_build-cloud.yml

# Internal reusable workflow for building a non-OSS ("cloud") Docker image and
# pushing it to Amazon ECR.
name: Build Cloud Image

on:
  workflow_call:
    inputs:
      environment:
        description: "GitHub Environment supplying the Sentry vars/secrets. Also scopes the OIDC subject used to assume the ECR push role."
        required: true
        type: string
      git_ref:
        description: "Git ref to checkout and build"
        required: true
        type: string
      docker_tags:
        description: "Docker tags configuration for docker/metadata-action"
        required: true
        type: string
      aws_region:
        description: "Region the ECR repository lives in"
        required: false
        type: string
        default: us-west-1
      require_sentry:
        description: "Require complete Sentry build configuration and source-map upload credentials"
        required: false
        type: boolean
        default: true

jobs:
  build:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    permissions:
      contents: read
      # Required to request the OIDC token that assumes the AWS role.
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.git_ref }}
          submodules: "true"
          fetch-depth: 0
          # Nothing after checkout talks to the remote, so don't leave the token
          # behind in the workspace's .git/config.
          persist-credentials: false

      - name: Resolve build commit SHA
        id: commit
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Validate environment configuration
        env:
          ENVIRONMENT: ${{ inputs.environment }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          AWS_ECR_ROLE_ARN: ${{ vars.AWS_ECR_ROLE_ARN }}
          NEXT_PUBLIC_SENTRY_ENVIRONMENT: ${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
          NEXT_PUBLIC_SENTRY_WEBAPP_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
          NEXT_PUBLIC_SENTRY_BACKEND_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
          SENTRY_ORG: ${{ vars.SENTRY_ORG }}
          SENTRY_WEBAPP_PROJECT: ${{ vars.SENTRY_WEBAPP_PROJECT }}
          SENTRY_BACKEND_PROJECT: ${{ vars.SENTRY_BACKEND_PROJECT }}
          REQUIRE_SENTRY: ${{ inputs.require_sentry }}
        run: |
          missing=0
          required_names="AWS_ECR_ROLE_ARN"
          if [ "$REQUIRE_SENTRY" = "true" ]; then
            required_names="$required_names SENTRY_AUTH_TOKEN NEXT_PUBLIC_SENTRY_ENVIRONMENT NEXT_PUBLIC_SENTRY_WEBAPP_DSN NEXT_PUBLIC_SENTRY_BACKEND_DSN SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT"
          fi
          for name in $required_names; do
            if [ -z "${!name}" ]; then
              echo "::error::${name} is not set on the '${ENVIRONMENT}' environment (or the repository)."
              missing=1
            else
              echo "ok: ${name}"
            fi
          done
          if [ "$missing" -ne 0 ]; then
            echo "::error::Refusing to build: required environment configuration is missing."
            exit 1
          fi
          if [ "$REQUIRE_SENTRY" != "true" ]; then
            echo "Sentry wiring is intentionally disabled for the isolated internal demo image."
          fi

      - name: Verify internal GitHub OIDC identity
        if: inputs.environment == 'internal'
        env:
          EXPECTED_OIDC_SUBJECT: repo:sourcebot-dev/sourcebot:environment:internal
        run: |
          response=$(curl --fail --silent --show-error \
            -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sts.amazonaws.com")
          token=$(jq -r '.value' <<<"$response")
          OIDC_TOKEN="$token" node - <<'NODE'
          const claims = JSON.parse(Buffer.from(process.env.OIDC_TOKEN.split('.')[1], 'base64url'));
          console.log(JSON.stringify({
            sub: claims.sub,
            aud: claims.aud,
            repository: claims.repository,
            repository_id: claims.repository_id,
            job_workflow_ref: claims.job_workflow_ref,
          }, null, 2));
          if (claims.sub !== process.env.EXPECTED_OIDC_SUBJECT) {
            console.error(`Unexpected OIDC subject: ${claims.sub}`);
            process.exit(1);
          }
          NODE

      - name: Check Prisma migrations
        uses: ./.github/actions/check-prisma-migrations

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_ECR_ROLE_ARN }}
          aws-region: ${{ inputs.aws_region }}

      - name: Login to Amazon ECR
        id: ecr
        uses: aws-actions/amazon-ecr-login@v2

      # Each environment publishes to its own registry (see CicdStack), so a
      # staging build can never overwrite a prod tag.
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ steps.ecr.outputs.registry }}/sourcebot-${{ inputs.environment }}
          tags: ${{ inputs.docker_tags }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          # SENTRY_RELEASE is the commit SHA rather than SOURCEBOT_VERSION so that
          # every prod build gets a distinct release (prod tracks `main`, where the
          # version only moves on a tagged release). packages/backend/src/instrument.ts
          # reports NEXT_PUBLIC_BUILD_COMMIT_SHA as its release to match; the webapp
          # gets SENTRY_RELEASE injected into its bundle by withSentryConfig.
          build-args: |
            NEXT_PUBLIC_BUILD_COMMIT_SHA=${{ steps.commit.outputs.sha }}
            NEXT_PUBLIC_SENTRY_ENVIRONMENT=${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
            NEXT_PUBLIC_SENTRY_WEBAPP_DSN=${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
            NEXT_PUBLIC_SENTRY_BACKEND_DSN=${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
            NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY=${{ vars.NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY }}
            NEXT_PUBLIC_LANGFUSE_BASE_URL=${{ vars.NEXT_PUBLIC_LANGFUSE_BASE_URL }}
            SENTRY_ORG=${{ vars.SENTRY_ORG }}
            SENTRY_WEBAPP_PROJECT=${{ vars.SENTRY_WEBAPP_PROJECT }}
            SENTRY_BACKEND_PROJECT=${{ vars.SENTRY_BACKEND_PROJECT }}
            SENTRY_RELEASE=${{ steps.commit.outputs.sha }}
          # Passed as a secret, not a build-arg: build args are recorded in layer
          # metadata that `mode=max` exports to the cache. @see: Dockerfile
          secrets: ${{ inputs.require_sentry && format('sentry_auth_token={0}', secrets.SENTRY_AUTH_TOKEN) || '' }}
          # Cache scope is per-environment, and distinct from the OSS build's
          # (which is keyed on platform alone). Sharing a scope would let a build
          # that never sees SENTRY_AUTH_TOKEN restore layers from one that did.
          cache-from: type=gha,scope=cloud-${{ inputs.environment }}-amd64
          cache-to: type=gha,mode=max,scope=cloud-${{ inputs.environment }}-amd64

      - name: Summarize
        env:
          ENVIRONMENT: ${{ inputs.environment }}
          COMMIT_SHA: ${{ steps.commit.outputs.sha }}
          TAGS: ${{ steps.meta.outputs.tags }}
          REQUIRE_SENTRY: ${{ inputs.require_sentry }}
        run: |
          sentry_summary="disabled"
          if [ "$REQUIRE_SENTRY" = "true" ]; then
            sentry_summary="$COMMIT_SHA"
          fi
          {
            echo "### Pushed to ECR"
            echo
            echo "| | |"
            echo "|---|---|"
            echo "| Environment | \`${ENVIRONMENT}\` |"
            echo "| Commit | \`${COMMIT_SHA}\` |"
            echo "| Sentry | \`${sentry_summary}\` |"
            echo
            echo '```'
            echo "$TAGS"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"