trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix Sentry source map upload in Docker builds

Browse source 
- Approve @sentry/cli and esbuild build scripts so postinstall runs
- Use --mount=type=secret instead of ARG for SENTRY_AUTH_TOKEN
  (fixes Docker warning about secrets in build args)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-03-27 18:01:54 +01:00
parent 87d01b4b0d
commit 5e200c8b62
No known key found for this signature in database
GPG key ID: A32FF691A0F752D9
3 changed files with 17 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

9
.github/workflows/cd-apps.yml vendored
View file

@ -38,7 +38,8 @@ jobs:
curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64
chmod +x sops-v3.9.4.linux.amd64
SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env > /tmp/secrets.env
echo "SENTRY_AUTH_TOKEN=$(grep SENTRY_AUTH_TOKEN /tmp/secrets.env | cut -d= -f2-)" >> "$GITHUB_ENV"
grep SENTRY_AUTH_TOKEN /tmp/secrets.env | cut -d= -f2- > /tmp/sentry_token
echo "${{ github.sha }}" > /tmp/sentry_release
- uses: docker/build-push-action@v7
with:
@ -48,9 +49,9 @@ jobs:
tags: |
ghcr.io/trails-cool/${{ matrix.app }}:latest
ghcr.io/trails-cool/${{ matrix.app }}:${{ github.sha }}
build-args: |
SENTRY_AUTH_TOKEN=${{ env.SENTRY_AUTH_TOKEN }}
SENTRY_RELEASE=${{ github.sha }}
secrets: |
SENTRY_AUTH_TOKEN=/tmp/sentry_token
SENTRY_RELEASE=/tmp/sentry_release
deploy:
name: Deploy Apps

9
apps/journal/Dockerfile
View file

@ -12,13 +12,16 @@ COPY packages/gpx/package.json packages/gpx/
COPY packages/i18n/package.json packages/i18n/
COPY packages/db/package.json packages/db/
RUN pnpm install --frozen-lockfile
RUN pnpm approve-builds @sentry/cli esbuild && pnpm install --frozen-lockfile
FROM base AS build
ARG SENTRY_AUTH_TOKEN
ARG SENTRY_RELEASE
COPY --from=deps /app/ ./
COPY . .
RUN pnpm --filter @trails-cool/journal build
RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN \
--mount=type=secret,id=SENTRY_RELEASE \
SENTRY_AUTH_TOKEN="$(cat /run/secrets/SENTRY_AUTH_TOKEN 2>/dev/null)" \
SENTRY_RELEASE="$(cat /run/secrets/SENTRY_RELEASE 2>/dev/null)" \
pnpm --filter @trails-cool/journal build
FROM base AS runtime
RUN addgroup --system app && adduser --system --ingroup app app

9
apps/planner/Dockerfile
View file

@ -12,13 +12,16 @@ COPY packages/gpx/package.json packages/gpx/
COPY packages/i18n/package.json packages/i18n/
COPY packages/db/package.json packages/db/
RUN pnpm install --frozen-lockfile
RUN pnpm approve-builds @sentry/cli esbuild && pnpm install --frozen-lockfile
FROM base AS build
ARG SENTRY_AUTH_TOKEN
ARG SENTRY_RELEASE
COPY --from=deps /app/ ./
COPY . .
RUN pnpm --filter @trails-cool/planner build
RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN \
--mount=type=secret,id=SENTRY_RELEASE \
SENTRY_AUTH_TOKEN="$(cat /run/secrets/SENTRY_AUTH_TOKEN 2>/dev/null)" \
SENTRY_RELEASE="$(cat /run/secrets/SENTRY_RELEASE 2>/dev/null)" \
pnpm --filter @trails-cool/planner build
FROM base AS runtime
RUN addgroup --system app && adduser --system --ingroup app app