From 041dadc92c6bb390218adbf6511adbc4ce4385e3 Mon Sep 17 00:00:00 2001 From: Alexander Tarasov Date: Tue, 16 Jun 2026 00:17:22 +0200 Subject: [PATCH] ci: build and push production image via GitHub Actions Cloud Build cannot unpack the dhi-mirror (Docker Hardened Image) base layers and fails with "archive/tar: invalid tar header". Build the image in GitHub Actions instead, using BuildKit via getsentry/action-build-and-push-images (the same path vroom/snuba took). The action tags with the full github.sha, matching what GoCD deploys by (GO_REVISION_RELOAD_REPO), and pushes to both the single-region registry GoCD currently deploys from and the multi-region mirror. This lands while Cloud Build is still authoritative so the new build can be verified in parallel; the GoCD gate is switched over in a follow-up. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/image.yml | 46 +++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 .github/workflows/image.yml diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml new file mode 100644 index 0000000..4076cf8 --- /dev/null +++ b/.github/workflows/image.yml @@ -0,0 +1,46 @@ +name: image +on: + pull_request: + push: + branches: + - master + - releases/** + +jobs: + build-production: + runs-on: ubuntu-24.04 + if: github.ref_name == github.event.repository.default_branch + name: Build and push production image + permissions: + contents: read + id-token: write + steps: + - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v4.2.2 + + - name: Build and push image to single-region registry + uses: getsentry/action-build-and-push-images@b172ab61a5f7eabd58bd42ce231b517e79947c01 + with: + image_name: 'reload' + platforms: linux/amd64 + dockerfile_path: './Dockerfile' + ghcr: false + google_ar: true + tag_nightly: false + tag_latest: true + google_ar_image_name: us-central1-docker.pkg.dev/sentryio/reload/image + google_workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool + google_service_account: gha-gcr-push@sac-prod-sa.iam.gserviceaccount.com + + - name: Build and push image to multi-region registry + uses: getsentry/action-build-and-push-images@b172ab61a5f7eabd58bd42ce231b517e79947c01 + with: + image_name: 'reload' + platforms: linux/amd64 + dockerfile_path: './Dockerfile' + ghcr: false + google_ar: true + tag_nightly: false + tag_latest: true + google_ar_image_name: us-docker.pkg.dev/sentryio/reload-mr/image + google_workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool + google_service_account: gha-gcr-push@sac-prod-sa.iam.gserviceaccount.com