From c62b20604fdd55aeeaed858017f5bcf3da2e15be Mon Sep 17 00:00:00 2001
From: Dennis Felsing <dennis@felsing.org>
Date: Fri, 19 Sep 2025 16:55:12 +0000
Subject: [PATCH] self-managed: Tag versions on dockerhub

naming scheme: self-managed-v25.2.6
---
 ci/deploy/docker.py                          | 24 ++++++++++++++--
 ci/publish-helm-charts/pipeline.template.yml | 11 +++++++
 misc/python/materialize/mzbuild.py           | 30 ++++++++++++++++++++
 3 files changed, 62 insertions(+), 3 deletions(-)

diff --git a/ci/deploy/docker.py b/ci/deploy/docker.py
index 063663c228b59..e3c01c7f43423 100644
--- a/ci/deploy/docker.py
+++ b/ci/deploy/docker.py
@@ -10,10 +10,10 @@
 import os
 from pathlib import Path
 
-from materialize import ci_util, git, mzbuild, ui
+from materialize import ci_util, git, mzbuild, spawn, ui
 from materialize.mz_version import MzVersion
 from materialize.rustc_flags import Sanitizer
-from materialize.version_list import get_all_mz_versions
+from materialize.version_list import get_all_mz_versions, get_self_managed_versions
 from materialize.xcompile import Arch
 
 
@@ -22,6 +22,12 @@ def main() -> None:
     bazel_remote_cache = os.getenv("CI_BAZEL_REMOTE_CACHE")
     bazel_lto = ui.env_is_truthy("CI_BAZEL_LTO")
 
+    ci_helm_chart_version = os.getenv("CI_HELM_CHART_VERSION")
+    ci_mz_version = os.getenv("CI_MZ_VERSION")
+
+    if ci_helm_chart_version and ci_mz_version:
+        spawn.runv(["git", "checkout", ci_mz_version])
+
     repos = [
         mzbuild.Repository(
             Path("."),
@@ -56,7 +62,19 @@ def include_image(image: mzbuild.Image) -> bool:
         for repo in repos
     ]
 
-    if buildkite_tag:
+    if ci_helm_chart_version and ci_mz_version:
+        # On tag builds, always tag the images as such.
+        mzbuild.tag_multiarch_images(
+            f"self-managed-{ci_helm_chart_version}", ci_mz_version, deps
+        )
+
+        version = MzVersion.parse_mz(ci_mz_version)
+        latest_version = max(
+            t for t in get_self_managed_versions() if t.prerelease is None
+        )
+        if version == latest_version:
+            mzbuild.tag_multiarch_images("latest-self-managed", ci_mz_version, deps)
+    elif buildkite_tag:
         # On tag builds, always tag the images as such.
         mzbuild.publish_multiarch_images(buildkite_tag, deps)
 
diff --git a/ci/publish-helm-charts/pipeline.template.yml b/ci/publish-helm-charts/pipeline.template.yml
index 0c708e69da343..e1fdffe8d0463 100644
--- a/ci/publish-helm-charts/pipeline.template.yml
+++ b/ci/publish-helm-charts/pipeline.template.yml
@@ -69,3 +69,14 @@ steps:
     timeout_in_minutes: 30
     agents:
       queue: linux-aarch64-small
+
+  - wait: ~
+
+  - id: docker-tag
+    label: Tag Versions on DockerHub
+    command: bin/ci-builder run stable bin/pyactivate -m ci.deploy.docker
+    timeout_in_minutes: 30
+    agents:
+      queue: linux-x86_64-small
+    concurrency: 1
+    concurrency_group: deploy/linux
diff --git a/misc/python/materialize/mzbuild.py b/misc/python/materialize/mzbuild.py
index 07928cd63d469..f1ebc20913c43 100644
--- a/misc/python/materialize/mzbuild.py
+++ b/misc/python/materialize/mzbuild.py
@@ -1589,3 +1589,33 @@ def publish_multiarch_images(
         ],
         stdin=markdown.encode(),
     )
+
+
+def tag_multiarch_images(
+    new_tag: str, previous_tag: str, dependency_sets: Iterable[Iterable[ResolvedImage]]
+) -> None:
+    """Publishes a set of docker images under a given tag."""
+    for images in zip(*dependency_sets):
+        names = set(image.image.name for image in images)
+        assert len(names) == 1, "dependency sets did not contain identical images"
+        new_name = images[0].image.docker_name(new_tag)
+
+        # Doesn't have tagged images
+        if images[0].image.name == "mz":
+            continue
+
+        previous_name = images[0].image.docker_name(previous_tag)
+        spawn.runv(["docker", "pull", previous_name])
+        spawn.runv(["docker", "tag", previous_name, new_name])
+        spawn.runv(["docker", "push", new_name])
+    print(f"--- Nofifying for tag {new_tag}")
+    markdown = f"""Pushed images with Docker tag `{new_tag}`"""
+    spawn.runv(
+        [
+            "buildkite-agent",
+            "annotate",
+            "--style=info",
+            f"--context=build-tags-{new_tag}",
+        ],
+        stdin=markdown.encode(),
+    )