feat(infra): Publish Superset docker image on pushes to main

[martyngigg]

Summary by CodeRabbit

• Chores
  • Enhanced release management by restricting Docker image publishing and artifact attestation to the main branch only, ensuring controlled and stable deployment processes.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

The Docker Superset workflow configuration was modified to conditionally control image publishing. The PUBLISH variable is now set based on the current git branch, restricting publishing and attestation operations to the main branch only.

Changes

Cohort / File(s)	Summary
Docker workflow configuration \.github/workflows/docker-superset\.yml	Replaced constant PUBLISH flag with conditional branch logic to restrict image publishing and attestation to the main branch only

Poem

🐰 Branch protection, oh what cheer!
Publishing gates are crystal clear,
Main branch only gets the key,
To build and push for all to see,
Workflow wisdom, wild and free! 🚀

Pre-merge checks

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: conditional Docker image publishing for Superset based on the main branch.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

.github/workflows/docker-superset.yml (1)

23-23: Excellent change to enable conditional publishing!

The logic correctly restricts publishing to the main branch. However, the expression can be simplified since the comparison already returns a boolean.

Apply this diff to simplify the expression:

-  PUBLISH: ${{ github.ref == 'refs/heads/main' && true || false }}
+  PUBLISH: ${{ github.ref == 'refs/heads/main' }}

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

📥 Commits

Reviewing files that changed from the base of the PR and between 8ecf438 and 90be5e4.

📒 Files selected for processing (1)

• .github/workflows/docker-superset.yml (1 hunks)

🔇 Additional comments (1)

.github/workflows/docker-superset.yml (1)

49-61: LGTM! Proper use of conditional publishing.

The PUBLISH variable is correctly used to control both image pushing (line 49) and attestation publishing (line 61). This ensures that:

• On pull requests: images are built for validation but not published
• On pushes to main: images are built, published, and attested

This is the recommended pattern for secure image publishing in GitHub Actions.