.github/workflows/republish_released_docker_containers.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

# Workflow that enables republishing released docker images to avoid vulnerabilities

name: Republish Released Docker Images

on:
  workflow_dispatch:
    inputs:
      RELEASE:
        description: Beam version of current release (e.g. 2.XX.0)
        required: false
      RC:
        description: Integer RC version for the release (e.g. 3 for RC3)
        required: false
  schedule:
  - cron: "0 6 * * 1"
env:
  docker_registry: gcr.io
  release: "${{ github.event.inputs.RELEASE || '2.76.0' }}"
  rc: "${{ github.event.inputs.RC || '4' }}"

jobs:

  build:
    runs-on: [self-hosted, ubuntu-24.04, main]
    strategy:
      fail-fast: false
      matrix:
        # Split up images to publish so that longer ones are able to run independently/finish faster, otherwise this takes >6 hours
        # Any task which is skipped from a broader task must be explicitly included in this list to avoid accidentally missing new
        # tasks as they are added.
        images_to_publish: [
          {"gradle_task": ":pushAllRunnersDockerImages", "include_skip_flags": "-Pinclude-ml -Pinclude-distroless"},
          {"gradle_task": ":sdks:python:container:push310", "include_skip_flags": "-Pinclude-ml -Pinclude-distroless"},
          {"gradle_task": ":sdks:python:container:push311", "include_skip_flags": "-Pinclude-ml -Pinclude-distroless"},
          {"gradle_task": ":sdks:python:container:push312", "include_skip_flags": "-Pinclude-ml -Pinclude-distroless"},
          {"gradle_task": ":sdks:python:container:push313", "include_skip_flags": "-Pinclude-ml -Pinclude-distroless"},
          {"gradle_task": ":sdks:python:container:pushAll", "include_skip_flags": "-Pinclude-ml -Pinclude-distroless -Pskip-python-39-images -Pskip-python-310-images -Pskip-python-311-images -Pskip-python-312-images -Pskip-python-313-images"},
          {"gradle_task": ":pushAllSdkDockerImages", "include_skip_flags": "-Pskip-python-images"},
          {"gradle_task": ":pushAllDockerImages", "include_skip_flags": "-Pskip-runner-images -Pskip-sdk-images"}
        ]
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: "release-${{ env.release }}-postrelease"
          repository: apache/beam
          persist-credentials: false
      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@v2.0.0
      - name: Install Java 11
        uses: actions/setup-java@v6
        with:
          distribution: 'temurin'
          java-version: |
            21
            11
      - name: Install Python 3.11
        uses: actions/setup-python@v7
        with:
          python-version: '3.11'
      - name: Authenticate on GCP
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
        with:
          service_account: ${{ secrets.GCP_SA_EMAIL }}
          credentials_json: ${{ secrets.GCP_SA_KEY }}
      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: Remove default github maven configuration
        # This step is a workaround to avoid a decryption issue of Beam's
        # net.linguica.gradle.maven.settings plugin and github's provided maven
        # settings.xml file
        run: rm ~/.m2/settings.xml || true
      - name: GCloud Docker credential helper
        run: |
          gcloud auth configure-docker ${{ env.docker_registry }}
      - name: Push docker images
        run: |
          ./gradlew ${{ matrix.images_to_publish.gradle_task }} \
          -PisRelease \
          -PpythonVersion=3.11 \
          -Pdocker-pull-licenses \
          -Pprune-images ${{ matrix.images_to_publish.include_skip_flags }} \
          -Pdocker-repository-root=gcr.io/apache-beam-testing/updated_released_container_images \
          -Pdocker-tag-list=${release},${{ github.sha }},$(date +'%Y-%m-%d') \
          -Pjava21Home=$JAVA_HOME_21_X64 \
          --no-daemon \
          --no-parallel