ci(gateway): add Docker Hub publish workflow (wetransform pool-loss image)

[morch23mj]

What

Adds .github/workflows/build_push_dockerhub.yml — a wetransform-internal, dispatch-only workflow that builds a single-arch (amd64, our EKS node arch) DocumentDB gateway image for one PG version, smoke-tests it, and publishes it to Docker Hub wetransform/documentdb-local (our first-party registry).

Kept separate from the upstream GHCR build_gateway.yml (which builds every arch/PG combo and cosign-signs) so upstream merges stay conflict-free. Touches nothing else.

Why into main

GitHub only makes a workflow_dispatch workflow runnable if it exists on the default branch. This carries only the workflow file.

Heads-up on merging

Merging pushes to main, triggering one run of the upstream build_gateway.yml — harmless: on a plain push its push/manifest/cosign steps are gated off, so it just builds + smoke-tests and publishes nothing.

After merge — publishing the patched image (0.118)

The fix and the image are consolidated on the 0.118 engine (main). So:

1. Merge this PR and the fix PR fix(gateway): keep last-known-good config when pg_settings read fails #2 (fix(gateway): keep last-known-good config when pg_settings read fails) into main. Now main has both the workflow and the fix.
2. Add repo secrets DOCKERHUB_USERNAME and DOCKERHUB_TOKEN (push rights to wetransform/).
3. Dispatch (build ref = main, which now carries the fix):

   gh workflow run build_push_dockerhub.yml --repo wetransform/documentdb \
     --ref main -f image_tag=0.118-poolfix -f pg_version=17 -f push_image=true
   

4. Take the printed digest → pin it in hale-connect-dev PR #2000 (wetransform/documentdb-local:0.118-poolfix).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a new GitHub Actions workflow to support wetransform-internal, manual publishing of a single-architecture (linux/amd64) documentdb-local gateway image to Docker Hub, including a basic runtime smoke test and printing an immutable digest for pinning.

Changes:

• Introduces a workflow_dispatch-only pipeline to build the Debian extension package, build the documentdb-local Docker image, and run a startup + mongosh smoke test.
• Adds optional Docker Hub login/push steps gated by an input flag, plus a post-push digest printout for deployment pinning.

Suppressed comments (2)

.github/workflows/build_push_dockerhub.yml:50

• Unquoted ${{ inputs.pg_version }} is interpolated directly into a shell command, which allows it to be parsed as additional arguments. Quote it to ensure it is treated as a single value; also pass --no-dbgsym to avoid building debug-symbol packages that this workflow never uses.

          ./packaging/build_packages.sh --os deb13 --pg ${{ inputs.pg_version }} --output-dir downloaded-artifacts

.github/workflows/build_push_dockerhub.yml:61

• inputs.pg_version is interpolated into the docker build command unquoted; if the value ever contains spaces it will be parsed as additional CLI args. Quote the build-arg value to keep it a single argument.

            --build-arg POSTGRES_VERSION=${{ inputs.pg_version }} \

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[morch23mj]

Thanks — both addressed in e7ebdc8:

1. pg_version injection: now a constrained choice input (15/16/17/18). Also bound image_tag/pg_version to job-level env and reference them as "$IMAGE_TAG"/"$PG_VERSION" in the run scripts, so no input is interpolated directly into shell. The Docker Hub login now reads the token from step env instead of the command line.
2. Non-deterministic .deb selection: replaced ls … | head -1 with the array-collect + "exactly one non-dbgsym .deb, else fail" check from documentdb_local_image_build_test.yml, and added --no-dbgsym to the package build.

[morch23mj]

Superseded: the Docker build/publish now lives in the private wetransform/documentdb-docker repo (submodules this fork). Closing; build logic relocated there.