ever-gauzy/.github/workflows/docker-build-publish-mcp-auth-demo.yml

name: Build and Publish Gauzy MCP Auth Image Demo

on:
  push:
    branches:
      - develop
      - temp

permissions:
  contents: read
  packages: write

concurrency:
  # One group PER WORKFLOW (never a group shared across the six non-prod image builds:
  # that shared `gauzy-docker-build` group did not queue them, it STARVED them — GitHub
  # keeps exactly one pending run per group, so an unrelated workflow's run cancelled
  # whichever run was waiting, and environments silently kept serving their old image).
  #
  # Within this workflow the newest commit wins, matching the prod image builds. The
  # trade-off is deliberate: an intermediate version tag can end up without an image,
  # which is inert here because demo/stage deploy from `:latest` and only the release
  # that actually ships needs its own tagged image. The alternative — letting a
  # superseded build run for three hours on a fleet where one install takes 2-3 h —
  # delays the image that IS wanted by exactly that long.
  group: gauzy-docker-build-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
# docker/build-push-action uploads a build record artifact and a job summary for every build.
# The record holds every build-arg value in plain text, and on a public repo anyone signed in to
# GitHub can download it, so neither is produced. (BuildKit `secrets:` are never recorded.)
env:
  DOCKER_BUILD_RECORD_UPLOAD: false
  DOCKER_BUILD_SUMMARY: false

jobs:
  gauzy-mcp-auth:
    runs-on: ${{ vars.RUNNER_LINUX_X64_8 || 'ubuntu-latest' }}
    timeout-minutes: 300
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          driver: docker

      - name: Build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./.deploy/mcp-auth/Dockerfile
          load: true
          platforms: linux/amd64
          tags: |
            ghcr.io/ever-co/gauzy-mcp-auth-demo:latest
            everco/gauzy-mcp-auth-demo:latest
            registry.digitalocean.com/ever/gauzy-mcp-auth-demo:latest
          cache-from: type=registry,ref=ghcr.io/ever-co/gauzy-mcp-auth-demo:latest
          cache-to: type=inline
          build-args: |
            NODE_ENV=production
            VERDACCIO_REGISTRY=${{ vars.VERDACCIO_REGISTRY }}
            NX_CLOUD_ACCESS_TOKEN=${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
            NX_BRANCH=${{ github.ref_name }}
          # VERDACCIO_TOKEN is a BuildKit build SECRET, never a build-arg: build-args are recorded
          # in the image config blob and these ghcr packages are public, so a build-arg is readable
          # via `docker history`. See the header on .deploy/mcp*/Dockerfile.
          secrets: |
            VERDACCIO_TOKEN=${{ secrets.VERDACCIO_TOKEN }}

      - name: Docker images list
        run: |
          sudo docker image list

      - name: Login to DockerHub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Push to Docker Hub Registry
        run: |
          docker push everco/gauzy-mcp-auth-demo:latest

      - name: Install doctl
        if: ${{ vars.DO_ENABLED == 'true' }}
        uses: digitalocean/action-doctl@v2
        with:
          token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}

      - name: Log in to DigitalOcean Container Registry with short-lived credentials
        if: ${{ vars.DO_ENABLED == 'true' }}
        run: doctl registry login --expiry-seconds 3600

      - name: Push to DigitalOcean Registry
        if: ${{ vars.DO_ENABLED == 'true' }}
        run: |
          docker push registry.digitalocean.com/ever/gauzy-mcp-auth-demo:latest

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push to Github Registry
        run: |
          docker push ghcr.io/ever-co/gauzy-mcp-auth-demo:latest

    #   - name: Login to CW Container Registry
    #     uses: docker/login-action@v4
    #     with:
    #       registry: ${{ secrets.CW_DOCKER_REGISTRY }}
    #       username: ${{ secrets.CW_DOCKER_USER }}
    #       password: ${{ secrets.CW_DOCKER_USER_PASSWORD }}

    #     - name: Push to CW Registry
    #     run: |
    #         docker push ${{ secrets.CW_DOCKER_REGISTRY }}/ever-co/gauzy-mcp-auth:latest