- **Run Number:** ${{ github.run_number }}
- **Event:** ${{ github.event_name }}
EOF
cat /tmp/summary.md >> $GITHUB_STEP_SUMMARY
- name: Report failures
if: |
needs.validate.result != 'success'
|| needs.build-and-push.result != 'success'
|| needs.scan-image.result != 'success'
|| needs.test-image.result != 'success'
run: |
echo "### Docker Publishing Workflow Failed" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "| Job | Status |" >> $GITHUB_STEP_SUMMARY
echo "|-----|--------|" >> $GITHUB_STEP_SUMMARY
echo "| Validation | ${{ needs.validate.result }} |" >> $GITHUB_STEP_SUMMARY
echo "| Build & Push | ${{ needs.build-and-push.result }} |" >> $GITHUB_STEP_SUMMARY
echo "| Security Scan | ${{ needs.scan-image.result }} |" >> $GITHUB_STEP_SUMMARY
echo "| Image Test | ${{ needs.test-image.result }} |" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "Please review the failed jobs above."
exit 1
