s

Author: brendan-kellam

.github/workflows/_build-cloud.yml

@@ -1,21 +1,5 @@
 # Internal reusable workflow for building a non-OSS ("cloud") Docker image and
 # pushing it to Amazon ECR.
-#
-# Unlike _build.yml (which builds the public, multi-platform OSS image for GHCR),
-# this workflow bakes environment-specific configuration into the image — Sentry
-# DSNs, the Sentry environment name — and uploads source maps to Sentry. Those
-# values come from the GitHub Environment named by `environment`, so a new
-# deployment environment is a new Environment plus a small caller workflow.
-#
-# Each environment publishes to its own ECR repository, `sourcebot-<environment>`,
-# owned by CicdStack in the sourcebot-demo-infra repo.
-#
-# Single-platform (linux/amd64): the EKS `general-purpose` NodePool that runs
-# Sourcebot pins `kubernetes.io/arch: amd64`. Building one platform lets us push
-# tags directly, skipping the push-by-digest + manifest-merge dance _build.yml
-# needs. It also avoids ECR lifecycle rules for untagged images silently deleting
-# a manifest list's per-platform children.
-
 name: Build Cloud Image
 
 on:
@@ -42,10 +26,6 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-    # Gates the job on the Environment's protection rules, and — because the
-    # OIDC subject for a job with an environment is
-    # `repo:<org>/<repo>:environment:<name>` — is what the ECR push role's trust
-    # policy matches on. Also what makes `vars`/`secrets` below resolve.
     environment: ${{ inputs.environment }}
     permissions:
       contents: read
@@ -60,16 +40,10 @@ jobs:
           submodules: "true"
           fetch-depth: 0
 
-      # The exact commit built. `github.sha` is the SHA of the ref the workflow
-      # was *dispatched* on, which is not necessarily `git_ref`.
       - name: Resolve build commit SHA
         id: commit
         run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
-      # Fail fast, and loudly. The Dockerfile only uploads source maps when every
-      # Sentry input is non-empty, so a missing var or secret would otherwise
-      # produce a perfectly green build of an image with no Sentry wiring. Values
-      # are never printed — only whether each resolved to something.
       - name: Validate environment configuration
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

.github/workflows/release-cloud-prod.yml

@@ -1,28 +1,5 @@
-# Builds the production image (app.sourcebot.dev) and pushes it to Amazon ECR.
-#
-# This is *not* the OSS image: it has the prod Sentry DSNs baked in and uploads
-# source maps to Sentry. See _build-cloud.yml.
-#
-# Publishes to the `sourcebot-prod` ECR repository:
-#
-#   push to main    -> :main, :sha-<commit-sha>
-#   push v*.*.* tag -> :v<x.y.z>, :latest
-#
-# The `sha-` prefix is load-bearing: CicdStack's lifecycle rule expires old commit
-# images by matching that prefix, which is what keeps `main`, `latest` and `v*`
-# from ever being expired by count.
-#
-# Prod deploys from the `:main` tag. The OSS image (ghcr.io/sourcebot-dev/sourcebot)
-# is still built independently by release-dev.yml / release-prod.yml.
-#
-# Note: the Prisma migration backstop is not repeated here — release-dev.yml runs
-# `check-prisma-migrations` on the same commit for every push to main.
-
 name: Release Sourcebot (Cloud - Production)
 
-# The called workflow's permissions are capped by the caller's, and `id-token` is
-# never granted by default — without requesting it here, the OIDC token request
-# that assumes the ECR push role fails.
 permissions:
   contents: read
   id-token: write

packages/web/next.config.mjs

@@ -147,7 +147,7 @@ export default withSentryConfig(nextConfig, {
     org: process.env.SENTRY_ORG,
     project: process.env.SENTRY_WEBAPP_PROJECT,
     authToken: process.env.SENTRY_AUTH_TOKEN,
-    release: process.env.SENTRY_RELEASE,
+    release: { name: process.env.SENTRY_RELEASE },
 
     // Only print logs for uploading source maps in CI
     silent: !process.env.CI,