sentry/.github/workflows/self-hosted.yml at 471b8a995197d5ae2a077875da48c3066d1896af · getsentry/sentry · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
name: self-hosted
on:
  push:
    branches:
      - master
      - releases/**
  pull_request:
  schedule:
    - cron: '0 3 * * *'
  workflow_dispatch:

# Cancel in progress workflows on pull_requests.
# https://docs.github.com/en/actions/using-jobs/using-concurrency#example-using-a-fallback-value
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

# hack for https://github.com/actions/cache/issues/810#issuecomment-1222550359
env:
  SEGMENT_DOWNLOAD_TIMEOUT_MINS: 3
  NODE_OPTIONS: '--max-old-space-size=4096'

jobs:
  self-hosted:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - os: ubuntu-24.04
            platform: amd64
          - os: ubuntu-24.04-arm
            platform: arm64
    name: self-hosted-${{ matrix.os }}-${{ matrix.platform }}
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4
        id: setup-node
        with:
          node-version-file: '.node-version'

      - uses: pnpm/action-setup@9b5745cdf0a2e8c2620f0746130f809adb911c19 # v4
      - uses: astral-sh/setup-uv@884ad927a57e558e7a70b92f2bccf9198a4be546 # v6
        with:
          version: '0.12.10'

      - uses: getsentry/action-setup-venv@5a80476d175edf56cb205b08bc58986fa99d1725 # v3.2.0
        with:
          cache-dependency-path: uv.lock
          # sentry.build.main has no external dependencies;
          # this is only to set up the venv with the correct
          # python version
          install-cmd: echo

      - name: Step configurations
        id: config
        run: |
          echo "webpack-path=.webpack_cache" >> "$GITHUB_OUTPUT"
          echo "WEBPACK_CACHE_PATH=.webpack_cache" >> "$GITHUB_ENV"

      - name: webpack cache
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ${{ steps.config.outputs.webpack-path }}
          key: ${{ runner.os }}-self-hosted-webpack-cache-${{ hashFiles('rsbuild.config.ts', 'pnpm-lock.yaml', 'package.json') }}

      - uses: ./.github/actions/node-modules-cache-paths
        id: workspace-cache

      - name: node_modules cache
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        id: nodemodulescache
        with:
          path: ${{ steps.workspace-cache.outputs.paths }}
          key: ${{ runner.os }}-${{ runner.arch }}-self-hosted-node-modules-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json', '.node-version') }}

      - name: Install Javascript Dependencies
        if: steps.nodemodulescache.outputs.cache-hit != 'true'
        run: pnpm install --frozen-lockfile --production

      - run: |
          python3 -m tools.fast_editable --path .
          python3 -m sentry.build.main

      - uses: getsentry/action-build-and-push-images@3714f354c0bc912a95221f193c9643cdba966e34
        if: github.event_name == 'push' || github.event_name == 'pull_request'
        with:
          image_name: 'sentry'
          platforms: linux/${{ matrix.platform }}
          dockerfile_path: 'self-hosted/Dockerfile'
          tag_suffix: -${{ matrix.platform }}
          build_args: |
            SOURCE_COMMIT=${{ github.sha }}
            TARGETARCH=${{ matrix.platform }}
          ghcr: true
          tag_nightly: false
          tag_latest: false
          # Restoring cached layers is slower than rebuilding them here.
          cache_from: ''
          cache_to: ''

      # getsentry/action-build-and-push-images only publishes on push, so the
      # daily and manual distroless builds use the Docker actions directly.
      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
        with:
          # Mirrored via getsentry/image-mirror to avoid Docker Hub rate limits.
          driver-opts: image=ghcr.io/getsentry/image-mirror-moby-buildkit:v0.33.1

      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
        if: (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && github.ref_name == 'master'
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
        with:
          context: .
          file: self-hosted/Dockerfile
          target: distroless
          platforms: linux/${{ matrix.platform }}
          build-args: |
            SOURCE_COMMIT=${{ github.sha }}
            TARGETARCH=${{ matrix.platform }}
          tags: ghcr.io/getsentry/sentry:${{ github.sha }}-distroless-${{ matrix.platform }}
          push: ${{ github.ref_name == 'master' }}

  assemble:
    needs: [self-hosted]
    if: ${{ (github.ref_name == 'master' || startsWith(github.ref_name, 'releases/')) && github.event_name != 'pull_request' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Docker Login
        run: docker login --username '${{ github.actor }}' --password-stdin ghcr.io <<< "$GHCR_TOKEN"
        env:
          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
        with:
          # Mirrored via getsentry/image-mirror to avoid Docker Hub rate limits.
          driver-opts: image=ghcr.io/getsentry/image-mirror-moby-buildkit:v0.33.1

      - name: Create multiplatform manifests
        if: github.event_name == 'push'
        run: |
          docker buildx imagetools create \
            --tag ghcr.io/getsentry/sentry:${{ github.sha }} \
            --tag ghcr.io/getsentry/sentry:nightly \
            ghcr.io/getsentry/sentry:${{ github.sha }}-amd64 \
            ghcr.io/getsentry/sentry:${{ github.sha }}-arm64

      - name: Create distroless multiplatform manifests
        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
        run: |
          docker buildx imagetools create \
            --tag ghcr.io/getsentry/sentry:${{ github.sha }}-distroless \
            --tag ghcr.io/getsentry/sentry:nightly-distroless \
            ghcr.io/getsentry/sentry:${{ github.sha }}-distroless-amd64 \
            ghcr.io/getsentry/sentry:${{ github.sha }}-distroless-arm64