name: Build & publish docker images

on:
  push:
    branches:
      - "master"
      - "[0-9].[0-9]*"
  pull_request:
    branches:
      - "master"

permissions:
  contents: read
  pull-requests: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  changes:
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: read
    outputs:
      python: ${{ steps.check.outputs.python }}
      frontend: ${{ steps.check.outputs.frontend }}
      docker: ${{ steps.check.outputs.docker }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Check for file changes
        id: check
        uses: ./.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  setup_matrix:
    runs-on: ubuntu-slim
    timeout-minutes: 5
    outputs:
      matrix_config: ${{ steps.set_matrix.outputs.matrix_config }}
    steps:
      - id: set_matrix
        run: |
          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["dev", "lean"]'; else echo '["dev", "lean", "websocket", "dockerize", "py311", "py312"]'; fi)
          echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
          echo $GITHUB_OUTPUT

  # Runs unconditionally (no dependency on `changes`, and no build-preset
  # matrix restriction) so a regression in the PY_VER override logic is
  # always caught on PRs. Without this, the real docker-build job only runs
  # when the change detector flags docker/python/frontend changes (a
  # workflow-only edit like this one does not), and even then the PR build
  # matrix never includes the "py311"/"py312" presets that logic protects -
  # so a break here would otherwise first surface on a push to master.
  pyver-override-check:
    name: verify docker build PY_VER override
    runs-on: ubuntu-26.04
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup supersetbot
        uses: ./.github/actions/setup-supersetbot/
      - name: Assert PY_VER override applies to every preset except py311/py312
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          # Asserts against the actual buildx command line `supersetbot docker
          # --dry-run` would run, not just this repo's own extra-flags helper,
          # so a regression in supersetbot itself (dropping the py311/py312
          # PY_VER pin, or reordering args so our override no longer lands
          # last) is caught here too, instead of only surfacing on master.
          assert_effective_py_ver() {
            local preset="$1" expected="$2" extra_flags command actual
            extra_flags="$(scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
            command="$(supersetbot docker --preset "$preset" --platform linux/amd64 --extra-flags "$extra_flags" --dry-run)"
            # docker buildx keeps the LAST value of a repeated --build-arg key.
            actual="$(grep -oE -- '--build-arg PY_VER=[^[:space:]]+' <<<"$command" | tail -1)"
            if [ "$actual" != "--build-arg PY_VER=$expected" ]; then
              echo "::error::preset '$preset' expected effective --build-arg PY_VER=$expected, got: ${actual:-<none>} (full command: $command)"
              exit 1
            fi
          }
          for preset in dev lean websocket dockerize; do
            assert_effective_py_ver "$preset" "3.11.14-slim-trixie"
          done
          assert_effective_py_ver py311 "3.11-slim-bookworm"
          assert_effective_py_ver py312 "3.12-slim-bookworm"
          echo "PY_VER override logic verified against the assembled buildx command for all build presets"

  docker-build:
    name: docker-build
    needs: [setup_matrix, changes]
    if: >-
      needs.changes.outputs.python == 'true' ||
      needs.changes.outputs.frontend == 'true' ||
      needs.changes.outputs.docker == 'true'
    runs-on: ubuntu-26.04
    timeout-minutes: 60
    strategy:
      matrix:
        build_preset: ${{fromJson(needs.setup_matrix.outputs.matrix_config)}}
      fail-fast: false
    env:
      DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
      IMAGE_TAG: apache/superset:GHA-${{ matrix.build_preset }}-${{ github.run_id }}

    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Free up disk space
        shell: bash
        run: |
          # Reclaim large preinstalled toolchains we don't use. The image
          # build, and especially the docker-compose sanity check (which
          # rebuilds from scratch whenever the registry cache image
          # apache/superset-cache is unavailable), can otherwise exhaust the
          # runner's root disk and fail with "no space left on device".
          echo "Disk before cleanup:"; df -h /
          sudo rm -rf \
            /usr/share/dotnet \
            /usr/local/lib/android \
            /opt/ghc \
            /usr/local/.ghcup \
            /opt/hostedtoolcache/CodeQL \
            /usr/local/share/boost || true
          echo "Disk after cleanup:"; df -h /

      - name: Setup Docker Environment
        uses: ./.github/actions/setup-docker
        with:
          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
          build: "true"

      - name: Setup supersetbot
        uses: ./.github/actions/setup-supersetbot/

      - name: Build Docker Image
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BUILD_PRESET: ${{ matrix.build_preset }}
        run: |
          # Single platform builds in pull_request context to speed things up
          if [ "$GITHUB_EVENT_NAME" = "push" ]; then
            PLATFORM_ARG="--platform linux/arm64 --platform linux/amd64"
            # can only --load images in single-platform builds
            PUSH_OR_LOAD="--push"
          elif [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
            PLATFORM_ARG="--platform linux/amd64"
            PUSH_OR_LOAD="--load"
          fi

          # Retry to absorb transient Docker Hub registry errors (base-image
          # pull timeouts, 504/401 on push, ECONNRESET) that otherwise fail
          # the whole job. buildx reuses the buildkit layer cache from the
          # failed attempt, so a retry mostly re-does just the failed push.
          #
          # See scripts/docker-build-extra-flags.sh for why "py311"/"py312"
          # are excluded from the PY_VER override applied to every other
          # preset; that logic is also exercised on every PR by the
          # always-on pyver-override-check job below, since this job itself
          # only runs when the change detector flags docker/python/frontend
          # changes and the PR build matrix never includes py311/py312.
          EXTRA_FLAGS="$(scripts/docker-build-extra-flags.sh "$BUILD_PRESET" "$IMAGE_TAG")"

          for attempt in 1 2 3; do
            if supersetbot docker \
              $PUSH_OR_LOAD \
              --preset "$BUILD_PRESET" \
              --context "$EVENT" \
              --context-ref "$RELEASE" $FORCE_LATEST \
              --extra-flags "$EXTRA_FLAGS" \
              $PLATFORM_ARG; then
              break
            fi
            if [ "$attempt" -eq 3 ]; then
              echo "::error::supersetbot docker build failed after 3 attempts"
              exit 1
            fi
            echo "::warning::Build attempt ${attempt} failed; retrying in 30s..."
            sleep 30
          done

      # in the context of push (using multi-platform build), we need to pull the image locally
      - name: Docker pull
        if: github.event_name == 'push'
        run: |
          for i in 1 2 3; do
            docker pull $IMAGE_TAG && break
            [ $i -lt 3 ] && sleep 30
          done

      - name: Print docker stats
        run: |
          echo "SHA: ${{ github.sha }}"
          echo "IMAGE: $IMAGE_TAG"
          docker images $IMAGE_TAG
          docker history $IMAGE_TAG

      - name: docker-compose sanity check
        if: matrix.build_preset == 'dev'
        shell: bash
        env:
          BUILD_PRESET: ${{ matrix.build_preset }}
        run: |
          export SUPERSET_BUILD_TARGET=$BUILD_PRESET
          # This should reuse the CACHED image built in the previous steps
          docker compose build superset-init --build-arg DEV_MODE=false --build-arg INCLUDE_CHROMIUM=false
          docker compose up superset-init --exit-code-from superset-init

  docker-compose-image-tag:
    # Run this job only on pushes to master (not for PRs)
    # goal is to check that building the latest image works, not required for all PR pushes
    needs: changes
    if: github.event_name == 'push' && github.ref == 'refs/heads/master' && needs.changes.outputs.docker == 'true'
    runs-on: ubuntu-26.04
    timeout-minutes: 30
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Free up disk space
        shell: bash
        run: |
          # The sanity check rebuilds the image from scratch whenever the
          # registry cache image apache/superset-cache is unavailable, which
          # can exhaust the runner's root disk ("no space left on device").
          echo "Disk before cleanup:"; df -h /
          sudo rm -rf \
            /usr/share/dotnet \
            /usr/local/lib/android \
            /opt/ghc \
            /usr/local/.ghcup \
            /opt/hostedtoolcache/CodeQL \
            /usr/local/share/boost || true
          echo "Disk after cleanup:"; df -h /
      - name: Setup Docker Environment
        uses: ./.github/actions/setup-docker
        with:
          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
          build: "false"
          install-docker-compose: "true"
      - name: docker-compose sanity check
        shell: bash
        run: |
          docker compose -f docker-compose-image-tag.yml up superset-init --exit-code-from superset-init

  actions-timeline:
    needs: [docker-build, docker-compose-image-tag]
    if: always()
    runs-on: ubuntu-26.04
    permissions:
      actions: read
    steps:
      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true