Add docker support to distribute sub-action (#62)

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: igalsi-t

README.md

@@ -191,7 +191,9 @@ Use `[LATEST]` for "give me whatever the most recent build is" workflows (consum
 
 ### Distribute
 
-Make a generic artifact version publicly downloadable — anyone with the link can grab it without a Fly account. Idempotent: calling again returns the same public URL.
+Make an artifact version publicly downloadable — anyone with the link can grab it without a Fly account. Idempotent: calling again returns the same public URL. Supported package types: **generic**, **docker**.
+
+#### Generic
 
 ```yaml
 - name: Distribute the artifact
@@ -201,13 +203,7 @@ Make a generic artifact version publicly downloadable — anyone with the link c
     version: '1.0.0'
 ```
 
-| Input | Description | Required | Default |
-| --- | --- | --- | --- |
-| `name` | Package name | Yes | |
-| `version` | Package version to make public (concrete; `[LATEST]` not supported here) | Yes | |
-| `type` | Artifact type. Currently only `generic` is supported. | No | `generic` |
-
-After distribute succeeds, consumers can fetch the file anonymously:
+After distribute succeeds, consumers fetch the file anonymously:
 
 ```bash
 # Specific version
@@ -217,9 +213,50 @@ curl -O https://{tenant}.jfrog.io/public/generic/my-app/1.0.0/app.zip
 curl -LO https://{tenant}.jfrog.io/public/generic/my-app/[LATEST]/app.zip
 ```
 
-The public URL pattern is `https://{tenant}.jfrog.io/public/generic/{name}/{version}/{file}`. On the public path `[LATEST]` is resolved server-side via `302` + `Cache-Control: no-store`, so consumers always see the latest published version (CDN never serves a stale resolution). The authenticated `download` sub-action also resolves `[LATEST]` — via inline proxy (no redirect) — see [`[LATEST]` resolution](#latest-resolution) above.
+The generic public URL pattern is `https://{tenant}.jfrog.io/public/generic/{name}/{version}/{file}`.
+
+#### Docker
+
+The image must already have been pushed to the tenant's `docker-local` repo (via `docker push {tenant}.jfrog.io/docker/...` after `jfrog/fly-action` configured the registry). The distribute step copies the manifest and layer blobs into the `{tenant}-docker-public` repo so anonymous pulls can resolve them.
+
+```yaml
+- name: Distribute the docker image
+  uses: jfrog/fly-action/distribute@v1
+  with:
+    name: myorg/my-image      # image name without registry host or `docker-public/` prefix
+    version: '1.0.0'          # image tag
+    type: docker
+```
+
+After distribute succeeds, consumers pull the image anonymously:
+
+```bash
+# Specific tag
+docker pull {tenant}.jfrog.io/docker-public/myorg/my-image:1.0.0
+
+# Latest tag (server 302-redirects to the newest distributed tag)
+docker pull {tenant}.jfrog.io/docker-public/myorg/my-image:[LATEST]
+```
+
+The docker public URL pattern is `https://{tenant}.jfrog.io/v2/docker-public/{image}/manifests/{tag}` (OCI registry API). The `/v2/docker-public/*` namespace is read-only — pushes always go through the authenticated distribute step above, never anonymously.
+
+#### Distribute inputs
+
+| Input | Description | Required | Default |
+| --- | --- | --- | --- |
+| `name` | Package name (for docker, the image name without the registry host or `docker-public/` prefix; nested repos like `myorg/myimg` are supported) | Yes | |
+| `version` | Package version to make public (for docker, the image tag). Concrete only — `[LATEST]` is not accepted here. | Yes | |
+| `type` | Artifact type. Supported values: `generic`, `docker`. | No | `generic` |
+
+#### `[LATEST]` on the public path
+
+`[LATEST]` is resolved server-side on **both** public URL shapes (generic `/public/generic/...` and docker `/v2/docker-public/...`) via `302 Found` + `Cache-Control: no-store`, so consumers always see the latest distributed version and the CDN never pins a stale resolution. The authenticated `download` sub-action also resolves `[LATEST]` — via inline proxy, no redirect — see [`[LATEST]` resolution](#latest-resolution) above.
+
+`[LATEST]` is **download-only**. The Fly server rejects it with `400 Bad Request` on `distribute` (and `upload`) so a literal `[LATEST]`-named folder or tag can never poison future resolution.
+
+#### Distribute outputs
 
-The `results` output is a JSON array with one entry: `{package_name, package_version, package_type, public_url, download_url, download_count}`. Multiple distribute steps in one job accumulate in the job summary's _Distributed Artifacts_ table.
+The `results` output is a JSON array with one entry: `{package_name, package_version, package_type, public_url, download_url, download_count, files?}`. Docker distributions also surface a `Pull:` line in the step logs with the ready-to-paste `docker pull …` command. Multiple distribute steps in one job accumulate in the job summary's _Distributed Artifacts_ table.
 
 ### Go Publish
 

distribute/action.yml

@@ -1,16 +1,16 @@
 name: 'Fly Distribute'
-description: 'Make a generic artifact version publicly downloadable. After distribute, anyone can fetch the file at https://{tenant}.jfrog.io/public/generic/{name}/{version}/{file} (no auth). Use [LATEST] in the public URL to always get the newest distributed version. Requires jfrog/fly-action to have run first for authentication.'
+description: 'Make an artifact version publicly downloadable. After distribute, consumers can fetch generic artifacts at https://{tenant}.jfrog.io/public/generic/{name}/{version}/{file} (no auth) or pull docker images with `docker pull {tenant}.jfrog.io/docker-public/{image}:{tag}` (no auth). Use [LATEST] in either URL shape to always get the newest distributed version. Requires jfrog/fly-action to have run first for authentication.'
 author: 'JFrog'
 
 inputs:
   name:
-    description: 'Artifact name'
+    description: 'Artifact name (for docker, the image name without the registry host or `docker-public/` prefix; nested repos like `myorg/myimg` are supported)'
     required: true
   version:
-    description: 'Artifact version'
+    description: 'Artifact version (for docker, the image tag)'
     required: true
   type:
-    description: 'Artifact type. Currently only "generic" is supported.'
+    description: 'Artifact type. Supported values: `generic`, `docker`.'
     required: false
     default: 'generic'
 

lib/distribute.js

@@ -61,9 +61,46 @@ export async function distributeArtifact(
     );
     core.info(`   Public URL: ${parsed.public_url}`);
     core.info(`   Download:   ${parsed.download_url}`);
+    const pullCommand = buildDockerPullCommand(parsed);
+    if (pullCommand) {
+      core.info(`   Pull:       ${pullCommand}`);
+    }
 
     return parsed;
   } finally {
     httpClient.dispose();
   }
 }
+
+/**
+ * Returns the `docker pull …` reference for a Docker distribution, or `null`
+ * for non-Docker types or when `public_url` doesn't match the expected
+ * `/v2/{repo}/{image}` shape. Surfacing the pull command is the most useful
+ * line for a Docker consumer — `public_url` alone is the OCI namespace, not a
+ * command they can paste, and `download_url` resolves to the JSON manifest.
+ *
+ * Exported so the job-summary renderer can reuse the same derivation and
+ * stay consistent with the step log line (no drift between sources).
+ */
+export function buildDockerPullCommand(
+  response: DistributeResponse,
+): string | null {
+  if (response.package_type !== "docker") {
+    return null;
+  }
+  let parsedUrl: URL;
+  try {
+    parsedUrl = new URL(response.public_url);
+  } catch {
+    return null;
+  }
+  // public_url is `/v2/{repo}/{image}` per the Fly OCI public namespace
+  // contract. Strip the OCI `/v2/` prefix so the result is the docker
+  // reference `{host}/{repo}/{image}:{tag}`. If the prefix is missing the
+  // backend changed shape — skip rather than emit a misleading command.
+  const pathWithoutV2 = parsedUrl.pathname.replace(/^\/v2\//, "/");
+  if (pathWithoutV2 === parsedUrl.pathname) {
+    return null;
+  }
+  return `docker pull ${parsedUrl.host}${pathWithoutV2}:${response.package_version}`;
+}

lib/post.js

@@ -130,6 +130,60 @@ describe("runDistribute", () => {
     expect(body.package_type).toBe("generic");
   });
 
+  it("distributes a docker image and logs the pull command", async () => {
+    mockInputs({ name: "myorg/my-image", version: "1.0.0", type: "docker" });
+
+    const dockerResponse: DistributeResponse = {
+      package_name: "myorg/my-image",
+      package_version: "1.0.0",
+      package_type: "docker",
+      public_url: "https://flyjfrog.jfrog.io/v2/docker-public/myorg/my-image",
+      download_url:
+        "https://flyjfrog.jfrog.io/v2/docker-public/myorg/my-image/manifests/1.0.0",
+      download_count: 0,
+      files: [
+        {
+          package_name: "myorg/my-image",
+          package_version: "1.0.0",
+          file_name: "manifest.json",
+          sha256: "abcd",
+          download_count: 0,
+        },
+      ],
+    };
+
+    mockPost.mockResolvedValue({
+      message: { statusCode: 200 },
+      readBody: () => Promise.resolve(JSON.stringify(dockerResponse)),
+    });
+
+    await runDistribute();
+
+    expect(core.setFailed).not.toHaveBeenCalled();
+    // Payload carries package_type=docker through to the backend unchanged.
+    const body = JSON.parse(mockPost.mock.calls[0][1]);
+    expect(body.package_type).toBe("docker");
+    // Pull command is derived from public_url + version, with `/v2/` stripped
+    // so consumers can paste it into a shell.
+    expect(core.info).toHaveBeenCalledWith(
+      "   Pull:       docker pull flyjfrog.jfrog.io/docker-public/myorg/my-image:1.0.0",
+    );
+  });
+
+  it("does not log a pull command for non-docker distributions", async () => {
+    mockInputs({ name: "my-app", version: "1.0.0", type: "generic" });
+
+    mockPost.mockResolvedValue({
+      message: { statusCode: 200 },
+      readBody: () => Promise.resolve(JSON.stringify(MOCK_RESPONSE)),
+    });
+
+    await runDistribute();
+
+    const infoCalls = vi.mocked(core.info).mock.calls.map((c) => c[0]);
+    expect(infoCalls.some((line) => line.includes("Pull:"))).toBe(false);
+  });
+
   it("accumulates results across multiple runDistribute invocations", async () => {
     const response2: DistributeResponse = {
       ...MOCK_RESPONSE,

src/distribute-core.ts

@@ -17,6 +17,11 @@ export async function runDistribute(): Promise<void> {
   try {
     const name = core.getInput(INPUT_NAME, { required: true });
     const version = core.getInput(INPUT_VERSION, { required: true });
+    // NOTE: `type` is forwarded to fly-service without a client-side allowlist
+    // check on purpose — the backend is the single source of truth for which
+    // package types are publicly distributable and returns a typed 400 for
+    // unsupported values. Keeping the allowlist server-side prevents the
+    // action and fly-service from drifting (e.g. when Phase 3 wires helm).
     const packageType = core.getInput(INPUT_DISTRIBUTE_TYPE) || "generic";
 
     const { url, token } = getAuthEnv();

src/distribute.spec.ts

@@ -485,6 +485,61 @@ describe("buildDistributedTable", () => {
     expect(table).toContain("my\\|app");
     expect(table).toContain("1\\|0");
   });
+
+  it("renders docker rows with a `docker pull …` command instead of the manifest URL", () => {
+    const manifestUrl =
+      "https://flyjfrog.jfrog.io/v2/docker-public/myorg/my-image/manifests/1.0.0";
+    const results: DistributeResponse[] = [
+      {
+        package_name: "myorg/my-image",
+        package_version: "1.0.0",
+        package_type: "docker",
+        public_url: "https://flyjfrog.jfrog.io/v2/docker-public/myorg/my-image",
+        download_url: manifestUrl,
+        download_count: 0,
+      },
+    ];
+
+    const table = buildDistributedTable(results);
+    // Inline-code pull command derived from public_url + version. Backticks
+    // signal "command, not URL" in the rendered markdown table.
+    expect(table).toContain(
+      "`docker pull flyjfrog.jfrog.io/docker-public/myorg/my-image:1.0.0`",
+    );
+    // Manifest URL must not leak into the cell — clicking it returns JSON.
+    expect(table).not.toContain(`[${manifestUrl}](${manifestUrl})`);
+  });
+
+  it("mixes generic and docker rows: each renders its own cell shape", () => {
+    const genericDownload =
+      "https://fly.example.com/public/generic/tenant/my-app/1.0.0/my-app.tar.gz";
+    const results: DistributeResponse[] = [
+      {
+        package_name: "my-app",
+        package_version: "1.0.0",
+        package_type: "generic",
+        public_url:
+          "https://fly.example.com/public/generic/tenant/my-app/1.0.0",
+        download_url: genericDownload,
+        download_count: 0,
+      },
+      {
+        package_name: "myorg/my-image",
+        package_version: "2.0.0",
+        package_type: "docker",
+        public_url: "https://flyjfrog.jfrog.io/v2/docker-public/myorg/my-image",
+        download_url:
+          "https://flyjfrog.jfrog.io/v2/docker-public/myorg/my-image/manifests/2.0.0",
+        download_count: 0,
+      },
+    ];
+
+    const table = buildDistributedTable(results);
+    expect(table).toContain(`[${genericDownload}](${genericDownload})`);
+    expect(table).toContain(
+      "`docker pull flyjfrog.jfrog.io/docker-public/myorg/my-image:2.0.0`",
+    );
+  });
 });
 
 describe("buildArtifactsTable", () => {

src/distribute.ts

@@ -15,6 +15,7 @@ import {
 } from "./constants";
 import { getErrorMessage } from "./utils";
 import { resolveAndDedup, resolveArtifact, dedupKey } from "./artifact-path";
+import { buildDockerPullCommand } from "./distribute-core";
 
 const escPipe = (s: string): string => s.replace(/\|/g, "\\|");
 
@@ -108,11 +109,26 @@ export function buildDistributedTable(results: DistributeResponse[]): string {
   const header = "| Package | Version | Download URL |\n| --- | --- | --- |";
   const rows = results.map(
     (r) =>
-      `| ${escPipe(r.package_name)} | ${escPipe(r.package_version)} | [${escPipe(r.download_url)}](${r.download_url}) |`,
+      `| ${escPipe(r.package_name)} | ${escPipe(r.package_version)} | ${renderDistributedDownloadCell(r)} |`,
   );
   return `\n### 🌐 Distributed Artifacts\n\n${header}\n${rows.join("\n")}\n`;
 }
 
+/**
+ * Builds the third-column cell for a distributed-artifacts row. Generic rows
+ * show a clickable link to the file. Docker rows show the `docker pull …`
+ * command in inline code: the raw `download_url` for docker points at the
+ * OCI manifest JSON, which is useless to skim in a job summary — consumers
+ * actually need a paste-ready pull command.
+ */
+function renderDistributedDownloadCell(r: DistributeResponse): string {
+  const pullCommand = buildDockerPullCommand(r);
+  if (pullCommand) {
+    return `\`${escPipe(pullCommand)}\``;
+  }
+  return `[${escPipe(r.download_url)}](${r.download_url})`;
+}
+
 export function buildTransfersTable(entries: TransferSummaryEntry[]): string {
   if (entries.length === 0) return "";