KAFKA-19686 : release - Trigger docker builds with rc and release by muralibasani · Pull Request #21963 · apache/kafka

muralibasani · 2026-04-04T08:47:49Z

https://issues.apache.org/jira/browse/KAFKA-19686

How It Works

After the RC tag is pushed, the script prompts: "Trigger Docker image
build workflows via GitHub Actions?"

If the user accepts:

Collects the user's GitHub Personal Access Token (with step-by-step
generation instructions; token is saved in preferences for reuse)
Step 1 — Build & CVE scan: Triggers docker_build_and_test.yml for
both JVM and native images. Then asks the user to verify builds passed
with no CVEs. If CVEs are found (n), the user fixes the Dockerfiles
(docker/jvm/Dockerfile, docker/native/Dockerfile) and the script
re-triggers automatically. This loop continues until builds are clean.
Step 2 — RC release: Triggers docker_rc_release.yml for both JVM and
native, pushing RC images to DockerHub with the correct names
(apache/kafka:{rc_tag}, apache/kafka-native:{rc_tag}).

The entire Docker flow is optional — if the user declines the initial
prompt, the existing release flow is unchanged. No new dependencies were
added (only Python stdlib urllib).

Supports GITHUB_DRY_RUN=true (prints API calls without executing) and
GITHUB_REPO=user/fork (test against a personal fork)

Added a interactive test for docker flow. GITHUB_DRY_RUN=true python3
test_docker_trigger_interactive.py


release % GITHUB_DRY_RUN=true python3 test_docker_trigger_interactive.py
Using preferences from:
/Users/username/projects/others/kafka2/kafka/release/.release-settings.json
======================================================================
  Docker Workflow Trigger - Interactive Test
======================================================================

  Target repo  : apache/kafka    Dry-run mode : True

Enter release version (e.g. 4.3.0): 4.4.0  Enter RC number (e.g. 0): 0

  Release version : 4.4.0    RC tag          : 4.4.0-rc0    Dev branch
: 4.4

=== Docker Image Workflows ===
NOTE: GITHUB_DRY_RUN is enabled. No actual API calls will be made.
Trigger Docker image build workflows via GitHub Actions? (y/n): y
Assuming: github_token = fhkdskjfhsdakjfksjhgfdjsadgfjhdsagfjagsjfhgs

Step 1/2: Triggering Docker Build Test workflows for JVM and native
images...

--- Docker Build Test (jvm) ---
  Image type : jvm
  Branch/ref : 4.4
  Kafka URL  :
https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc0/kafka_2.13-4.4.0.tgz
Triggering workflow docker_build_and_test.yml on apache/kafka with
inputs: {"image_type": "jvm", "kafka_url":
"https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc0/kafka_2.13-4.4.0.tgz"}
[DRY RUN] POST
https://api.github.com/repos/apache/kafka/actions/workflows/docker_build_and_test.yml/dispatches
[DRY RUN] Body: {
  "ref": "4.4",
  "inputs": {
    "image_type": "jvm",
    "kafka_url":
"https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc0/kafka_2.13-4.4.0.tgz"
  }
}
Successfully triggered docker_build_and_test.yml
[DRY RUN] GET
https://api.github.com/repos/apache/kafka/actions/workflows/docker_build_and_test.yml/runs?per_page=1
  View run:
https://github.com/apache/kafka/actions/workflows/docker_build_and_test.yml

--- Docker Build Test (native) ---
  Image type : native
  Branch/ref : 4.4
  Kafka URL  :
https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc0/kafka_2.13-4.4.0.tgz
Triggering workflow docker_build_and_test.yml on apache/kafka with
inputs: {"image_type": "native", "kafka_url":
"https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc0/kafka_2.13-4.4.0.tgz"}
[DRY RUN] POST
https://api.github.com/repos/apache/kafka/actions/workflows/docker_build_and_test.yml/dispatches
[DRY RUN] Body: {
  "ref": "4.4",
  "inputs": {
    "image_type": "native",
    "kafka_url":
"https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc0/kafka_2.13-4.4.0.tgz"
  }
}
Successfully triggered docker_build_and_test.yml
[DRY RUN] GET
https://api.github.com/repos/apache/kafka/actions/workflows/docker_build_and_test.yml/runs?per_page=1
  View run:
https://github.com/apache/kafka/actions/workflows/docker_build_and_test.yml

Docker Build Test workflows triggered successfully for both JVM and
native images.

Please check the build results and CVE scan reports at:
https://github.com/apache/kafka/actions/workflows/docker_build_and_test.yml

Verify that:    1. Both JVM and native image builds succeeded    2. The
CVE scan reports show no CRITICAL or HIGH vulnerabilities    3. If CVEs
are found, update the Dockerfiles and re-trigger       Dockerfiles are
located at: docker/jvm/Dockerfile and docker/native/Dockerfile  Have the
builds passed with no CVEs? (n to re-trigger after fixing Dockerfiles)
(y/n): y

Step 2/2: Triggering Docker RC Release workflows for JVM and native
images...

--- Docker RC Release (jvm) ---
  Image type   : jvm
  Docker image : apache/kafka:4.4.0-rc0
  Branch/ref   : 4.4
  Kafka URL    :
https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc0/kafka_2.13-4.4.0.tgz
Triggering workflow docker_rc_release.yml on apache/kafka with inputs:
{"image_type": "jvm", "rc_docker_image": "apache/kafka:4.4.0-rc0",
"kafka_url":
"https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc0/kafka_2.13-4.4.0.tgz"}
[DRY RUN] POST
https://api.github.com/repos/apache/kafka/actions/workflows/docker_rc_release.yml/dispatches
[DRY RUN] Body: {
  "ref": "4.4",
  "inputs": {
    "image_type": "jvm",
    "rc_docker_image": "apache/kafka:4.4.0-rc0",
    "kafka_url":
"https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc0/kafka_2.13-4.4.0.tgz"
  }
}
Successfully triggered docker_rc_release.yml
[DRY RUN] GET
https://api.github.com/repos/apache/kafka/actions/workflows/docker_rc_release.yml/runs?per_page=1
  View run:
https://github.com/apache/kafka/actions/workflows/docker_rc_release.yml

--- Docker RC Release (native) ---
  Image type   : native
  Docker image : apache/kafka-native:4.4.0-rc0
  Branch/ref   : 4.4
  Kafka URL    :
https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc0/kafka_2.13-4.4.0.tgz
Triggering workflow docker_rc_release.yml on apache/kafka with inputs:
{"image_type": "native", "rc_docker_image":
"apache/kafka-native:4.4.0-rc0", "kafka_url":
"https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc0/kafka_2.13-4.4.0.tgz"}
[DRY RUN] POST
https://api.github.com/repos/apache/kafka/actions/workflows/docker_rc_release.yml/dispatches
[DRY RUN] Body: {
  "ref": "4.4",
  "inputs": {
    "image_type": "native",
    "rc_docker_image": "apache/kafka-native:4.4.0-rc0",
    "kafka_url":
"https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc0/kafka_2.13-4.4.0.tgz"
  }
}
Successfully triggered docker_rc_release.yml
[DRY RUN] GET
https://api.github.com/repos/apache/kafka/actions/workflows/docker_rc_release.yml/runs?per_page=1
  View run:
https://github.com/apache/kafka/actions/workflows/docker_rc_release.yml

Docker RC Release workflows triggered successfully for both JVM and
native images.

All Docker workflow runs can be monitored at:
https://github.com/apache/kafka/actions

Done.

mimaison

Thanks for looking into this. I left a few suggestions

mimaison · 2026-04-11T13:37:48Z

+if github.GITHUB_REPO != "apache/kafka":
+    print(f"NOTE: Using custom repository: {github.GITHUB_REPO}")
+if confirm("Trigger Docker image build workflows via GitHub Actions?"):
+    github_token = preferences.get('github_token', lambda: prompt("Enter your GitHub personal access token (with 'actions' scope): "))


Can we have some detail how to generate a token?

Added get token instructions to template, so when user starts the script, it prints them. https://github.com/apache/kafka/pull/21963/changes#diff-e0b37c325cc2eb8c49ab256555554edc05bf4e316f6d6d728169bdc50eba68c7R271

mimaison · 2026-04-11T13:41:02Z

+    for image_type in ["jvm", "native"]:
+        github.trigger_docker_build_test(github_token, dev_branch, image_type, kafka_url)
+    print("\nDocker Build Test workflows triggered successfully for both JVM and native images.")
+    if confirm("Also trigger Docker RC release workflows to push RC images to DockerHub?"):


Instead of asking whether to run this step or not, the prompt should ask to go check the builds have succeeded and the reports indicate no CVEs where found. If CVEs are found then we need to update the Dockerfiles and rerun until no CVEs are detected.

Once this is done, the following steps should be run.

Could we also print links to the builds this triggers?

Now the flow is in 2 steps.

Docker Build Test workflows with cve scan prompts

RC release

Added a test interactive script and updated pr description with it's execution. There we can see how are the prompts.

Build run urls are printed yes.

muralibasani · 2026-04-12T16:04:23Z

Thanks for looking into this. I left a few suggestions

@mimaison Thankyou for the review. Made the below changes.

I moved the docker workflows codeblocks to a def now making it more clear
Getting token instructions are added. Token is cached and reset insurctutions are there.
Added prompts for cve and passed builds
If user replies as 'n' for cve or build prompts, it will be in the loop
Added a definition for build run urls
A interactive test is added to simulate the flow

muralibasani · 2026-04-27T19:30:21Z

@mimaison possible for another review ?

muralibasani · 2026-05-02T13:27:54Z

@dejan2609 possible for you to review this one ?

github-actions Bot added the triage PRs from the community label Apr 4, 2026

muralibasani changed the title ~~KAFKA-19686 : Trigger docker builds with rc and release~~ KAFKA-19686 : release - Trigger docker builds with rc and release Apr 5, 2026

chia7712 added the ci-approved label Apr 7, 2026

mimaison reviewed Apr 11, 2026

View reviewed changes

github-actions Bot removed the triage PRs from the community label Apr 12, 2026

muralibasani added 3 commits April 12, 2026 17:40

Trigger docker builds with rc and release

120ced3

Adding tests and log statements

ad95170

From review

855a4c1

muralibasani force-pushed the KAFKA-19686 branch from 49324d3 to 855a4c1 Compare April 12, 2026 15:40

Updating instruction for token reset

cb8301b

muralibasani requested a review from mimaison April 13, 2026 14:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

KAFKA-19686 : release - Trigger docker builds with rc and release#21963

KAFKA-19686 : release - Trigger docker builds with rc and release#21963
muralibasani wants to merge 4 commits intoapache:trunkfrom
muralibasani:KAFKA-19686

muralibasani commented Apr 4, 2026 •

edited by github-actions Bot

Loading

Uh oh!

mimaison left a comment

Uh oh!

mimaison Apr 11, 2026

Uh oh!

muralibasani Apr 12, 2026

Uh oh!

mimaison Apr 11, 2026

Uh oh!

mimaison Apr 11, 2026

Uh oh!

muralibasani Apr 12, 2026

Uh oh!

muralibasani Apr 12, 2026

Uh oh!

muralibasani Apr 12, 2026

Uh oh!

muralibasani commented Apr 12, 2026 •

edited

Loading

Uh oh!

muralibasani commented Apr 27, 2026

Uh oh!

muralibasani commented May 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

muralibasani commented Apr 4, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mimaison left a comment

Choose a reason for hiding this comment

Uh oh!

mimaison Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

muralibasani Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

mimaison Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

mimaison Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

muralibasani Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

muralibasani Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

muralibasani Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

muralibasani commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

muralibasani commented Apr 27, 2026

Uh oh!

muralibasani commented May 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

muralibasani commented Apr 4, 2026 •

edited by github-actions Bot

Loading

muralibasani commented Apr 12, 2026 •

edited

Loading