From 0c21c81e66646f9b5f38845c65d038c7c722ca8a Mon Sep 17 00:00:00 2001
From: bndw <benwoodward@boaweb.com>
Date: Mon, 25 Sep 2017 22:11:01 -0700
Subject: [PATCH] CI: Publish tags to Dockerhub

Signed-off-by: bndw <benjamindwoodward@gmail.com>
---
 .circleci/config.yml |  7 ++++++-
 ci/docker_push.sh    |  2 +-
 ci/docker_tag.sh     | 24 ++++++++++++++++++++++++
 3 files changed, 31 insertions(+), 2 deletions(-)
 create mode 100755 ci/docker_tag.sh

diff --git a/.circleci/config.yml b/.circleci/config.yml
index bab2cba52827b..e389f15e129bf 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -13,6 +13,8 @@ jobs:
        - run: ci/do_circle_ci.sh bazel.release
        - setup_remote_docker
        - run: ci/docker_push.sh
+       - deploy:
+           command: ci/docker_tag.sh
    asan:
      docker:
        - image: lyft/envoy-build:7480d2a53726b6389380d741f8a7e7b74a990133
@@ -79,7 +81,10 @@ workflows:
   version: 2
   all:
     jobs:
-      - release
+      - release:
+          filters:
+            tags:
+              only: /^v.*/
       - asan
       - tsan
       - coverage
diff --git a/ci/docker_push.sh b/ci/docker_push.sh
index 3d0a5e42d6918..ce4671576b21d 100755
--- a/ci/docker_push.sh
+++ b/ci/docker_push.sh
@@ -13,7 +13,7 @@ do
        want_push='true'
    fi
 done
-if [ -z "$CIRCLE_PULL_REQUEST" ] && [ "$want_push" == "true" ]
+if [ -z "$CIRCLE_PULL_REQUEST" ] && [ -z "$CIRCLE_TAG" ] && [ "$want_push" == "true" ]
 then
    # TODO(mattklein123): Currently we are doing this push in the context of the release job which
    # happens inside of our build image. We should switch to using Circle caching so each of these
diff --git a/ci/docker_tag.sh b/ci/docker_tag.sh
new file mode 100755
index 0000000000000..94aed200a8d94
--- /dev/null
+++ b/ci/docker_tag.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# Do not ever set -x here, it is a security hazard as it will place the credentials below in the
+# Travis logs.
+set -e
+
+if [ -n "$CIRCLE_TAG" ]
+then
+   docker login -u "$DOCKERHUB_USERNAME" -p "$DOCKERHUB_PASSWORD"
+
+   docker pull lyft/envoy:"$CIRCLE_SHA1"
+   docker tag lyft/envoy:"$CIRCLE_SHA1" lyft/envoy:"$CIRCLE_TAG"
+   docker push lyft/envoy:"$CIRCLE_TAG"
+
+   docker pull lyft/envoy-alpine:"$CIRCLE_SHA1"
+   docker tag lyft/envoy-alpine:"$CIRCLE_SHA1" lyft/envoy-alpine:"$CIRCLE_TAG"
+   docker push lyft/envoy-alpine:"$CIRCLE_TAG"
+
+   docker pull lyft/envoy-alpine-debug:"$CIRCLE_SHA1"
+   docker tag lyft/envoy-alpine-debug:"$CIRCLE_SHA1" lyft/envoy-alpine-debug:"$CIRCLE_TAG"
+   docker push lyft/envoy-alpine-debug:"$CIRCLE_TAG"
+else
+   echo 'Ignoring non-tag event for docker tag.'
+fi