docker.yml

name: Build & publish docker images

on:
  push:
    branches:
      - "master"
      - "[0-9].[0-9]*"
  pull_request:
    branches:
      - "master"

permissions:
  contents: read
  pull-requests: read

jobs:
  changes:
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: read
    outputs:
      python: ${{ steps.check.outputs.python }}
      frontend: ${{ steps.check.outputs.frontend }}
      docker: ${{ steps.check.outputs.docker }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Check for file changes
        id: check
        uses: $/.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  # Master (and each release branch) gets frequent, sometimes bursty pushes,
  # and docker-build's per-preset concurrency groups below are keyed on the
  # branch, not the run: with cancel-in-progress: false, a burst queues
  # several runs behind each other in the same group, and GitHub
  # force-cancels all but the newest queued one regardless of
  # cancel-in-progress — that shows up as a failing "Cancelled" check on an
  # otherwise-fine commit instead of a clean "Skipped" one. Check up front
  # whether this run is still building its branch's current tip and, if
  # not, skip the whole matrix cleanly before it ever joins that queue.
  # Deliberately outside any concurrency group so it runs immediately for
  # every trigger without blocking or being blocked by anything. Mirrors
  # check-freshness in superset-docs-deploy.yml, which hit the same
  # cancelled-vs-skipped problem first.
  check-freshness:
    runs-on: ubuntu-26.04
    timeout-minutes: 5
    outputs:
      is-current: ${{ steps.check.outputs.is-current }}
    steps:
      # Sparse checkout: this job's only job is to be fast, so it fetches
      # nothing but the freshness-check script itself.
      - name: Checkout freshness-check script
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: |
            .github/workflows/scripts
          sparse-checkout-cone-mode: false
      - name: "Check whether this is still the branch's current commit"
        id: check
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BUILD_SHA: ${{ github.sha }}
          EVENT_NAME: ${{ github.event_name }}
          REPO: ${{ github.repository }}
          BRANCH: ${{ github.ref_name }}
          OUTPUT_NAME: is-current
          FAIL_OPEN: "true"
        run: .github/workflows/scripts/check-branch-freshness.sh

  setup_matrix:
    runs-on: ubuntu-slim
    timeout-minutes: 5
    outputs:
      matrix_config: ${{ steps.set_matrix.outputs.matrix_config }}
      has-secrets: ${{ steps.check.outputs.has-secrets }}
    steps:
      - name: "Check for secrets"
        id: check
        shell: bash
        run: |
          if [ -n "${DOCKERHUB_USER}" ] && [ -n "${DOCKERHUB_TOKEN}" ]; then
            echo "has-secrets=1" >> "$GITHUB_OUTPUT"
          fi
        env:
          DOCKERHUB_USER: ${{ (secrets.DOCKERHUB_USER != '') || '' }}
          DOCKERHUB_TOKEN: ${{ (secrets.DOCKERHUB_TOKEN != '') || '' }}
      - id: set_matrix
        run: |
          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["superset", "dev", "lean"]'; else echo '["superset", "dev", "lean", "py311", "py312"]'; fi)
          echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
          echo $GITHUB_OUTPUT

  # Runs unconditionally (no dependency on `changes`, and no build-preset
  # matrix restriction) so regressions in the assembled Supersetbot command
  # are always caught on PRs. Without this, the real docker-build job only
  # runs when the change detector flags docker/python/frontend changes (a
  # workflow-only edit like this one does not), and even then the PR build
  # matrix never includes the "py311"/"py312" presets that logic protects.
  docker-command-check:
    name: verify docker build command
    runs-on: ubuntu-26.04
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup supersetbot
        uses: $/.github/actions/setup-supersetbot/
      - name: Assert generated docker build command
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          # Asserts against the actual buildx command line `supersetbot docker
          # --dry-run` would run, not just this repo's own extra-flags helper,
          # so a regression in supersetbot itself (dropping the py311/py312
          # PY_VER pin, or reordering args so our override no longer lands
          # last) is caught here too, instead of only surfacing on master.
          docker_command() {
            local preset="$1" extra_flags="$2"
            shift 2
            # Supersetbot adds its own --cache-to whenever DOCKERHUB_TOKEN is
            # present. Hide the token from Supersetbot so cache export is
            # controlled only by docker-build-extra-flags.sh, mirroring the
            # docker-build job. assert_supersetbot_exports_cache_with_token
            # below covers the unhidden case.
            DOCKERHUB_TOKEN= supersetbot docker \
              --preset "$preset" \
              --platform linux/amd64 \
              "$@" \
              --extra-flags "$extra_flags" \
              --dry-run
          }
          docker_command_with_token() {
            local preset="$1" extra_flags="$2"
            shift 2
            DOCKERHUB_TOKEN=dummy supersetbot docker \
              --preset "$preset" \
              --platform linux/amd64 \
              "$@" \
              --extra-flags "$extra_flags" \
              --dry-run
          }
          load_build_plan() {
            local event_name="$1" ref="$2" ref_name="$3"
            eval "$(bash scripts/docker-build-plan.sh "$event_name" "$ref" "$ref_name")"
          }
          assert_build_plan() {
            local event_name="$1" ref="$2" ref_name="$3" expected_context="$4" expected_context_ref="$5" expected_push_or_load="$6" expected_platform="$7" expected_cache_publish="$8"
            load_build_plan "$event_name" "$ref" "$ref_name"
            if [ "$BUILD_CONTEXT" != "$expected_context" ] ||
              [ "$BUILD_CONTEXT_REF" != "$expected_context_ref" ] ||
              [ "$PUSH_OR_LOAD" != "$expected_push_or_load" ] ||
              [ "$PLATFORM_ARG" != "$expected_platform" ] ||
              [ "$PUBLISH_DOCKER_CACHE" != "$expected_cache_publish" ]; then
              echo "::error::unexpected docker build plan for event=$event_name ref=$ref ref_name=$ref_name: context=$BUILD_CONTEXT context_ref=$BUILD_CONTEXT_REF push_or_load=$PUSH_OR_LOAD platform=$PLATFORM_ARG publish_cache=$PUBLISH_DOCKER_CACHE"
              exit 1
            fi
          }
          assert_effective_py_ver() {
            local preset="$1" expected="$2" extra_flags command actual
            extra_flags="$(scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
            command="$(docker_command "$preset" "$extra_flags")"
            # docker buildx keeps the LAST value of a repeated --build-arg key.
            actual="$(grep -oE -- '--build-arg PY_VER=[^[:space:]]+' <<<"$command" | tail -1)"
            if [ "$actual" != "--build-arg PY_VER=$expected" ]; then
              echo "::error::preset '$preset' expected effective --build-arg PY_VER=$expected, got: ${actual:-<none>} (full command: $command)"
              exit 1
            fi
          }
          assert_cache_ref() {
            local preset="$1" expected="$2" extra_flags command
            extra_flags="$(scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
            command="$(docker_command "$preset" "$extra_flags")"
            # Match the whole flag, so a ref with extra trailing text (e.g. a
            # digest) doesn't pass on its prefix.
            if ! grep -oE -- '--cache-from=[^[:space:]]+' <<<"$command" | grep -Fxq -- "--cache-from=type=registry,ref=apache/superset-cache:$expected"; then
              echo "::error::preset '$preset' expected cache-from apache/superset-cache:$expected (full command: $command)"
              exit 1
            fi
          }
          assert_master_tag() {
            local preset="$1" expected="$2" extra_flags command
            load_build_plan push refs/heads/master master
            extra_flags="$(scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
            command="$(docker_command "$preset" "$extra_flags" --context "$BUILD_CONTEXT" --context-ref "$BUILD_CONTEXT_REF")"
            if ! grep -Eq -- "-t apache/superset:${expected}([[:space:]]|$)" <<<"$command"; then
              echo "::error::preset '$preset' expected master tag apache/superset:$expected (full command: $command)"
              exit 1
            fi
          }
          assert_no_cache_push_for_validation() {
            local preset="$1" extra_flags command
            load_build_plan push refs/heads/7.0 7.0
            extra_flags="$(PUBLISH_DOCKER_CACHE="" DOCKERHUB_TOKEN=dummy scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
            command="$(GITHUB_REF=refs/heads/7.0 docker_command "$preset" "$extra_flags" --context "$BUILD_CONTEXT" --context-ref "$BUILD_CONTEXT_REF")"
            if grep -Fq -- "--cache-to=type=registry" <<<"$command"; then
              echo "::error::preset '$preset' unexpectedly exports registry cache during validation (full command: $command)"
              exit 1
            fi
          }
          # The assertion above only proves our own helper stays quiet; it is
          # the docker-build job blanking DOCKERHUB_TOKEN that stops Supersetbot
          # from adding an implicit --cache-to of its own. Pin that Supersetbot
          # behaviour here, so the reason the production guard exists cannot
          # quietly disappear and leave validation builds exporting unreviewed
          # layers to the shared registry cache.
          assert_supersetbot_exports_cache_with_token() {
            local preset="$1" extra_flags command
            load_build_plan push refs/heads/7.0 7.0
            extra_flags="$(PUBLISH_DOCKER_CACHE="" DOCKERHUB_TOKEN=dummy scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
            command="$(GITHUB_REF=refs/heads/7.0 docker_command_with_token "$preset" "$extra_flags" --context "$BUILD_CONTEXT" --context-ref "$BUILD_CONTEXT_REF")"
            if ! grep -Fq -- "--cache-to=type=registry" <<<"$command"; then
              echo "::error::supersetbot no longer adds an implicit --cache-to when DOCKERHUB_TOKEN is set; the token-hiding guard in docker-build may be obsolete (full command: $command)"
              exit 1
            fi
          }
          assert_publish_guard() {
            local event_name="$1" ref="$2" sha="$3" tip_sha="$4" expected="$5"
            eval "$(bash scripts/docker-publish-guard.sh "$event_name" "$ref" "$sha" "$tip_sha")"
            if [ "$PUBLISH" != "$expected" ]; then
              echo "::error::publish guard for event=$event_name ref=$ref sha=$sha tip=$tip_sha expected PUBLISH=$expected, got $PUBLISH"
              exit 1
            fi
          }
          assert_cache_push_for_master() {
            local preset="$1" expected="$2" extra_flags command
            load_build_plan push refs/heads/master master
            extra_flags="$(PUBLISH_DOCKER_CACHE=true DOCKERHUB_TOKEN=dummy scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
            command="$(docker_command "$preset" "$extra_flags" --context "$BUILD_CONTEXT" --context-ref "$BUILD_CONTEXT_REF")"
            if ! grep -oE -- '--cache-to=[^[:space:]]+' <<<"$command" | grep -Fxq -- "--cache-to=type=registry,mode=max,ref=apache/superset-cache:$expected"; then
              echo "::error::preset '$preset' expected cache-to apache/superset-cache:$expected for master publish (full command: $command)"
              exit 1
            fi
          }
          assert_release_tag() {
            local preset="$1" expected="$2" extra_flags command
            extra_flags="$(scripts/docker-build-extra-flags.sh "$preset" "" release)"
            command="$(docker_command "$preset" "$extra_flags" --context release --context-ref 6.1.0)"
            if ! grep -Eq -- "-t apache/superset:${expected}([[:space:]]|$)" <<<"$command"; then
              echo "::error::preset '$preset' expected release tag apache/superset:$expected (full command: $command)"
              exit 1
            fi
            if grep -Fq -- "--build-arg INCLUDE_CHROMIUM=" <<<"$command"; then
              echo "::error::preset '$preset' overrides the release Dockerfile's Chromium default (full command: $command)"
              exit 1
            fi
          }
          # tag-release.yml snapshots this helper from master, then checks out
          # the release ref before running it, so the helper has to read the
          # Dockerfile from the working tree rather than from wherever it
          # lives. Simulate that ref swap against a synthetic older tree: a
          # real release ref pins an older PY_VER and carries its own Chromium
          # default, neither of which release mode may override.
          assert_release_ref_swap() {
            local snapshot release_tree flags
            snapshot="$(mktemp -d)/docker-build-extra-flags.sh"
            cp scripts/docker-build-extra-flags.sh "$snapshot"
            release_tree="$(mktemp -d)"
            printf 'ARG PY_VER=3.11-slim-bookworm\n' >"$release_tree/Dockerfile"
            flags="$(cd "$release_tree" && bash "$snapshot" superset "" release)"
            if ! grep -Fq -- "--build-arg PY_VER=3.11-slim-bookworm" <<<"$flags"; then
              echo "::error::release build ignored the checked-out Dockerfile's PY_VER (flags: $flags)"
              exit 1
            fi
            if grep -Fq -- "--build-arg INCLUDE_CHROMIUM=" <<<"$flags"; then
              echo "::error::release build overrode the checked-out Dockerfile's Chromium default (flags: $flags)"
              exit 1
            fi
            # The same tree in ci mode must still get the validation override,
            # so the two modes cannot silently converge.
            flags="$(cd "$release_tree" && bash "$snapshot" superset dummy-tag ci)"
            if ! grep -Fq -- "--build-arg INCLUDE_CHROMIUM=false" <<<"$flags"; then
              echo "::error::ci build lost the INCLUDE_CHROMIUM=false override (flags: $flags)"
              exit 1
            fi
          }
          assert_build_plan push refs/heads/master master push master --push "--platform linux/arm64 --platform linux/amd64" true
          assert_build_plan push refs/heads/7.0 7.0 push "" --load "--platform linux/amd64" ""
          assert_build_plan pull_request refs/pull/44250/merge "" pull_request "" --load "--platform linux/amd64" ""
          # A master push publishes only while its commit is still the branch
          # tip. The second case is the delayed-A/fast-B inversion: A's change
          # detection lagged, B published first, and A must not roll the
          # mutable master* tags back to the older digest.
          assert_publish_guard push refs/heads/master aaaa111 aaaa111 true
          assert_publish_guard push refs/heads/master aaaa111 bbbb222 false
          assert_publish_guard push refs/heads/7.0 aaaa111 bbbb222 true
          assert_publish_guard pull_request refs/pull/44250/merge aaaa111 bbbb222 true
          assert_supersetbot_exports_cache_with_token superset
          # The default presets must pass the Dockerfile's digest-pinned PY_VER
          # (tag@sha256:...) through unchanged; read it the way
          # docker-build-extra-flags.sh does so digest bumps need no edit here.
          default_py_ver="$(sed -n 's/^ARG PY_VER=//p' Dockerfile | head -n 1)"
          if [[ "$default_py_ver" != *@sha256:* ]]; then
            echo "::error::Dockerfile ARG PY_VER must pin a digest (tag@sha256:...), got: ${default_py_ver:-<none>}"
            exit 1
          fi
          for preset in superset dev lean; do
            assert_effective_py_ver "$preset" "$default_py_ver"
            expected_cache="3.11-slim-trixie"
            if [ "$preset" != "superset" ]; then
              expected_cache="${expected_cache}-${preset}"
            fi
            assert_cache_ref "$preset" "$expected_cache"
            assert_no_cache_push_for_validation "$preset"
          done
          assert_effective_py_ver py311 "3.11-slim-bookworm"
          assert_cache_ref py311 "3.11-slim-bookworm"
          assert_no_cache_push_for_validation py311
          assert_effective_py_ver py312 "3.12-slim-bookworm"
          assert_cache_ref py312 "3.12-slim-bookworm"
          assert_no_cache_push_for_validation py312
          assert_master_tag superset master
          assert_master_tag dev master-dev
          assert_master_tag lean master-lean
          assert_master_tag py311 master-py311
          assert_master_tag py312 master-py312
          assert_cache_push_for_master superset "3.11-slim-trixie"
          assert_cache_push_for_master dev "3.11-slim-trixie-dev"
          assert_cache_push_for_master lean "3.11-slim-trixie-lean"
          assert_cache_push_for_master py311 "3.11-slim-bookworm"
          assert_cache_push_for_master py312 "3.12-slim-bookworm"
          assert_release_tag superset "6.1.0"
          assert_release_tag dev "6.1.0-dev"
          assert_release_tag lean "6.1.0-lean"
          assert_release_tag py311 "6.1.0-py311"
          assert_release_tag py312 "6.1.0-py312"
          assert_release_ref_swap
          echo "Docker build command verified for Python versions, cache refs, cache export, publish guard, master tags, release tags, and the release ref swap"

  docker-build:
    name: docker-build
    needs: [setup_matrix, changes, check-freshness]
    # Only master pushes publish images (see scripts/docker-build-plan.sh).
    # Without the Docker Hub credentials (e.g. on a fork or mirror) they can
    # publish nothing, so they are skipped there. Version-branch pushes and
    # pull_request builds only load the image to validate that it builds, so
    # they run everywhere. check-freshness.outputs.is-current is always
    # 'true' for pull_request (it bypasses the check there — a PR build has
    # no branch tip to race against, and staleness is instead handled by
    # this job's own cancel-in-progress: true below), so this only narrows
    # push triggers superseded by a newer commit on the same branch.
    if: >-
      needs.check-freshness.outputs.is-current == 'true' &&
      (github.event_name != 'push' ||
       github.ref != 'refs/heads/master' ||
       needs.setup_matrix.outputs.has-secrets) &&
      (needs.changes.outputs.python == 'true' ||
       needs.changes.outputs.frontend == 'true' ||
       needs.changes.outputs.docker == 'true')
    runs-on: ubuntu-26.04
    timeout-minutes: 60
    permissions:
      contents: read
      # Required for the vulnerability scan below to upload its SARIF
      # results to GitHub code scanning (advanced-security is enabled by
      # default), matching the same grant in github-action-validator.yml.
      security-events: write
    strategy:
      matrix:
        build_preset: ${{fromJson(needs.setup_matrix.outputs.matrix_config)}}
      fail-fast: false
    # Apply concurrency after change detection. A docs-only push has no
    # docker-build job and cannot replace a pending publisher. Publishing
    # pushes queue so a slower run cannot overwrite mutable tags, while
    # superseded pull_request validation builds are cancelled as before --
    # otherwise every new commit on a PR would wait behind the abandoned
    # merge ref's build for up to the 60 minute job timeout.
    concurrency:
      group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.build_preset }}
      cancel-in-progress: ${{ github.event_name == 'pull_request' }}
    env:
      DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
      IMAGE_TAG: apache/superset:GHA-${{ matrix.build_preset }}-${{ github.run_id }}

    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Free up disk space
        shell: bash
        run: |
          # Reclaim large preinstalled toolchains we don't use. The image
          # build, and especially the docker-compose sanity check (which
          # rebuilds from scratch whenever the registry cache image
          # apache/superset-cache is unavailable), can otherwise exhaust the
          # runner's root disk and fail with "no space left on device".
          echo "Disk before cleanup:"; df -h /
          sudo rm -rf \
            /usr/share/dotnet \
            /usr/local/lib/android \
            /opt/ghc \
            /usr/local/.ghcup \
            /opt/hostedtoolcache/CodeQL \
            /usr/local/share/boost || true
          echo "Disk after cleanup:"; df -h /

      - name: Setup Docker Environment
        uses: $/.github/actions/setup-docker
        with:
          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
          build: "true"

      - name: Setup supersetbot
        uses: $/.github/actions/setup-supersetbot/

      # Concurrency serializes the master matrix per preset, but it does not
      # order the runs entering it: a run whose change detection lagged can
      # acquire the lock after a newer commit already published, and would
      # then move the mutable `master*` tags back to the older digest. Reject
      # the stale SHA instead. Every later step is gated on the result,
      # because a skipped build leaves no $IMAGE_TAG for them to act on.
      - name: Guard against publishing a superseded master commit
        id: publish_guard
        shell: bash
        run: |
          set -euo pipefail
          TIP_SHA=""
          if [ "$GITHUB_EVENT_NAME" = "push" ] && [ "$GITHUB_REF" = "refs/heads/master" ]; then
            # Public repo, so ls-remote needs no credentials; this keeps
            # persist-credentials: false on the checkout above. Retried
            # because a transient blip here would otherwise fail the job
            # rather than let it publish from a possibly superseded commit.
            for attempt in 1 2 3; do
              if TIP_SHA="$(git ls-remote "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" refs/heads/master | cut -f1)" &&
                [ -n "$TIP_SHA" ]; then
                break
              fi
              if [ "$attempt" -eq 3 ]; then
                echo "::error::could not read the master tip to validate $GITHUB_SHA"
                exit 1
              fi
              echo "::warning::ls-remote attempt ${attempt} failed; retrying in 10s..."
              sleep 10
            done
          fi
          eval "$(bash scripts/docker-publish-guard.sh "$GITHUB_EVENT_NAME" "$GITHUB_REF" "$GITHUB_SHA" "$TIP_SHA")"
          if [ "$PUBLISH" != "true" ]; then
            echo "::notice::master advanced to ${TIP_SHA} while ${GITHUB_SHA} was queued; skipping this build"
          fi
          echo "publish=$PUBLISH" >> "$GITHUB_OUTPUT"

      - name: Build Docker Image
        if: steps.publish_guard.outputs.publish == 'true'
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BUILD_PRESET: ${{ matrix.build_preset }}
        run: |
          set -euo pipefail
          # Release branch pushes and pull requests validate the build
          # locally. Official release images are published only by the
          # release workflow after the vote completes.
          eval "$(bash scripts/docker-build-plan.sh "$GITHUB_EVENT_NAME" "$GITHUB_REF" "${GITHUB_REF_NAME:-}")"
          export PUBLISH_DOCKER_CACHE

          # Retry to absorb transient Docker Hub registry errors (base-image
          # pull timeouts, 504/401 on push, ECONNRESET) that otherwise fail
          # the whole job. buildx reuses the buildkit layer cache from the
          # failed attempt, so a retry mostly re-does just the failed push.
          #
          # See scripts/docker-build-extra-flags.sh for why "py311"/"py312"
          # are excluded from the PY_VER override applied to every other
          # preset; that logic is also exercised on every PR by the
          # always-on docker-command-check job, since this job itself
          # only runs when the change detector flags docker/python/frontend
          # changes and the PR build matrix never includes py311/py312.
          EXTRA_FLAGS="$(scripts/docker-build-extra-flags.sh "$BUILD_PRESET" "$IMAGE_TAG")"

          for attempt in 1 2 3; do
            # Supersetbot adds --cache-to whenever DOCKERHUB_TOKEN is present.
            # Docker auth was already configured above; hide the token from
            # Supersetbot so release branches and PRs cannot write registry
            # cache while using --load validation builds.
            if DOCKERHUB_TOKEN= supersetbot docker \
              $PUSH_OR_LOAD \
              --preset "$BUILD_PRESET" \
              --context "$BUILD_CONTEXT" \
              --context-ref "$BUILD_CONTEXT_REF" \
              --extra-flags "$EXTRA_FLAGS" \
              $PLATFORM_ARG; then
              break
            fi
            if [ "$attempt" -eq 3 ]; then
              echo "::error::supersetbot docker build failed after 3 attempts"
              exit 1
            fi
            echo "::warning::Build attempt ${attempt} failed; retrying in 30s..."
            sleep 30
          done

      # in the context of push (using multi-platform build), we need to pull the image locally
      - name: Docker pull
        if: >-
          steps.publish_guard.outputs.publish == 'true' &&
          github.event_name == 'push' && github.ref == 'refs/heads/master'
        run: |
          for i in 1 2 3; do
            docker pull $IMAGE_TAG && break
            [ $i -lt 3 ] && sleep 30
          done

      - name: Print docker stats
        if: steps.publish_guard.outputs.publish == 'true'
        run: |
          echo "SHA: ${{ github.sha }}"
          echo "IMAGE: $IMAGE_TAG"
          docker images $IMAGE_TAG
          docker history $IMAGE_TAG

      # Scan the built image for known vulnerabilities and publish results
      # to the Security tab. Trivy did this until #38780 removed it: both
      # aquasecurity/trivy-action and the trivy binary itself were
      # compromised (twice) to steal GitHub Secrets from CI runs. Grype is a
      # different tool from a different maintainer with no shared supply
      # chain, and is already on the ASF Infra GitHub Actions allowlist.
      - name: Scan built image for vulnerabilities
        if: >-
          steps.publish_guard.outputs.publish == 'true' &&
          github.event_name == 'push' && github.ref == 'refs/heads/master' &&
          contains(fromJson('["superset", "lean"]'), matrix.build_preset)
        id: grype-scan
        # This step's own failure (e.g. a transient issue pulling the Grype
        # vulnerability DB) must not fail docker-build, matching the
        # informational fail-build: false below -- one is findings, the
        # other is the scan itself not completing.
        continue-on-error: true
        uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
        with:
          image: ${{ env.IMAGE_TAG }}
          output-format: sarif
          severity-cutoff: high
          only-fixed: true
          # Informational only, matching the prior Trivy setup: this
          # workflow does not gate merges on scan findings.
          fail-build: false

      - name: Upload vulnerability scan results to GitHub Security tab
        if: >-
          steps.publish_guard.outputs.publish == 'true' &&
          github.event_name == 'push' && github.ref == 'refs/heads/master' &&
          contains(fromJson('["superset", "lean"]'), matrix.build_preset) &&
          steps.grype-scan.outputs.sarif != ''
        continue-on-error: true
        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          sarif_file: ${{ steps.grype-scan.outputs.sarif }}
          # Both `superset` and `lean` are scanned now; without a distinct
          # category per preset they would land under the same code-scanning
          # entry and one build_preset's findings would overwrite the
          # other's, mirroring the per-language category in
          # codeql-analysis.yml.
          category: "docker-${{ matrix.build_preset }}"

      - name: WebSocket server smoke test
        if: >-
          steps.publish_guard.outputs.publish == 'true' &&
          contains(fromJson('["superset", "lean", "dev"]'), matrix.build_preset)
        shell: bash
        run: |
          # The realtime WebSocket server is bundled in the official image and
          # launched via an alternate entrypoint; verify the bundled Node runtime
          # starts it and it serves /health. (A JWT secret >= 32 bytes is required
          # or the server refuses to start; no Redis is needed for /health.)
          # All app-image presets are checked because docker-compose-non-dev.yml
          # runs the websocket service from the dev target.
          docker run -d --name superset-ws \
            -e JWT_SECRET="ci-smoke-test-secret-ci-smoke-test-secret" \
            -e PORT=8080 -p 8080:8080 \
            "$IMAGE_TAG" /app/docker/entrypoints/run-websocket.sh
          ok=""
          for _ in $(seq 1 20); do
            if curl -sf http://localhost:8080/health; then echo "ws /health OK"; ok=1; break; fi
            sleep 2
          done
          docker logs superset-ws || true
          docker rm -f superset-ws || true
          [ "$ok" = "1" ] || { echo "::error::websocket /health did not come up"; exit 1; }

      - name: docker-compose sanity check
        if: >-
          steps.publish_guard.outputs.publish == 'true' &&
          matrix.build_preset == 'dev'
        shell: bash
        env:
          BUILD_PRESET: ${{ matrix.build_preset }}
        run: |
          export SUPERSET_BUILD_TARGET=$BUILD_PRESET
          # This should reuse the CACHED image built in the previous steps
          docker compose build superset-init --build-arg DEV_MODE=false --build-arg INCLUDE_CHROMIUM=false
          docker compose up superset-init --exit-code-from superset-init

  docker-compose-image-tag:
    # Run this job only on pushes to master (not for PRs)
    # goal is to check that building the latest image works, not required for all PR pushes
    needs: changes
    if: github.event_name == 'push' && github.ref == 'refs/heads/master' && needs.changes.outputs.docker == 'true'
    runs-on: ubuntu-26.04
    timeout-minutes: 30
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Free up disk space
        shell: bash
        run: |
          # The sanity check rebuilds the image from scratch whenever the
          # registry cache image apache/superset-cache is unavailable, which
          # can exhaust the runner's root disk ("no space left on device").
          echo "Disk before cleanup:"; df -h /
          sudo rm -rf \
            /usr/share/dotnet \
            /usr/local/lib/android \
            /opt/ghc \
            /usr/local/.ghcup \
            /opt/hostedtoolcache/CodeQL \
            /usr/local/share/boost || true
          echo "Disk after cleanup:"; df -h /
      - name: Setup Docker Environment
        uses: $/.github/actions/setup-docker
        with:
          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
          build: "false"
          install-docker-compose: "true"
      - name: docker-compose sanity check
        shell: bash
        run: |
          docker compose -f docker-compose-image-tag.yml up superset-init --exit-code-from superset-init

  actions-timeline:
    needs: [docker-build, docker-compose-image-tag]
    if: always()
    runs-on: ubuntu-slim
    permissions:
      actions: read
    steps:
      - uses: Kesin11/actions-timeline@460b1f8a750077029ad3589824d371b200e91dcf # v3.2.1
        with:
          expand-composite-actions: true