Merge branch 'main' into brendan/job-manager

Author: brendan-kellam

.github/workflows/_build-cloud.yml

@@ -22,6 +22,11 @@ on:
         required: false
         type: string
         default: us-west-1
+      require_sentry:
+        description: "Require complete Sentry build configuration and source-map upload credentials"
+        required: false
+        type: boolean
+        default: true
 
 jobs:
   build:
@@ -58,13 +63,14 @@ jobs:
           SENTRY_ORG: ${{ vars.SENTRY_ORG }}
           SENTRY_WEBAPP_PROJECT: ${{ vars.SENTRY_WEBAPP_PROJECT }}
           SENTRY_BACKEND_PROJECT: ${{ vars.SENTRY_BACKEND_PROJECT }}
+          REQUIRE_SENTRY: ${{ inputs.require_sentry }}
         run: |
           missing=0
-          for name in SENTRY_AUTH_TOKEN AWS_ECR_ROLE_ARN \
-                      NEXT_PUBLIC_SENTRY_ENVIRONMENT \
-                      NEXT_PUBLIC_SENTRY_WEBAPP_DSN \
-                      NEXT_PUBLIC_SENTRY_BACKEND_DSN \
-                      SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT; do
+          required_names="AWS_ECR_ROLE_ARN"
+          if [ "$REQUIRE_SENTRY" = "true" ]; then
+            required_names="$required_names SENTRY_AUTH_TOKEN NEXT_PUBLIC_SENTRY_ENVIRONMENT NEXT_PUBLIC_SENTRY_WEBAPP_DSN NEXT_PUBLIC_SENTRY_BACKEND_DSN SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT"
+          fi
+          for name in $required_names; do
             if [ -z "${!name}" ]; then
               echo "::error::${name} is not set on the '${ENVIRONMENT}' environment (or the repository)."
               missing=1
@@ -73,9 +79,36 @@ jobs:
             fi
           done
           if [ "$missing" -ne 0 ]; then
-            echo "::error::Refusing to build: the image would ship without Sentry wiring."
+            echo "::error::Refusing to build: required environment configuration is missing."
             exit 1
           fi
+          if [ "$REQUIRE_SENTRY" != "true" ]; then
+            echo "Sentry wiring is intentionally disabled for the isolated internal demo image."
+          fi
+
+      - name: Verify internal GitHub OIDC identity
+        if: inputs.environment == 'internal'
+        env:
+          EXPECTED_OIDC_SUBJECT: repo:sourcebot-dev/sourcebot:environment:internal
+        run: |
+          response=$(curl --fail --silent --show-error \
+            -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sts.amazonaws.com")
+          token=$(jq -r '.value' <<<"$response")
+          OIDC_TOKEN="$token" node - <<'NODE'
+          const claims = JSON.parse(Buffer.from(process.env.OIDC_TOKEN.split('.')[1], 'base64url'));
+          console.log(JSON.stringify({
+            sub: claims.sub,
+            aud: claims.aud,
+            repository: claims.repository,
+            repository_id: claims.repository_id,
+            job_workflow_ref: claims.job_workflow_ref,
+          }, null, 2));
+          if (claims.sub !== process.env.EXPECTED_OIDC_SUBJECT) {
+            console.error(`Unexpected OIDC subject: ${claims.sub}`);
+            process.exit(1);
+          }
+          NODE
 
       - name: Check Prisma migrations
         uses: ./.github/actions/check-prisma-migrations
@@ -128,8 +161,7 @@ jobs:
             SENTRY_RELEASE=${{ steps.commit.outputs.sha }}
           # Passed as a secret, not a build-arg: build args are recorded in layer
           # metadata that `mode=max` exports to the cache. @see: Dockerfile
-          secrets: |
-            sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+          secrets: ${{ inputs.require_sentry && format('sentry_auth_token={0}', secrets.SENTRY_AUTH_TOKEN) || '' }}
           # Cache scope is per-environment, and distinct from the OSS build's
           # (which is keyed on platform alone). Sharing a scope would let a build
           # that never sees SENTRY_AUTH_TOKEN restore layers from one that did.
@@ -141,15 +173,20 @@ jobs:
           ENVIRONMENT: ${{ inputs.environment }}
           COMMIT_SHA: ${{ steps.commit.outputs.sha }}
           TAGS: ${{ steps.meta.outputs.tags }}
+          REQUIRE_SENTRY: ${{ inputs.require_sentry }}
         run: |
+          sentry_summary="disabled"
+          if [ "$REQUIRE_SENTRY" = "true" ]; then
+            sentry_summary="$COMMIT_SHA"
+          fi
           {
             echo "### Pushed to ECR"
             echo
             echo "| | |"
             echo "|---|---|"
             echo "| Environment | \`${ENVIRONMENT}\` |"
             echo "| Commit | \`${COMMIT_SHA}\` |"
-            echo "| Sentry release | \`${COMMIT_SHA}\` |"
+            echo "| Sentry | \`${sentry_summary}\` |"
             echo
             echo '```'
             echo "$TAGS"

.github/workflows/releaseCloudInternal.yml

@@ -0,0 +1,25 @@
+name: Release Sourcebot (Cloud - Internal Demo)
+
+permissions:
+  contents: read
+  id-token: write
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: release-cloud-internal
+  cancel-in-progress: false
+
+jobs:
+  build:
+    uses: ./.github/workflows/_build-cloud.yml
+    with:
+      environment: internal
+      # Pin the checkout and image tags to the same dispatch commit so metadata
+      # can never identify image contents as a different revision.
+      git_ref: ${{ github.sha }}
+      require_sentry: false
+      docker_tags: |
+        type=raw,value=main
+        type=raw,value=sha-${{ github.sha }}

CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Fixed memory leak attributed to CodeMirror allocating objects on heap that were never freed. [#1580](https://github.com/sourcebot-dev/sourcebot/pull/1580)
+- Kept Git provider credentials out of subprocess arguments and on-disk configuration by using isolated in-memory credential caches. [#1584](https://github.com/sourcebot-dev/sourcebot/pull/1584)
+
+## [5.1.7] - 2026-08-13
+
+### Added
+- Added a manually triggered cloud image release workflow for isolated internal deployments. [#1566](https://github.com/sourcebot-dev/sourcebot/pull/1566)
+- Added Prometheus metrics for the web process, served on `WEB_METRICS_PORT` (default `3070`). [#1570](https://github.com/sourcebot-dev/sourcebot/pull/1570)
+- Added an `http_request_duration_seconds` metric recording web request latency by route, method, and status. [#1571](https://github.com/sourcebot-dev/sourcebot/pull/1571)
+- [EE] Added one-hour repository-scoped access tokens with public mint and revoke APIs. [#1549](https://github.com/sourcebot-dev/sourcebot/pull/1549)
+- Added public connection listing and connection-based repository filtering APIs. [#1550](https://github.com/sourcebot-dev/sourcebot/pull/1550)
+
+### Fixed
+- Fixed the web process being capped at a ~4GiB heap regardless of how much memory the container has, which caused multi-second garbage collection pauses on larger deployments. [#1569](https://github.com/sourcebot-dev/sourcebot/pull/1569)
+- Upgraded `@sentry/*` to `^10.70.0`, fixing memory leaks where spans retained request data indefinitely. [#1572](https://github.com/sourcebot-dev/sourcebot/pull/1572)
+- Fixed code search result links occasionally getting stuck during navigation and restored Cmd/Ctrl-click to open matches in preview. [#1574](https://github.com/sourcebot-dev/sourcebot/pull/1574)
+- Fixed a server-side memory leak where a single shared react-query cache retained state from every server render; the cache is now created per-request. [#1575](https://github.com/sourcebot-dev/sourcebot/pull/1575)
+- Fixed code host retry warnings to include the HTTP response status. [#1576](https://github.com/sourcebot-dev/sourcebot/pull/1576)
+- Fixed streamed code search updates silently cancelling in-flight result navigation. [#1577](https://github.com/sourcebot-dev/sourcebot/pull/1577)
+- Fixed the `grep` and `glob` agent tools mis-parsing structured search inputs containing spaces, commas, or quotes. [#1573](https://github.com/sourcebot-dev/sourcebot/pull/1573)
+
 ## [5.1.6] - 2026-08-10
 
 ### Added