chore(ci): Add cloud ci

.github/workflows/_build-cloud.yml

@@ -0,0 +1,157 @@
+# Internal reusable workflow for building a non-OSS ("cloud") Docker image and
+# pushing it to Amazon ECR.
+name: Build Cloud Image
+
+on:
+ workflow_call:
+ inputs:
+ environment:
+ description: "GitHub Environment supplying the Sentry vars/secrets. Also scopes the OIDC subject used to assume the ECR push role."
+ required: true
+ type: string
+ git_ref:
+ description: "Git ref to checkout and build"
+ required: true
+ type: string
+ docker_tags:
+ description: "Docker tags configuration for docker/metadata-action"
+ required: true
+ type: string
+ aws_region:
+ description: "Region the ECR repository lives in"
+ required: false
+ type: string
+ default: us-west-1
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ environment: ${{ inputs.environment }}
+ permissions:
+ contents: read
+ # Required to request the OIDC token that assumes the AWS role.
+ id-token: write
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ inputs.git_ref }}
+ submodules: "true"
+ fetch-depth: 0
+ # Nothing after checkout talks to the remote, so don't leave the token
+ # behind in the workspace's .git/config.
+ persist-credentials: false
+
+ - name: Resolve build commit SHA
+ id: commit
+ run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+ - name: Validate environment configuration
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+ AWS_ECR_ROLE_ARN: ${{ vars.AWS_ECR_ROLE_ARN }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT: ${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ SENTRY_ORG: ${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT: ${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT: ${{ vars.SENTRY_BACKEND_PROJECT }}
+ run: |
+ missing=0
+ for name in SENTRY_AUTH_TOKEN AWS_ECR_ROLE_ARN \
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT \
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN \
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN \
+ SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT; do
+ if [ -z "${!name}" ]; then
+ echo "::error::${name} is not set on the '${ENVIRONMENT}' environment (or the repository)."
+ missing=1
+ else
+ echo "ok: ${name}"
+ fi
+ done
+ if [ "$missing" -ne 0 ]; then
+ echo "::error::Refusing to build: the image would ship without Sentry wiring."
+ exit 1
+ fi
+
+ - name: Check Prisma migrations
+ uses: ./.github/actions/check-prisma-migrations
+
+ - name: Configure AWS credentials
+ uses: aws-actions/configure-aws-credentials@v4
+ with:
+ role-to-assume: ${{ vars.AWS_ECR_ROLE_ARN }}
+ aws-region: ${{ inputs.aws_region }}
+
+ - name: Login to Amazon ECR
+ id: ecr
+ uses: aws-actions/amazon-ecr-login@v2
+
+ # Each environment publishes to its own registry (see CicdStack), so a
+ # staging build can never overwrite a prod tag.
+ - name: Extract Docker metadata
+ id: meta
+ uses: docker/metadata-action@v5
+ with:
+ images: ${{ steps.ecr.outputs.registry }}/sourcebot-${{ inputs.environment }}
+ tags: ${{ inputs.docker_tags }}
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
+ - name: Build and push Docker image
+ uses: docker/build-push-action@v7
+ with:
+ context: .
+ platforms: linux/amd64
+ push: true
+ tags: ${{ steps.meta.outputs.tags }}
+ labels: ${{ steps.meta.outputs.labels }}
+ # SENTRY_RELEASE is the commit SHA rather than SOURCEBOT_VERSION so that
+ # every prod build gets a distinct release (prod tracks `main`, where the
+ # version only moves on a tagged release). packages/backend/src/instrument.ts
+ # reports NEXT_PUBLIC_BUILD_COMMIT_SHA as its release to match; the webapp
+ # gets SENTRY_RELEASE injected into its bundle by withSentryConfig.
+ build-args: |
+ NEXT_PUBLIC_BUILD_COMMIT_SHA=${{ steps.commit.outputs.sha }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT=${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN=${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN=${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY=${{ vars.NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY }}
+ NEXT_PUBLIC_LANGFUSE_BASE_URL=${{ vars.NEXT_PUBLIC_LANGFUSE_BASE_URL }}
+ SENTRY_ORG=${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT=${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT=${{ vars.SENTRY_BACKEND_PROJECT }}
+ SENTRY_RELEASE=${{ steps.commit.outputs.sha }}
+ # Passed as a secret, not a build-arg: build args are recorded in layer
+ # metadata that `mode=max` exports to the cache. @see: Dockerfile
+ secrets: |
+ sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+ # Cache scope is per-environment, and distinct from the OSS build's
+ # (which is keyed on platform alone). Sharing a scope would let a build
+ # that never sees SENTRY_AUTH_TOKEN restore layers from one that did.
+ cache-from: type=gha,scope=cloud-${{ inputs.environment }}-amd64
+ cache-to: type=gha,mode=max,scope=cloud-${{ inputs.environment }}-amd64
+
+ - name: Summarize
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ COMMIT_SHA: ${{ steps.commit.outputs.sha }}
+ TAGS: ${{ steps.meta.outputs.tags }}
+ run: |
+ {
+ echo "### Pushed to ECR"
+ echo
+ echo "| | |"
+ echo "|---|---|"
+ echo "| Environment | \`${ENVIRONMENT}\` |"
+ echo "| Commit | \`${COMMIT_SHA}\` |"
+ echo "| Sentry release | \`${COMMIT_SHA}\` |"
+ echo
+ echo '```'
+ echo "$TAGS"
+ echo '```'
+ } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-cloud-prod.yml

@@ -0,0 +1,28 @@
+name: Release Sourcebot (Cloud - Production)
+
+permissions:
+ contents: read
+ id-token: write
+
+on:
+ push:
+ branches: ["main"]
+ tags: ["v*.*.*"]
+ workflow_dispatch:
+
+concurrency:
+ group: release-cloud-prod-${{ github.ref }}
+ cancel-in-progress: false
+
+jobs:
+ build:
+ uses: ./.github/workflows/_build-cloud.yml
+ with:
+ environment: prod
+ git_ref: ${{ github.ref }}
+ docker_tags: |
+ type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
+ type=sha,format=long,enable=${{ github.ref == 'refs/heads/main' }}
+ type=semver,pattern=v{{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ secrets: inherit

Dockerfile

@@ -61,19 +61,12 @@ ENV NEXT_PUBLIC_LANGFUSE_BASE_URL=$NEXT_PUBLIC_LANGFUSE_BASE_URL
 ARG NEXT_PUBLIC_BUILD_COMMIT_SHA
 ENV NEXT_PUBLIC_BUILD_COMMIT_SHA=$NEXT_PUBLIC_BUILD_COMMIT_SHA
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
-# @see : next.config.mjs
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_WEBAPP_PROJECT
 ENV SENTRY_WEBAPP_PROJECT=$SENTRY_WEBAPP_PROJECT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 # -----------
 
 RUN apk add --no-cache libc6-compat
@@ -92,7 +85,9 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/web install
 
 ENV NEXT_TELEMETRY_DISABLED=1
-RUN yarn workspace @sourcebot/web build
+
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+ yarn workspace @sourcebot/web build
 ENV SKIP_ENV_VALIDATION=0
 # ------------------------------
 
@@ -101,16 +96,10 @@ FROM node-alpine AS backend-builder
 ENV SKIP_ENV_VALIDATION=1
 # -----------
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_BACKEND_PROJECT
 ENV SENTRY_BACKEND_PROJECT=$SENTRY_BACKEND_PROJECT
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
 # -----------
@@ -129,11 +118,10 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/backend install
 RUN yarn workspace @sourcebot/backend build
 
-# Upload source maps to Sentry if we have the necessary build-time args.
-RUN if [ -n "$SENTRY_SMUAT" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+if [ -n "$SENTRY_AUTH_TOKEN" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
  apk add --no-cache curl; \
  curl -sL https://sentry.io/get-cli/ | sh; \
- sentry-cli login --auth-token $SENTRY_SMUAT; \
  sentry-cli sourcemaps inject --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
  sentry-cli sourcemaps upload --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
 fi

packages/backend/src/instrument.ts

@@ -7,7 +7,10 @@ const logger = createLogger('instrument');
 if (!!env.NEXT_PUBLIC_SENTRY_BACKEND_DSN && !!env.NEXT_PUBLIC_SENTRY_ENVIRONMENT) {
  Sentry.init({
  dsn: env.NEXT_PUBLIC_SENTRY_BACKEND_DSN,
- release: SOURCEBOT_VERSION,
+ // Must match the release our source maps are uploaded under, which the
+ // Dockerfile sets from SENTRY_RELEASE (the build's commit SHA). Falls back
+ // to the version for builds that don't pass a commit SHA.
+ release: env.NEXT_PUBLIC_BUILD_COMMIT_SHA ?? SOURCEBOT_VERSION,
  environment: env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
  });
 } else {

packages/web/next.config.mjs

@@ -146,8 +146,8 @@ export default withSentryConfig(nextConfig, {
  // For all available options, see:
  org: process.env.SENTRY_ORG,
  project: process.env.SENTRY_WEBAPP_PROJECT,
- authToken: process.env.SENTRY_SMUAT,
- release: process.env.SENTRY_RELEASE,
+ authToken: process.env.SENTRY_AUTH_TOKEN,
+ release: { name: process.env.SENTRY_RELEASE },
 
  // Only print logs for uploading source maps in CI
  silent: !process.env.CI,

packages/web/sentry.client.config.ts → packages/web/src/instrumentation-client.ts

@@ -1,6 +1,10 @@
 // This file configures the initialization of Sentry on the client.
 // The config you add here will be used whenever a users loads a page in their browser.
 // https://docs.sentry.io/platforms/javascript/guides/nextjs/
+//
+// Must be named `instrumentation-client.ts`. Next.js loads this file itself, whereas
+// `sentry.client.config.ts` is only picked up by @sentry/nextjs' webpack plugin,
+// which never runs since `next build` defaults to Turbopack.
 
 import * as Sentry from "@sentry/nextjs";
 
@@ -9,9 +13,15 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });
 } else {
  console.debug("[client] Sentry was not initialized");
 }
+
+// Instruments App Router client-side navigations as spans. Next.js only reads this
+// export from `instrumentation-client.ts`. A no-op when Sentry is uninitialized.
+export const onRouterTransitionStart = Sentry.captureRouterTransitionStart;

packages/web/src/instrumentation.ts

@@ -19,11 +19,11 @@ export async function register() {
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {
- await import('../sentry.server.config');
+ await import('./sentry.server.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'edge') {
- await import('../sentry.edge.config');
+ await import('./sentry.edge.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {

packages/web/sentry.edge.config.ts → packages/web/src/sentry.edge.config.ts

@@ -10,6 +10,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

packages/web/sentry.server.config.ts → packages/web/src/sentry.server.config.ts

@@ -12,6 +12,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

.github/workflows/_build-cloud.yml

@@ -0,0 +1,157 @@
+# Internal reusable workflow for building a non-OSS ("cloud") Docker image and
+# pushing it to Amazon ECR.
+name: Build Cloud Image
+
+on:
+ workflow_call:
+ inputs:
+ environment:
+ description: "GitHub Environment supplying the Sentry vars/secrets. Also scopes the OIDC subject used to assume the ECR push role."
+ required: true
+ type: string
+ git_ref:
+ description: "Git ref to checkout and build"
+ required: true
+ type: string
+ docker_tags:
+ description: "Docker tags configuration for docker/metadata-action"
+ required: true
+ type: string
+ aws_region:
+ description: "Region the ECR repository lives in"
+ required: false
+ type: string
+ default: us-west-1
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ environment: ${{ inputs.environment }}
+ permissions:
+ contents: read
+ # Required to request the OIDC token that assumes the AWS role.
+ id-token: write
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ inputs.git_ref }}
+ submodules: "true"
+ fetch-depth: 0
+ # Nothing after checkout talks to the remote, so don't leave the token
+ # behind in the workspace's .git/config.
+ persist-credentials: false
+
+ - name: Resolve build commit SHA
+ id: commit
+ run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+ - name: Validate environment configuration
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+ AWS_ECR_ROLE_ARN: ${{ vars.AWS_ECR_ROLE_ARN }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT: ${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ SENTRY_ORG: ${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT: ${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT: ${{ vars.SENTRY_BACKEND_PROJECT }}
+ run: |
+ missing=0
+ for name in SENTRY_AUTH_TOKEN AWS_ECR_ROLE_ARN \
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT \
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN \
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN \
+ SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT; do
+ if [ -z "${!name}" ]; then
+ echo "::error::${name} is not set on the '${ENVIRONMENT}' environment (or the repository)."
+ missing=1
+ else
+ echo "ok: ${name}"
+ fi
+ done
+ if [ "$missing" -ne 0 ]; then
+ echo "::error::Refusing to build: the image would ship without Sentry wiring."
+ exit 1
+ fi
+
+ - name: Check Prisma migrations
+ uses: ./.github/actions/check-prisma-migrations
+
+ - name: Configure AWS credentials
+ uses: aws-actions/configure-aws-credentials@v4
+ with:
+ role-to-assume: ${{ vars.AWS_ECR_ROLE_ARN }}
+ aws-region: ${{ inputs.aws_region }}
+
+ - name: Login to Amazon ECR
+ id: ecr
+ uses: aws-actions/amazon-ecr-login@v2
+
+ # Each environment publishes to its own registry (see CicdStack), so a
+ # staging build can never overwrite a prod tag.
+ - name: Extract Docker metadata
+ id: meta
+ uses: docker/metadata-action@v5
+ with:
+ images: ${{ steps.ecr.outputs.registry }}/sourcebot-${{ inputs.environment }}
+ tags: ${{ inputs.docker_tags }}
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
+ - name: Build and push Docker image
+ uses: docker/build-push-action@v7
+ with:
+ context: .
+ platforms: linux/amd64
+ push: true
+ tags: ${{ steps.meta.outputs.tags }}
+ labels: ${{ steps.meta.outputs.labels }}
+ # SENTRY_RELEASE is the commit SHA rather than SOURCEBOT_VERSION so that
+ # every prod build gets a distinct release (prod tracks `main`, where the
+ # version only moves on a tagged release). packages/backend/src/instrument.ts
+ # reports NEXT_PUBLIC_BUILD_COMMIT_SHA as its release to match; the webapp
+ # gets SENTRY_RELEASE injected into its bundle by withSentryConfig.
+ build-args: |
+ NEXT_PUBLIC_BUILD_COMMIT_SHA=${{ steps.commit.outputs.sha }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT=${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN=${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN=${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY=${{ vars.NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY }}
+ NEXT_PUBLIC_LANGFUSE_BASE_URL=${{ vars.NEXT_PUBLIC_LANGFUSE_BASE_URL }}
+ SENTRY_ORG=${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT=${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT=${{ vars.SENTRY_BACKEND_PROJECT }}
+ SENTRY_RELEASE=${{ steps.commit.outputs.sha }}
+ # Passed as a secret, not a build-arg: build args are recorded in layer
+ # metadata that `mode=max` exports to the cache. @see: Dockerfile
+ secrets: |
+ sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+ # Cache scope is per-environment, and distinct from the OSS build's
+ # (which is keyed on platform alone). Sharing a scope would let a build
+ # that never sees SENTRY_AUTH_TOKEN restore layers from one that did.
+ cache-from: type=gha,scope=cloud-${{ inputs.environment }}-amd64
+ cache-to: type=gha,mode=max,scope=cloud-${{ inputs.environment }}-amd64
+
+ - name: Summarize
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ COMMIT_SHA: ${{ steps.commit.outputs.sha }}
+ TAGS: ${{ steps.meta.outputs.tags }}
+ run: |
+ {
+ echo "### Pushed to ECR"
+ echo
+ echo "| | |"
+ echo "|---|---|"
+ echo "| Environment | \`${ENVIRONMENT}\` |"
+ echo "| Commit | \`${COMMIT_SHA}\` |"
+ echo "| Sentry release | \`${COMMIT_SHA}\` |"
+ echo
+ echo '```'
+ echo "$TAGS"
+ echo '```'
+ } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-cloud-prod.yml

@@ -0,0 +1,28 @@
+name: Release Sourcebot (Cloud - Production)
+
+permissions:
+ contents: read
+ id-token: write
+
+on:
+ push:
+ branches: ["main"]
+ tags: ["v*.*.*"]
+ workflow_dispatch:
+
+concurrency:
+ group: release-cloud-prod-${{ github.ref }}
+ cancel-in-progress: false
+
+jobs:
+ build:
+ uses: ./.github/workflows/_build-cloud.yml
+ with:
+ environment: prod
+ git_ref: ${{ github.ref }}
+ docker_tags: |
+ type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
+ type=sha,format=long,enable=${{ github.ref == 'refs/heads/main' }}
+ type=semver,pattern=v{{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ secrets: inherit

Dockerfile

@@ -61,19 +61,12 @@ ENV NEXT_PUBLIC_LANGFUSE_BASE_URL=$NEXT_PUBLIC_LANGFUSE_BASE_URL
 ARG NEXT_PUBLIC_BUILD_COMMIT_SHA
 ENV NEXT_PUBLIC_BUILD_COMMIT_SHA=$NEXT_PUBLIC_BUILD_COMMIT_SHA
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
-# @see : next.config.mjs
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_WEBAPP_PROJECT
 ENV SENTRY_WEBAPP_PROJECT=$SENTRY_WEBAPP_PROJECT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 # -----------
 
 RUN apk add --no-cache libc6-compat
@@ -92,7 +85,9 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/web install
 
 ENV NEXT_TELEMETRY_DISABLED=1
-RUN yarn workspace @sourcebot/web build
+
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+ yarn workspace @sourcebot/web build
 ENV SKIP_ENV_VALIDATION=0
 # ------------------------------
 
@@ -101,16 +96,10 @@ FROM node-alpine AS backend-builder
 ENV SKIP_ENV_VALIDATION=1
 # -----------
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_BACKEND_PROJECT
 ENV SENTRY_BACKEND_PROJECT=$SENTRY_BACKEND_PROJECT
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
 # -----------
@@ -129,11 +118,10 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/backend install
 RUN yarn workspace @sourcebot/backend build
 
-# Upload source maps to Sentry if we have the necessary build-time args.
-RUN if [ -n "$SENTRY_SMUAT" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+if [ -n "$SENTRY_AUTH_TOKEN" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
  apk add --no-cache curl; \
  curl -sL https://sentry.io/get-cli/ | sh; \
- sentry-cli login --auth-token $SENTRY_SMUAT; \
  sentry-cli sourcemaps inject --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
  sentry-cli sourcemaps upload --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
 fi

packages/backend/src/instrument.ts

@@ -7,7 +7,10 @@ const logger = createLogger('instrument');
 if (!!env.NEXT_PUBLIC_SENTRY_BACKEND_DSN && !!env.NEXT_PUBLIC_SENTRY_ENVIRONMENT) {
  Sentry.init({
  dsn: env.NEXT_PUBLIC_SENTRY_BACKEND_DSN,
- release: SOURCEBOT_VERSION,
+ // Must match the release our source maps are uploaded under, which the
+ // Dockerfile sets from SENTRY_RELEASE (the build's commit SHA). Falls back
+ // to the version for builds that don't pass a commit SHA.
+ release: env.NEXT_PUBLIC_BUILD_COMMIT_SHA ?? SOURCEBOT_VERSION,
  environment: env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
  });
 } else {

packages/web/next.config.mjs

@@ -146,8 +146,8 @@ export default withSentryConfig(nextConfig, {
  // For all available options, see:
  org: process.env.SENTRY_ORG,
  project: process.env.SENTRY_WEBAPP_PROJECT,
- authToken: process.env.SENTRY_SMUAT,
- release: process.env.SENTRY_RELEASE,
+ authToken: process.env.SENTRY_AUTH_TOKEN,
+ release: { name: process.env.SENTRY_RELEASE },
 
  // Only print logs for uploading source maps in CI
  silent: !process.env.CI,

packages/web/sentry.client.config.ts → packages/web/src/instrumentation-client.ts

@@ -1,6 +1,10 @@
 // This file configures the initialization of Sentry on the client.
 // The config you add here will be used whenever a users loads a page in their browser.
 // https://docs.sentry.io/platforms/javascript/guides/nextjs/
+//
+// Must be named `instrumentation-client.ts`. Next.js loads this file itself, whereas
+// `sentry.client.config.ts` is only picked up by @sentry/nextjs' webpack plugin,
+// which never runs since `next build` defaults to Turbopack.
 
 import * as Sentry from "@sentry/nextjs";
 
@@ -9,9 +13,15 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });
 } else {
  console.debug("[client] Sentry was not initialized");
 }
+
+// Instruments App Router client-side navigations as spans. Next.js only reads this
+// export from `instrumentation-client.ts`. A no-op when Sentry is uninitialized.
+export const onRouterTransitionStart = Sentry.captureRouterTransitionStart;

packages/web/src/instrumentation.ts

@@ -19,11 +19,11 @@ export async function register() {
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {
- await import('../sentry.server.config');
+ await import('./sentry.server.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'edge') {
- await import('../sentry.edge.config');
+ await import('./sentry.edge.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {

packages/web/sentry.edge.config.ts → packages/web/src/sentry.edge.config.ts

@@ -10,6 +10,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

packages/web/sentry.server.config.ts → packages/web/src/sentry.server.config.ts

@@ -12,6 +12,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

.github/workflows/_build-cloud.yml

@@ -0,0 +1,157 @@
+# Internal reusable workflow for building a non-OSS ("cloud") Docker image and
+# pushing it to Amazon ECR.
+name: Build Cloud Image
+
+on:
+ workflow_call:
+ inputs:
+ environment:
+ description: "GitHub Environment supplying the Sentry vars/secrets. Also scopes the OIDC subject used to assume the ECR push role."
+ required: true
+ type: string
+ git_ref:
+ description: "Git ref to checkout and build"
+ required: true
+ type: string
+ docker_tags:
+ description: "Docker tags configuration for docker/metadata-action"
+ required: true
+ type: string
+ aws_region:
+ description: "Region the ECR repository lives in"
+ required: false
+ type: string
+ default: us-west-1
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ environment: ${{ inputs.environment }}
+ permissions:
+ contents: read
+ # Required to request the OIDC token that assumes the AWS role.
+ id-token: write
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ inputs.git_ref }}
+ submodules: "true"
+ fetch-depth: 0
+ # Nothing after checkout talks to the remote, so don't leave the token
+ # behind in the workspace's .git/config.
+ persist-credentials: false
+
+ - name: Resolve build commit SHA
+ id: commit
+ run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+ - name: Validate environment configuration
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+ AWS_ECR_ROLE_ARN: ${{ vars.AWS_ECR_ROLE_ARN }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT: ${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ SENTRY_ORG: ${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT: ${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT: ${{ vars.SENTRY_BACKEND_PROJECT }}
+ run: |
+ missing=0
+ for name in SENTRY_AUTH_TOKEN AWS_ECR_ROLE_ARN \
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT \
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN \
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN \
+ SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT; do
+ if [ -z "${!name}" ]; then
+ echo "::error::${name} is not set on the '${ENVIRONMENT}' environment (or the repository)."
+ missing=1
+ else
+ echo "ok: ${name}"
+ fi
+ done
+ if [ "$missing" -ne 0 ]; then
+ echo "::error::Refusing to build: the image would ship without Sentry wiring."
+ exit 1
+ fi
+
+ - name: Check Prisma migrations
+ uses: ./.github/actions/check-prisma-migrations
+
+ - name: Configure AWS credentials
+ uses: aws-actions/configure-aws-credentials@v4
+ with:
+ role-to-assume: ${{ vars.AWS_ECR_ROLE_ARN }}
+ aws-region: ${{ inputs.aws_region }}
+
+ - name: Login to Amazon ECR
+ id: ecr
+ uses: aws-actions/amazon-ecr-login@v2
+
+ # Each environment publishes to its own registry (see CicdStack), so a
+ # staging build can never overwrite a prod tag.
+ - name: Extract Docker metadata
+ id: meta
+ uses: docker/metadata-action@v5
+ with:
+ images: ${{ steps.ecr.outputs.registry }}/sourcebot-${{ inputs.environment }}
+ tags: ${{ inputs.docker_tags }}
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
+ - name: Build and push Docker image
+ uses: docker/build-push-action@v7
+ with:
+ context: .
+ platforms: linux/amd64
+ push: true
+ tags: ${{ steps.meta.outputs.tags }}
+ labels: ${{ steps.meta.outputs.labels }}
+ # SENTRY_RELEASE is the commit SHA rather than SOURCEBOT_VERSION so that
+ # every prod build gets a distinct release (prod tracks `main`, where the
+ # version only moves on a tagged release). packages/backend/src/instrument.ts
+ # reports NEXT_PUBLIC_BUILD_COMMIT_SHA as its release to match; the webapp
+ # gets SENTRY_RELEASE injected into its bundle by withSentryConfig.
+ build-args: |
+ NEXT_PUBLIC_BUILD_COMMIT_SHA=${{ steps.commit.outputs.sha }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT=${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN=${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN=${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY=${{ vars.NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY }}
+ NEXT_PUBLIC_LANGFUSE_BASE_URL=${{ vars.NEXT_PUBLIC_LANGFUSE_BASE_URL }}
+ SENTRY_ORG=${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT=${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT=${{ vars.SENTRY_BACKEND_PROJECT }}
+ SENTRY_RELEASE=${{ steps.commit.outputs.sha }}
+ # Passed as a secret, not a build-arg: build args are recorded in layer
+ # metadata that `mode=max` exports to the cache. @see: Dockerfile
+ secrets: |
+ sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+ # Cache scope is per-environment, and distinct from the OSS build's
+ # (which is keyed on platform alone). Sharing a scope would let a build
+ # that never sees SENTRY_AUTH_TOKEN restore layers from one that did.
+ cache-from: type=gha,scope=cloud-${{ inputs.environment }}-amd64
+ cache-to: type=gha,mode=max,scope=cloud-${{ inputs.environment }}-amd64
+
+ - name: Summarize
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ COMMIT_SHA: ${{ steps.commit.outputs.sha }}
+ TAGS: ${{ steps.meta.outputs.tags }}
+ run: |
+ {
+ echo "### Pushed to ECR"
+ echo
+ echo "| | |"
+ echo "|---|---|"
+ echo "| Environment | \`${ENVIRONMENT}\` |"
+ echo "| Commit | \`${COMMIT_SHA}\` |"
+ echo "| Sentry release | \`${COMMIT_SHA}\` |"
+ echo
+ echo '```'
+ echo "$TAGS"
+ echo '```'
+ } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-cloud-prod.yml

@@ -0,0 +1,28 @@
+name: Release Sourcebot (Cloud - Production)
+
+permissions:
+ contents: read
+ id-token: write
+
+on:
+ push:
+ branches: ["main"]
+ tags: ["v*.*.*"]
+ workflow_dispatch:
+
+concurrency:
+ group: release-cloud-prod-${{ github.ref }}
+ cancel-in-progress: false
+
+jobs:
+ build:
+ uses: ./.github/workflows/_build-cloud.yml
+ with:
+ environment: prod
+ git_ref: ${{ github.ref }}
+ docker_tags: |
+ type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
+ type=sha,format=long,enable=${{ github.ref == 'refs/heads/main' }}
+ type=semver,pattern=v{{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ secrets: inherit

Dockerfile

@@ -61,19 +61,12 @@ ENV NEXT_PUBLIC_LANGFUSE_BASE_URL=$NEXT_PUBLIC_LANGFUSE_BASE_URL
 ARG NEXT_PUBLIC_BUILD_COMMIT_SHA
 ENV NEXT_PUBLIC_BUILD_COMMIT_SHA=$NEXT_PUBLIC_BUILD_COMMIT_SHA
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
-# @see : next.config.mjs
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_WEBAPP_PROJECT
 ENV SENTRY_WEBAPP_PROJECT=$SENTRY_WEBAPP_PROJECT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 # -----------
 
 RUN apk add --no-cache libc6-compat
@@ -92,7 +85,9 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/web install
 
 ENV NEXT_TELEMETRY_DISABLED=1
-RUN yarn workspace @sourcebot/web build
+
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+ yarn workspace @sourcebot/web build
 ENV SKIP_ENV_VALIDATION=0
 # ------------------------------
 
@@ -101,16 +96,10 @@ FROM node-alpine AS backend-builder
 ENV SKIP_ENV_VALIDATION=1
 # -----------
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_BACKEND_PROJECT
 ENV SENTRY_BACKEND_PROJECT=$SENTRY_BACKEND_PROJECT
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
 # -----------
@@ -129,11 +118,10 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/backend install
 RUN yarn workspace @sourcebot/backend build
 
-# Upload source maps to Sentry if we have the necessary build-time args.
-RUN if [ -n "$SENTRY_SMUAT" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+if [ -n "$SENTRY_AUTH_TOKEN" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
  apk add --no-cache curl; \
  curl -sL https://sentry.io/get-cli/ | sh; \
- sentry-cli login --auth-token $SENTRY_SMUAT; \
  sentry-cli sourcemaps inject --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
  sentry-cli sourcemaps upload --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
 fi

packages/backend/src/instrument.ts

@@ -7,7 +7,10 @@ const logger = createLogger('instrument');
 if (!!env.NEXT_PUBLIC_SENTRY_BACKEND_DSN && !!env.NEXT_PUBLIC_SENTRY_ENVIRONMENT) {
  Sentry.init({
  dsn: env.NEXT_PUBLIC_SENTRY_BACKEND_DSN,
- release: SOURCEBOT_VERSION,
+ // Must match the release our source maps are uploaded under, which the
+ // Dockerfile sets from SENTRY_RELEASE (the build's commit SHA). Falls back
+ // to the version for builds that don't pass a commit SHA.
+ release: env.NEXT_PUBLIC_BUILD_COMMIT_SHA ?? SOURCEBOT_VERSION,
  environment: env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
  });
 } else {

packages/web/next.config.mjs

@@ -146,8 +146,8 @@ export default withSentryConfig(nextConfig, {
  // For all available options, see:
  org: process.env.SENTRY_ORG,
  project: process.env.SENTRY_WEBAPP_PROJECT,
- authToken: process.env.SENTRY_SMUAT,
- release: process.env.SENTRY_RELEASE,
+ authToken: process.env.SENTRY_AUTH_TOKEN,
+ release: { name: process.env.SENTRY_RELEASE },
 
  // Only print logs for uploading source maps in CI
  silent: !process.env.CI,

packages/web/sentry.client.config.ts → packages/web/src/instrumentation-client.ts

@@ -1,6 +1,10 @@
 // This file configures the initialization of Sentry on the client.
 // The config you add here will be used whenever a users loads a page in their browser.
 // https://docs.sentry.io/platforms/javascript/guides/nextjs/
+//
+// Must be named `instrumentation-client.ts`. Next.js loads this file itself, whereas
+// `sentry.client.config.ts` is only picked up by @sentry/nextjs' webpack plugin,
+// which never runs since `next build` defaults to Turbopack.
 
 import * as Sentry from "@sentry/nextjs";
 
@@ -9,9 +13,15 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });
 } else {
  console.debug("[client] Sentry was not initialized");
 }
+
+// Instruments App Router client-side navigations as spans. Next.js only reads this
+// export from `instrumentation-client.ts`. A no-op when Sentry is uninitialized.
+export const onRouterTransitionStart = Sentry.captureRouterTransitionStart;

packages/web/src/instrumentation.ts

@@ -19,11 +19,11 @@ export async function register() {
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {
- await import('../sentry.server.config');
+ await import('./sentry.server.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'edge') {
- await import('../sentry.edge.config');
+ await import('./sentry.edge.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {

packages/web/sentry.edge.config.ts → packages/web/src/sentry.edge.config.ts

@@ -10,6 +10,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

packages/web/sentry.server.config.ts → packages/web/src/sentry.server.config.ts

@@ -12,6 +12,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

.github/workflows/_build-cloud.yml

@@ -0,0 +1,157 @@
+# Internal reusable workflow for building a non-OSS ("cloud") Docker image and
+# pushing it to Amazon ECR.
+name: Build Cloud Image
+
+on:
+ workflow_call:
+ inputs:
+ environment:
+ description: "GitHub Environment supplying the Sentry vars/secrets. Also scopes the OIDC subject used to assume the ECR push role."
+ required: true
+ type: string
+ git_ref:
+ description: "Git ref to checkout and build"
+ required: true
+ type: string
+ docker_tags:
+ description: "Docker tags configuration for docker/metadata-action"
+ required: true
+ type: string
+ aws_region:
+ description: "Region the ECR repository lives in"
+ required: false
+ type: string
+ default: us-west-1
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ environment: ${{ inputs.environment }}
+ permissions:
+ contents: read
+ # Required to request the OIDC token that assumes the AWS role.
+ id-token: write
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ inputs.git_ref }}
+ submodules: "true"
+ fetch-depth: 0
+ # Nothing after checkout talks to the remote, so don't leave the token
+ # behind in the workspace's .git/config.
+ persist-credentials: false
+
+ - name: Resolve build commit SHA
+ id: commit
+ run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+ - name: Validate environment configuration
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+ AWS_ECR_ROLE_ARN: ${{ vars.AWS_ECR_ROLE_ARN }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT: ${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ SENTRY_ORG: ${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT: ${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT: ${{ vars.SENTRY_BACKEND_PROJECT }}
+ run: |
+ missing=0
+ for name in SENTRY_AUTH_TOKEN AWS_ECR_ROLE_ARN \
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT \
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN \
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN \
+ SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT; do
+ if [ -z "${!name}" ]; then
+ echo "::error::${name} is not set on the '${ENVIRONMENT}' environment (or the repository)."
+ missing=1
+ else
+ echo "ok: ${name}"
+ fi
+ done
+ if [ "$missing" -ne 0 ]; then
+ echo "::error::Refusing to build: the image would ship without Sentry wiring."
+ exit 1
+ fi
+
+ - name: Check Prisma migrations
+ uses: ./.github/actions/check-prisma-migrations
+
+ - name: Configure AWS credentials
+ uses: aws-actions/configure-aws-credentials@v4
+ with:
+ role-to-assume: ${{ vars.AWS_ECR_ROLE_ARN }}
+ aws-region: ${{ inputs.aws_region }}
+
+ - name: Login to Amazon ECR
+ id: ecr
+ uses: aws-actions/amazon-ecr-login@v2
+
+ # Each environment publishes to its own registry (see CicdStack), so a
+ # staging build can never overwrite a prod tag.
+ - name: Extract Docker metadata
+ id: meta
+ uses: docker/metadata-action@v5
+ with:
+ images: ${{ steps.ecr.outputs.registry }}/sourcebot-${{ inputs.environment }}
+ tags: ${{ inputs.docker_tags }}
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
+ - name: Build and push Docker image
+ uses: docker/build-push-action@v7
+ with:
+ context: .
+ platforms: linux/amd64
+ push: true
+ tags: ${{ steps.meta.outputs.tags }}
+ labels: ${{ steps.meta.outputs.labels }}
+ # SENTRY_RELEASE is the commit SHA rather than SOURCEBOT_VERSION so that
+ # every prod build gets a distinct release (prod tracks `main`, where the
+ # version only moves on a tagged release). packages/backend/src/instrument.ts
+ # reports NEXT_PUBLIC_BUILD_COMMIT_SHA as its release to match; the webapp
+ # gets SENTRY_RELEASE injected into its bundle by withSentryConfig.
+ build-args: |
+ NEXT_PUBLIC_BUILD_COMMIT_SHA=${{ steps.commit.outputs.sha }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT=${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN=${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN=${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY=${{ vars.NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY }}
+ NEXT_PUBLIC_LANGFUSE_BASE_URL=${{ vars.NEXT_PUBLIC_LANGFUSE_BASE_URL }}
+ SENTRY_ORG=${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT=${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT=${{ vars.SENTRY_BACKEND_PROJECT }}
+ SENTRY_RELEASE=${{ steps.commit.outputs.sha }}
+ # Passed as a secret, not a build-arg: build args are recorded in layer
+ # metadata that `mode=max` exports to the cache. @see: Dockerfile
+ secrets: |
+ sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+ # Cache scope is per-environment, and distinct from the OSS build's
+ # (which is keyed on platform alone). Sharing a scope would let a build
+ # that never sees SENTRY_AUTH_TOKEN restore layers from one that did.
+ cache-from: type=gha,scope=cloud-${{ inputs.environment }}-amd64
+ cache-to: type=gha,mode=max,scope=cloud-${{ inputs.environment }}-amd64
+
+ - name: Summarize
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ COMMIT_SHA: ${{ steps.commit.outputs.sha }}
+ TAGS: ${{ steps.meta.outputs.tags }}
+ run: |
+ {
+ echo "### Pushed to ECR"
+ echo
+ echo "| | |"
+ echo "|---|---|"
+ echo "| Environment | \`${ENVIRONMENT}\` |"
+ echo "| Commit | \`${COMMIT_SHA}\` |"
+ echo "| Sentry release | \`${COMMIT_SHA}\` |"
+ echo
+ echo '```'
+ echo "$TAGS"
+ echo '```'
+ } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-cloud-prod.yml

@@ -0,0 +1,28 @@
+name: Release Sourcebot (Cloud - Production)
+
+permissions:
+ contents: read
+ id-token: write
+
+on:
+ push:
+ branches: ["main"]
+ tags: ["v*.*.*"]
+ workflow_dispatch:
+
+concurrency:
+ group: release-cloud-prod-${{ github.ref }}
+ cancel-in-progress: false
+
+jobs:
+ build:
+ uses: ./.github/workflows/_build-cloud.yml
+ with:
+ environment: prod
+ git_ref: ${{ github.ref }}
+ docker_tags: |
+ type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
+ type=sha,format=long,enable=${{ github.ref == 'refs/heads/main' }}
+ type=semver,pattern=v{{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ secrets: inherit

Dockerfile

@@ -61,19 +61,12 @@ ENV NEXT_PUBLIC_LANGFUSE_BASE_URL=$NEXT_PUBLIC_LANGFUSE_BASE_URL
 ARG NEXT_PUBLIC_BUILD_COMMIT_SHA
 ENV NEXT_PUBLIC_BUILD_COMMIT_SHA=$NEXT_PUBLIC_BUILD_COMMIT_SHA
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
-# @see : next.config.mjs
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_WEBAPP_PROJECT
 ENV SENTRY_WEBAPP_PROJECT=$SENTRY_WEBAPP_PROJECT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 # -----------
 
 RUN apk add --no-cache libc6-compat
@@ -92,7 +85,9 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/web install
 
 ENV NEXT_TELEMETRY_DISABLED=1
-RUN yarn workspace @sourcebot/web build
+
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+ yarn workspace @sourcebot/web build
 ENV SKIP_ENV_VALIDATION=0
 # ------------------------------
 
@@ -101,16 +96,10 @@ FROM node-alpine AS backend-builder
 ENV SKIP_ENV_VALIDATION=1
 # -----------
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_BACKEND_PROJECT
 ENV SENTRY_BACKEND_PROJECT=$SENTRY_BACKEND_PROJECT
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
 # -----------
@@ -129,11 +118,10 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/backend install
 RUN yarn workspace @sourcebot/backend build
 
-# Upload source maps to Sentry if we have the necessary build-time args.
-RUN if [ -n "$SENTRY_SMUAT" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+if [ -n "$SENTRY_AUTH_TOKEN" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
  apk add --no-cache curl; \
  curl -sL https://sentry.io/get-cli/ | sh; \
- sentry-cli login --auth-token $SENTRY_SMUAT; \
  sentry-cli sourcemaps inject --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
  sentry-cli sourcemaps upload --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
 fi

packages/backend/src/instrument.ts

@@ -7,7 +7,10 @@ const logger = createLogger('instrument');
 if (!!env.NEXT_PUBLIC_SENTRY_BACKEND_DSN && !!env.NEXT_PUBLIC_SENTRY_ENVIRONMENT) {
  Sentry.init({
  dsn: env.NEXT_PUBLIC_SENTRY_BACKEND_DSN,
- release: SOURCEBOT_VERSION,
+ // Must match the release our source maps are uploaded under, which the
+ // Dockerfile sets from SENTRY_RELEASE (the build's commit SHA). Falls back
+ // to the version for builds that don't pass a commit SHA.
+ release: env.NEXT_PUBLIC_BUILD_COMMIT_SHA ?? SOURCEBOT_VERSION,
  environment: env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
  });
 } else {

packages/web/next.config.mjs

@@ -146,8 +146,8 @@ export default withSentryConfig(nextConfig, {
  // For all available options, see:
  org: process.env.SENTRY_ORG,
  project: process.env.SENTRY_WEBAPP_PROJECT,
- authToken: process.env.SENTRY_SMUAT,
- release: process.env.SENTRY_RELEASE,
+ authToken: process.env.SENTRY_AUTH_TOKEN,
+ release: { name: process.env.SENTRY_RELEASE },
 
  // Only print logs for uploading source maps in CI
  silent: !process.env.CI,

packages/web/sentry.client.config.ts → packages/web/src/instrumentation-client.ts

@@ -1,6 +1,10 @@
 // This file configures the initialization of Sentry on the client.
 // The config you add here will be used whenever a users loads a page in their browser.
 // https://docs.sentry.io/platforms/javascript/guides/nextjs/
+//
+// Must be named `instrumentation-client.ts`. Next.js loads this file itself, whereas
+// `sentry.client.config.ts` is only picked up by @sentry/nextjs' webpack plugin,
+// which never runs since `next build` defaults to Turbopack.
 
 import * as Sentry from "@sentry/nextjs";
 
@@ -9,9 +13,15 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });
 } else {
  console.debug("[client] Sentry was not initialized");
 }
+
+// Instruments App Router client-side navigations as spans. Next.js only reads this
+// export from `instrumentation-client.ts`. A no-op when Sentry is uninitialized.
+export const onRouterTransitionStart = Sentry.captureRouterTransitionStart;

packages/web/src/instrumentation.ts

@@ -19,11 +19,11 @@ export async function register() {
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {
- await import('../sentry.server.config');
+ await import('./sentry.server.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'edge') {
- await import('../sentry.edge.config');
+ await import('./sentry.edge.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {

packages/web/sentry.edge.config.ts → packages/web/src/sentry.edge.config.ts

@@ -10,6 +10,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

packages/web/sentry.server.config.ts → packages/web/src/sentry.server.config.ts

@@ -12,6 +12,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

.github/workflows/_build-cloud.yml

@@ -0,0 +1,157 @@
+# Internal reusable workflow for building a non-OSS ("cloud") Docker image and
+# pushing it to Amazon ECR.
+name: Build Cloud Image
+
+on:
+ workflow_call:
+ inputs:
+ environment:
+ description: "GitHub Environment supplying the Sentry vars/secrets. Also scopes the OIDC subject used to assume the ECR push role."
+ required: true
+ type: string
+ git_ref:
+ description: "Git ref to checkout and build"
+ required: true
+ type: string
+ docker_tags:
+ description: "Docker tags configuration for docker/metadata-action"
+ required: true
+ type: string
+ aws_region:
+ description: "Region the ECR repository lives in"
+ required: false
+ type: string
+ default: us-west-1
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ environment: ${{ inputs.environment }}
+ permissions:
+ contents: read
+ # Required to request the OIDC token that assumes the AWS role.
+ id-token: write
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ inputs.git_ref }}
+ submodules: "true"
+ fetch-depth: 0
+ # Nothing after checkout talks to the remote, so don't leave the token
+ # behind in the workspace's .git/config.
+ persist-credentials: false
+
+ - name: Resolve build commit SHA
+ id: commit
+ run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+ - name: Validate environment configuration
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+ AWS_ECR_ROLE_ARN: ${{ vars.AWS_ECR_ROLE_ARN }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT: ${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ SENTRY_ORG: ${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT: ${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT: ${{ vars.SENTRY_BACKEND_PROJECT }}
+ run: |
+ missing=0
+ for name in SENTRY_AUTH_TOKEN AWS_ECR_ROLE_ARN \
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT \
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN \
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN \
+ SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT; do
+ if [ -z "${!name}" ]; then
+ echo "::error::${name} is not set on the '${ENVIRONMENT}' environment (or the repository)."
+ missing=1
+ else
+ echo "ok: ${name}"
+ fi
+ done
+ if [ "$missing" -ne 0 ]; then
+ echo "::error::Refusing to build: the image would ship without Sentry wiring."
+ exit 1
+ fi
+
+ - name: Check Prisma migrations
+ uses: ./.github/actions/check-prisma-migrations
+
+ - name: Configure AWS credentials
+ uses: aws-actions/configure-aws-credentials@v4
+ with:
+ role-to-assume: ${{ vars.AWS_ECR_ROLE_ARN }}
+ aws-region: ${{ inputs.aws_region }}
+
+ - name: Login to Amazon ECR
+ id: ecr
+ uses: aws-actions/amazon-ecr-login@v2
+
+ # Each environment publishes to its own registry (see CicdStack), so a
+ # staging build can never overwrite a prod tag.
+ - name: Extract Docker metadata
+ id: meta
+ uses: docker/metadata-action@v5
+ with:
+ images: ${{ steps.ecr.outputs.registry }}/sourcebot-${{ inputs.environment }}
+ tags: ${{ inputs.docker_tags }}
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
+ - name: Build and push Docker image
+ uses: docker/build-push-action@v7
+ with:
+ context: .
+ platforms: linux/amd64
+ push: true
+ tags: ${{ steps.meta.outputs.tags }}
+ labels: ${{ steps.meta.outputs.labels }}
+ # SENTRY_RELEASE is the commit SHA rather than SOURCEBOT_VERSION so that
+ # every prod build gets a distinct release (prod tracks `main`, where the
+ # version only moves on a tagged release). packages/backend/src/instrument.ts
+ # reports NEXT_PUBLIC_BUILD_COMMIT_SHA as its release to match; the webapp
+ # gets SENTRY_RELEASE injected into its bundle by withSentryConfig.
+ build-args: |
+ NEXT_PUBLIC_BUILD_COMMIT_SHA=${{ steps.commit.outputs.sha }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT=${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN=${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN=${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY=${{ vars.NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY }}
+ NEXT_PUBLIC_LANGFUSE_BASE_URL=${{ vars.NEXT_PUBLIC_LANGFUSE_BASE_URL }}
+ SENTRY_ORG=${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT=${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT=${{ vars.SENTRY_BACKEND_PROJECT }}
+ SENTRY_RELEASE=${{ steps.commit.outputs.sha }}
+ # Passed as a secret, not a build-arg: build args are recorded in layer
+ # metadata that `mode=max` exports to the cache. @see: Dockerfile
+ secrets: |
+ sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+ # Cache scope is per-environment, and distinct from the OSS build's
+ # (which is keyed on platform alone). Sharing a scope would let a build
+ # that never sees SENTRY_AUTH_TOKEN restore layers from one that did.
+ cache-from: type=gha,scope=cloud-${{ inputs.environment }}-amd64
+ cache-to: type=gha,mode=max,scope=cloud-${{ inputs.environment }}-amd64
+
+ - name: Summarize
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ COMMIT_SHA: ${{ steps.commit.outputs.sha }}
+ TAGS: ${{ steps.meta.outputs.tags }}
+ run: |
+ {
+ echo "### Pushed to ECR"
+ echo
+ echo "| | |"
+ echo "|---|---|"
+ echo "| Environment | \`${ENVIRONMENT}\` |"
+ echo "| Commit | \`${COMMIT_SHA}\` |"
+ echo "| Sentry release | \`${COMMIT_SHA}\` |"
+ echo
+ echo '```'
+ echo "$TAGS"
+ echo '```'
+ } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-cloud-prod.yml

@@ -0,0 +1,28 @@
+name: Release Sourcebot (Cloud - Production)
+
+permissions:
+ contents: read
+ id-token: write
+
+on:
+ push:
+ branches: ["main"]
+ tags: ["v*.*.*"]
+ workflow_dispatch:
+
+concurrency:
+ group: release-cloud-prod-${{ github.ref }}
+ cancel-in-progress: false
+
+jobs:
+ build:
+ uses: ./.github/workflows/_build-cloud.yml
+ with:
+ environment: prod
+ git_ref: ${{ github.ref }}
+ docker_tags: |
+ type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
+ type=sha,format=long,enable=${{ github.ref == 'refs/heads/main' }}
+ type=semver,pattern=v{{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ secrets: inherit

Dockerfile

@@ -61,19 +61,12 @@ ENV NEXT_PUBLIC_LANGFUSE_BASE_URL=$NEXT_PUBLIC_LANGFUSE_BASE_URL
 ARG NEXT_PUBLIC_BUILD_COMMIT_SHA
 ENV NEXT_PUBLIC_BUILD_COMMIT_SHA=$NEXT_PUBLIC_BUILD_COMMIT_SHA
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
-# @see : next.config.mjs
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_WEBAPP_PROJECT
 ENV SENTRY_WEBAPP_PROJECT=$SENTRY_WEBAPP_PROJECT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 # -----------
 
 RUN apk add --no-cache libc6-compat
@@ -92,7 +85,9 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/web install
 
 ENV NEXT_TELEMETRY_DISABLED=1
-RUN yarn workspace @sourcebot/web build
+
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+ yarn workspace @sourcebot/web build
 ENV SKIP_ENV_VALIDATION=0
 # ------------------------------
 
@@ -101,16 +96,10 @@ FROM node-alpine AS backend-builder
 ENV SKIP_ENV_VALIDATION=1
 # -----------
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_BACKEND_PROJECT
 ENV SENTRY_BACKEND_PROJECT=$SENTRY_BACKEND_PROJECT
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
 # -----------
@@ -129,11 +118,10 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/backend install
 RUN yarn workspace @sourcebot/backend build
 
-# Upload source maps to Sentry if we have the necessary build-time args.
-RUN if [ -n "$SENTRY_SMUAT" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+if [ -n "$SENTRY_AUTH_TOKEN" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
  apk add --no-cache curl; \
  curl -sL https://sentry.io/get-cli/ | sh; \
- sentry-cli login --auth-token $SENTRY_SMUAT; \
  sentry-cli sourcemaps inject --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
  sentry-cli sourcemaps upload --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
 fi

packages/backend/src/instrument.ts

@@ -7,7 +7,10 @@ const logger = createLogger('instrument');
 if (!!env.NEXT_PUBLIC_SENTRY_BACKEND_DSN && !!env.NEXT_PUBLIC_SENTRY_ENVIRONMENT) {
  Sentry.init({
  dsn: env.NEXT_PUBLIC_SENTRY_BACKEND_DSN,
- release: SOURCEBOT_VERSION,
+ // Must match the release our source maps are uploaded under, which the
+ // Dockerfile sets from SENTRY_RELEASE (the build's commit SHA). Falls back
+ // to the version for builds that don't pass a commit SHA.
+ release: env.NEXT_PUBLIC_BUILD_COMMIT_SHA ?? SOURCEBOT_VERSION,
  environment: env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
  });
 } else {

packages/web/next.config.mjs

@@ -146,8 +146,8 @@ export default withSentryConfig(nextConfig, {
  // For all available options, see:
  org: process.env.SENTRY_ORG,
  project: process.env.SENTRY_WEBAPP_PROJECT,
- authToken: process.env.SENTRY_SMUAT,
- release: process.env.SENTRY_RELEASE,
+ authToken: process.env.SENTRY_AUTH_TOKEN,
+ release: { name: process.env.SENTRY_RELEASE },
 
  // Only print logs for uploading source maps in CI
  silent: !process.env.CI,

packages/web/sentry.client.config.ts → packages/web/src/instrumentation-client.ts

@@ -1,6 +1,10 @@
 // This file configures the initialization of Sentry on the client.
 // The config you add here will be used whenever a users loads a page in their browser.
 // https://docs.sentry.io/platforms/javascript/guides/nextjs/
+//
+// Must be named `instrumentation-client.ts`. Next.js loads this file itself, whereas
+// `sentry.client.config.ts` is only picked up by @sentry/nextjs' webpack plugin,
+// which never runs since `next build` defaults to Turbopack.
 
 import * as Sentry from "@sentry/nextjs";
 
@@ -9,9 +13,15 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });
 } else {
  console.debug("[client] Sentry was not initialized");
 }
+
+// Instruments App Router client-side navigations as spans. Next.js only reads this
+// export from `instrumentation-client.ts`. A no-op when Sentry is uninitialized.
+export const onRouterTransitionStart = Sentry.captureRouterTransitionStart;

packages/web/src/instrumentation.ts

@@ -19,11 +19,11 @@ export async function register() {
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {
- await import('../sentry.server.config');
+ await import('./sentry.server.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'edge') {
- await import('../sentry.edge.config');
+ await import('./sentry.edge.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {

packages/web/sentry.edge.config.ts → packages/web/src/sentry.edge.config.ts

@@ -10,6 +10,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

packages/web/sentry.server.config.ts → packages/web/src/sentry.server.config.ts

@@ -12,6 +12,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

.github/workflows/_build-cloud.yml

@@ -0,0 +1,157 @@
+# Internal reusable workflow for building a non-OSS ("cloud") Docker image and
+# pushing it to Amazon ECR.
+name: Build Cloud Image
+
+on:
+ workflow_call:
+ inputs:
+ environment:
+ description: "GitHub Environment supplying the Sentry vars/secrets. Also scopes the OIDC subject used to assume the ECR push role."
+ required: true
+ type: string
+ git_ref:
+ description: "Git ref to checkout and build"
+ required: true
+ type: string
+ docker_tags:
+ description: "Docker tags configuration for docker/metadata-action"
+ required: true
+ type: string
+ aws_region:
+ description: "Region the ECR repository lives in"
+ required: false
+ type: string
+ default: us-west-1
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ environment: ${{ inputs.environment }}
+ permissions:
+ contents: read
+ # Required to request the OIDC token that assumes the AWS role.
+ id-token: write
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ inputs.git_ref }}
+ submodules: "true"
+ fetch-depth: 0
+ # Nothing after checkout talks to the remote, so don't leave the token
+ # behind in the workspace's .git/config.
+ persist-credentials: false
+
+ - name: Resolve build commit SHA
+ id: commit
+ run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+ - name: Validate environment configuration
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+ AWS_ECR_ROLE_ARN: ${{ vars.AWS_ECR_ROLE_ARN }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT: ${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ SENTRY_ORG: ${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT: ${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT: ${{ vars.SENTRY_BACKEND_PROJECT }}
+ run: |
+ missing=0
+ for name in SENTRY_AUTH_TOKEN AWS_ECR_ROLE_ARN \
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT \
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN \
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN \
+ SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT; do
+ if [ -z "${!name}" ]; then
+ echo "::error::${name} is not set on the '${ENVIRONMENT}' environment (or the repository)."
+ missing=1
+ else
+ echo "ok: ${name}"
+ fi
+ done
+ if [ "$missing" -ne 0 ]; then
+ echo "::error::Refusing to build: the image would ship without Sentry wiring."
+ exit 1
+ fi
+
+ - name: Check Prisma migrations
+ uses: ./.github/actions/check-prisma-migrations
+
+ - name: Configure AWS credentials
+ uses: aws-actions/configure-aws-credentials@v4
+ with:
+ role-to-assume: ${{ vars.AWS_ECR_ROLE_ARN }}
+ aws-region: ${{ inputs.aws_region }}
+
+ - name: Login to Amazon ECR
+ id: ecr
+ uses: aws-actions/amazon-ecr-login@v2
+
+ # Each environment publishes to its own registry (see CicdStack), so a
+ # staging build can never overwrite a prod tag.
+ - name: Extract Docker metadata
+ id: meta
+ uses: docker/metadata-action@v5
+ with:
+ images: ${{ steps.ecr.outputs.registry }}/sourcebot-${{ inputs.environment }}
+ tags: ${{ inputs.docker_tags }}
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
+ - name: Build and push Docker image
+ uses: docker/build-push-action@v7
+ with:
+ context: .
+ platforms: linux/amd64
+ push: true
+ tags: ${{ steps.meta.outputs.tags }}
+ labels: ${{ steps.meta.outputs.labels }}
+ # SENTRY_RELEASE is the commit SHA rather than SOURCEBOT_VERSION so that
+ # every prod build gets a distinct release (prod tracks `main`, where the
+ # version only moves on a tagged release). packages/backend/src/instrument.ts
+ # reports NEXT_PUBLIC_BUILD_COMMIT_SHA as its release to match; the webapp
+ # gets SENTRY_RELEASE injected into its bundle by withSentryConfig.
+ build-args: |
+ NEXT_PUBLIC_BUILD_COMMIT_SHA=${{ steps.commit.outputs.sha }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT=${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN=${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN=${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY=${{ vars.NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY }}
+ NEXT_PUBLIC_LANGFUSE_BASE_URL=${{ vars.NEXT_PUBLIC_LANGFUSE_BASE_URL }}
+ SENTRY_ORG=${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT=${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT=${{ vars.SENTRY_BACKEND_PROJECT }}
+ SENTRY_RELEASE=${{ steps.commit.outputs.sha }}
+ # Passed as a secret, not a build-arg: build args are recorded in layer
+ # metadata that `mode=max` exports to the cache. @see: Dockerfile
+ secrets: |
+ sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+ # Cache scope is per-environment, and distinct from the OSS build's
+ # (which is keyed on platform alone). Sharing a scope would let a build
+ # that never sees SENTRY_AUTH_TOKEN restore layers from one that did.
+ cache-from: type=gha,scope=cloud-${{ inputs.environment }}-amd64
+ cache-to: type=gha,mode=max,scope=cloud-${{ inputs.environment }}-amd64
+
+ - name: Summarize
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ COMMIT_SHA: ${{ steps.commit.outputs.sha }}
+ TAGS: ${{ steps.meta.outputs.tags }}
+ run: |
+ {
+ echo "### Pushed to ECR"
+ echo
+ echo "| | |"
+ echo "|---|---|"
+ echo "| Environment | \`${ENVIRONMENT}\` |"
+ echo "| Commit | \`${COMMIT_SHA}\` |"
+ echo "| Sentry release | \`${COMMIT_SHA}\` |"
+ echo
+ echo '```'
+ echo "$TAGS"
+ echo '```'
+ } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-cloud-prod.yml

@@ -0,0 +1,28 @@
+name: Release Sourcebot (Cloud - Production)
+
+permissions:
+ contents: read
+ id-token: write
+
+on:
+ push:
+ branches: ["main"]
+ tags: ["v*.*.*"]
+ workflow_dispatch:
+
+concurrency:
+ group: release-cloud-prod-${{ github.ref }}
+ cancel-in-progress: false
+
+jobs:
+ build:
+ uses: ./.github/workflows/_build-cloud.yml
+ with:
+ environment: prod
+ git_ref: ${{ github.ref }}
+ docker_tags: |
+ type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
+ type=sha,format=long,enable=${{ github.ref == 'refs/heads/main' }}
+ type=semver,pattern=v{{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ secrets: inherit

Dockerfile

@@ -61,19 +61,12 @@ ENV NEXT_PUBLIC_LANGFUSE_BASE_URL=$NEXT_PUBLIC_LANGFUSE_BASE_URL
 ARG NEXT_PUBLIC_BUILD_COMMIT_SHA
 ENV NEXT_PUBLIC_BUILD_COMMIT_SHA=$NEXT_PUBLIC_BUILD_COMMIT_SHA
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
-# @see : next.config.mjs
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_WEBAPP_PROJECT
 ENV SENTRY_WEBAPP_PROJECT=$SENTRY_WEBAPP_PROJECT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 # -----------
 
 RUN apk add --no-cache libc6-compat
@@ -92,7 +85,9 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/web install
 
 ENV NEXT_TELEMETRY_DISABLED=1
-RUN yarn workspace @sourcebot/web build
+
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+ yarn workspace @sourcebot/web build
 ENV SKIP_ENV_VALIDATION=0
 # ------------------------------
 
@@ -101,16 +96,10 @@ FROM node-alpine AS backend-builder
 ENV SKIP_ENV_VALIDATION=1
 # -----------
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_BACKEND_PROJECT
 ENV SENTRY_BACKEND_PROJECT=$SENTRY_BACKEND_PROJECT
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
 # -----------
@@ -129,11 +118,10 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/backend install
 RUN yarn workspace @sourcebot/backend build
 
-# Upload source maps to Sentry if we have the necessary build-time args.
-RUN if [ -n "$SENTRY_SMUAT" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+if [ -n "$SENTRY_AUTH_TOKEN" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
  apk add --no-cache curl; \
  curl -sL https://sentry.io/get-cli/ | sh; \
- sentry-cli login --auth-token $SENTRY_SMUAT; \
  sentry-cli sourcemaps inject --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
  sentry-cli sourcemaps upload --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
 fi

packages/backend/src/instrument.ts

@@ -7,7 +7,10 @@ const logger = createLogger('instrument');
 if (!!env.NEXT_PUBLIC_SENTRY_BACKEND_DSN && !!env.NEXT_PUBLIC_SENTRY_ENVIRONMENT) {
  Sentry.init({
  dsn: env.NEXT_PUBLIC_SENTRY_BACKEND_DSN,
- release: SOURCEBOT_VERSION,
+ // Must match the release our source maps are uploaded under, which the
+ // Dockerfile sets from SENTRY_RELEASE (the build's commit SHA). Falls back
+ // to the version for builds that don't pass a commit SHA.
+ release: env.NEXT_PUBLIC_BUILD_COMMIT_SHA ?? SOURCEBOT_VERSION,
  environment: env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
  });
 } else {

packages/web/next.config.mjs

@@ -146,8 +146,8 @@ export default withSentryConfig(nextConfig, {
  // For all available options, see:
  org: process.env.SENTRY_ORG,
  project: process.env.SENTRY_WEBAPP_PROJECT,
- authToken: process.env.SENTRY_SMUAT,
- release: process.env.SENTRY_RELEASE,
+ authToken: process.env.SENTRY_AUTH_TOKEN,
+ release: { name: process.env.SENTRY_RELEASE },
 
  // Only print logs for uploading source maps in CI
  silent: !process.env.CI,

packages/web/sentry.client.config.ts → packages/web/src/instrumentation-client.ts

@@ -1,6 +1,10 @@
 // This file configures the initialization of Sentry on the client.
 // The config you add here will be used whenever a users loads a page in their browser.
 // https://docs.sentry.io/platforms/javascript/guides/nextjs/
+//
+// Must be named `instrumentation-client.ts`. Next.js loads this file itself, whereas
+// `sentry.client.config.ts` is only picked up by @sentry/nextjs' webpack plugin,
+// which never runs since `next build` defaults to Turbopack.
 
 import * as Sentry from "@sentry/nextjs";
 
@@ -9,9 +13,15 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });
 } else {
  console.debug("[client] Sentry was not initialized");
 }
+
+// Instruments App Router client-side navigations as spans. Next.js only reads this
+// export from `instrumentation-client.ts`. A no-op when Sentry is uninitialized.
+export const onRouterTransitionStart = Sentry.captureRouterTransitionStart;

packages/web/src/instrumentation.ts

@@ -19,11 +19,11 @@ export async function register() {
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {
- await import('../sentry.server.config');
+ await import('./sentry.server.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'edge') {
- await import('../sentry.edge.config');
+ await import('./sentry.edge.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {

packages/web/sentry.edge.config.ts → packages/web/src/sentry.edge.config.ts

@@ -10,6 +10,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

packages/web/sentry.server.config.ts → packages/web/src/sentry.server.config.ts

@@ -12,6 +12,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

.github/workflows/_build-cloud.yml

@@ -0,0 +1,157 @@
+# Internal reusable workflow for building a non-OSS ("cloud") Docker image and
+# pushing it to Amazon ECR.
+name: Build Cloud Image
+
+on:
+ workflow_call:
+ inputs:
+ environment:
+ description: "GitHub Environment supplying the Sentry vars/secrets. Also scopes the OIDC subject used to assume the ECR push role."
+ required: true
+ type: string
+ git_ref:
+ description: "Git ref to checkout and build"
+ required: true
+ type: string
+ docker_tags:
+ description: "Docker tags configuration for docker/metadata-action"
+ required: true
+ type: string
+ aws_region:
+ description: "Region the ECR repository lives in"
+ required: false
+ type: string
+ default: us-west-1
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ environment: ${{ inputs.environment }}
+ permissions:
+ contents: read
+ # Required to request the OIDC token that assumes the AWS role.
+ id-token: write
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ inputs.git_ref }}
+ submodules: "true"
+ fetch-depth: 0
+ # Nothing after checkout talks to the remote, so don't leave the token
+ # behind in the workspace's .git/config.
+ persist-credentials: false
+
+ - name: Resolve build commit SHA
+ id: commit
+ run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+ - name: Validate environment configuration
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+ AWS_ECR_ROLE_ARN: ${{ vars.AWS_ECR_ROLE_ARN }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT: ${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ SENTRY_ORG: ${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT: ${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT: ${{ vars.SENTRY_BACKEND_PROJECT }}
+ run: |
+ missing=0
+ for name in SENTRY_AUTH_TOKEN AWS_ECR_ROLE_ARN \
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT \
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN \
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN \
+ SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT; do
+ if [ -z "${!name}" ]; then
+ echo "::error::${name} is not set on the '${ENVIRONMENT}' environment (or the repository)."
+ missing=1
+ else
+ echo "ok: ${name}"
+ fi
+ done
+ if [ "$missing" -ne 0 ]; then
+ echo "::error::Refusing to build: the image would ship without Sentry wiring."
+ exit 1
+ fi
+
+ - name: Check Prisma migrations
+ uses: ./.github/actions/check-prisma-migrations
+
+ - name: Configure AWS credentials
+ uses: aws-actions/configure-aws-credentials@v4
+ with:
+ role-to-assume: ${{ vars.AWS_ECR_ROLE_ARN }}
+ aws-region: ${{ inputs.aws_region }}
+
+ - name: Login to Amazon ECR
+ id: ecr
+ uses: aws-actions/amazon-ecr-login@v2
+
+ # Each environment publishes to its own registry (see CicdStack), so a
+ # staging build can never overwrite a prod tag.
+ - name: Extract Docker metadata
+ id: meta
+ uses: docker/metadata-action@v5
+ with:
+ images: ${{ steps.ecr.outputs.registry }}/sourcebot-${{ inputs.environment }}
+ tags: ${{ inputs.docker_tags }}
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
+ - name: Build and push Docker image
+ uses: docker/build-push-action@v7
+ with:
+ context: .
+ platforms: linux/amd64
+ push: true
+ tags: ${{ steps.meta.outputs.tags }}
+ labels: ${{ steps.meta.outputs.labels }}
+ # SENTRY_RELEASE is the commit SHA rather than SOURCEBOT_VERSION so that
+ # every prod build gets a distinct release (prod tracks `main`, where the
+ # version only moves on a tagged release). packages/backend/src/instrument.ts
+ # reports NEXT_PUBLIC_BUILD_COMMIT_SHA as its release to match; the webapp
+ # gets SENTRY_RELEASE injected into its bundle by withSentryConfig.
+ build-args: |
+ NEXT_PUBLIC_BUILD_COMMIT_SHA=${{ steps.commit.outputs.sha }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT=${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN=${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN=${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY=${{ vars.NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY }}
+ NEXT_PUBLIC_LANGFUSE_BASE_URL=${{ vars.NEXT_PUBLIC_LANGFUSE_BASE_URL }}
+ SENTRY_ORG=${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT=${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT=${{ vars.SENTRY_BACKEND_PROJECT }}
+ SENTRY_RELEASE=${{ steps.commit.outputs.sha }}
+ # Passed as a secret, not a build-arg: build args are recorded in layer
+ # metadata that `mode=max` exports to the cache. @see: Dockerfile
+ secrets: |
+ sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+ # Cache scope is per-environment, and distinct from the OSS build's
+ # (which is keyed on platform alone). Sharing a scope would let a build
+ # that never sees SENTRY_AUTH_TOKEN restore layers from one that did.
+ cache-from: type=gha,scope=cloud-${{ inputs.environment }}-amd64
+ cache-to: type=gha,mode=max,scope=cloud-${{ inputs.environment }}-amd64
+
+ - name: Summarize
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ COMMIT_SHA: ${{ steps.commit.outputs.sha }}
+ TAGS: ${{ steps.meta.outputs.tags }}
+ run: |
+ {
+ echo "### Pushed to ECR"
+ echo
+ echo "| | |"
+ echo "|---|---|"
+ echo "| Environment | \`${ENVIRONMENT}\` |"
+ echo "| Commit | \`${COMMIT_SHA}\` |"
+ echo "| Sentry release | \`${COMMIT_SHA}\` |"
+ echo
+ echo '```'
+ echo "$TAGS"
+ echo '```'
+ } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-cloud-prod.yml

@@ -0,0 +1,28 @@
+name: Release Sourcebot (Cloud - Production)
+
+permissions:
+ contents: read
+ id-token: write
+
+on:
+ push:
+ branches: ["main"]
+ tags: ["v*.*.*"]
+ workflow_dispatch:
+
+concurrency:
+ group: release-cloud-prod-${{ github.ref }}
+ cancel-in-progress: false
+
+jobs:
+ build:
+ uses: ./.github/workflows/_build-cloud.yml
+ with:
+ environment: prod
+ git_ref: ${{ github.ref }}
+ docker_tags: |
+ type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
+ type=sha,format=long,enable=${{ github.ref == 'refs/heads/main' }}
+ type=semver,pattern=v{{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ secrets: inherit

Dockerfile

@@ -61,19 +61,12 @@ ENV NEXT_PUBLIC_LANGFUSE_BASE_URL=$NEXT_PUBLIC_LANGFUSE_BASE_URL
 ARG NEXT_PUBLIC_BUILD_COMMIT_SHA
 ENV NEXT_PUBLIC_BUILD_COMMIT_SHA=$NEXT_PUBLIC_BUILD_COMMIT_SHA
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
-# @see : next.config.mjs
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_WEBAPP_PROJECT
 ENV SENTRY_WEBAPP_PROJECT=$SENTRY_WEBAPP_PROJECT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 # -----------
 
 RUN apk add --no-cache libc6-compat
@@ -92,7 +85,9 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/web install
 
 ENV NEXT_TELEMETRY_DISABLED=1
-RUN yarn workspace @sourcebot/web build
+
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+ yarn workspace @sourcebot/web build
 ENV SKIP_ENV_VALIDATION=0
 # ------------------------------
 
@@ -101,16 +96,10 @@ FROM node-alpine AS backend-builder
 ENV SKIP_ENV_VALIDATION=1
 # -----------
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_BACKEND_PROJECT
 ENV SENTRY_BACKEND_PROJECT=$SENTRY_BACKEND_PROJECT
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
 # -----------
@@ -129,11 +118,10 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/backend install
 RUN yarn workspace @sourcebot/backend build
 
-# Upload source maps to Sentry if we have the necessary build-time args.
-RUN if [ -n "$SENTRY_SMUAT" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+if [ -n "$SENTRY_AUTH_TOKEN" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
  apk add --no-cache curl; \
  curl -sL https://sentry.io/get-cli/ | sh; \
- sentry-cli login --auth-token $SENTRY_SMUAT; \
  sentry-cli sourcemaps inject --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
  sentry-cli sourcemaps upload --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
 fi

packages/backend/src/instrument.ts

@@ -7,7 +7,10 @@ const logger = createLogger('instrument');
 if (!!env.NEXT_PUBLIC_SENTRY_BACKEND_DSN && !!env.NEXT_PUBLIC_SENTRY_ENVIRONMENT) {
  Sentry.init({
  dsn: env.NEXT_PUBLIC_SENTRY_BACKEND_DSN,
- release: SOURCEBOT_VERSION,
+ // Must match the release our source maps are uploaded under, which the
+ // Dockerfile sets from SENTRY_RELEASE (the build's commit SHA). Falls back
+ // to the version for builds that don't pass a commit SHA.
+ release: env.NEXT_PUBLIC_BUILD_COMMIT_SHA ?? SOURCEBOT_VERSION,
  environment: env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
  });
 } else {

packages/web/next.config.mjs

@@ -146,8 +146,8 @@ export default withSentryConfig(nextConfig, {
  // For all available options, see:
  org: process.env.SENTRY_ORG,
  project: process.env.SENTRY_WEBAPP_PROJECT,
- authToken: process.env.SENTRY_SMUAT,
- release: process.env.SENTRY_RELEASE,
+ authToken: process.env.SENTRY_AUTH_TOKEN,
+ release: { name: process.env.SENTRY_RELEASE },
 
  // Only print logs for uploading source maps in CI
  silent: !process.env.CI,

packages/web/sentry.client.config.ts → packages/web/src/instrumentation-client.ts

@@ -1,6 +1,10 @@
 // This file configures the initialization of Sentry on the client.
 // The config you add here will be used whenever a users loads a page in their browser.
 // https://docs.sentry.io/platforms/javascript/guides/nextjs/
+//
+// Must be named `instrumentation-client.ts`. Next.js loads this file itself, whereas
+// `sentry.client.config.ts` is only picked up by @sentry/nextjs' webpack plugin,
+// which never runs since `next build` defaults to Turbopack.
 
 import * as Sentry from "@sentry/nextjs";
 
@@ -9,9 +13,15 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });
 } else {
  console.debug("[client] Sentry was not initialized");
 }
+
+// Instruments App Router client-side navigations as spans. Next.js only reads this
+// export from `instrumentation-client.ts`. A no-op when Sentry is uninitialized.
+export const onRouterTransitionStart = Sentry.captureRouterTransitionStart;

packages/web/src/instrumentation.ts

@@ -19,11 +19,11 @@ export async function register() {
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {
- await import('../sentry.server.config');
+ await import('./sentry.server.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'edge') {
- await import('../sentry.edge.config');
+ await import('./sentry.edge.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {

packages/web/sentry.edge.config.ts → packages/web/src/sentry.edge.config.ts

@@ -10,6 +10,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

packages/web/sentry.server.config.ts → packages/web/src/sentry.server.config.ts

@@ -12,6 +12,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

.github/workflows/_build-cloud.yml

@@ -0,0 +1,157 @@
+# Internal reusable workflow for building a non-OSS ("cloud") Docker image and
+# pushing it to Amazon ECR.
+name: Build Cloud Image
+
+on:
+ workflow_call:
+ inputs:
+ environment:
+ description: "GitHub Environment supplying the Sentry vars/secrets. Also scopes the OIDC subject used to assume the ECR push role."
+ required: true
+ type: string
+ git_ref:
+ description: "Git ref to checkout and build"
+ required: true
+ type: string
+ docker_tags:
+ description: "Docker tags configuration for docker/metadata-action"
+ required: true
+ type: string
+ aws_region:
+ description: "Region the ECR repository lives in"
+ required: false
+ type: string
+ default: us-west-1
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ environment: ${{ inputs.environment }}
+ permissions:
+ contents: read
+ # Required to request the OIDC token that assumes the AWS role.
+ id-token: write
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ inputs.git_ref }}
+ submodules: "true"
+ fetch-depth: 0
+ # Nothing after checkout talks to the remote, so don't leave the token
+ # behind in the workspace's .git/config.
+ persist-credentials: false
+
+ - name: Resolve build commit SHA
+ id: commit
+ run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+ - name: Validate environment configuration
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+ AWS_ECR_ROLE_ARN: ${{ vars.AWS_ECR_ROLE_ARN }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT: ${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ SENTRY_ORG: ${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT: ${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT: ${{ vars.SENTRY_BACKEND_PROJECT }}
+ run: |
+ missing=0
+ for name in SENTRY_AUTH_TOKEN AWS_ECR_ROLE_ARN \
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT \
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN \
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN \
+ SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT; do
+ if [ -z "${!name}" ]; then
+ echo "::error::${name} is not set on the '${ENVIRONMENT}' environment (or the repository)."
+ missing=1
+ else
+ echo "ok: ${name}"
+ fi
+ done
+ if [ "$missing" -ne 0 ]; then
+ echo "::error::Refusing to build: the image would ship without Sentry wiring."
+ exit 1
+ fi
+
+ - name: Check Prisma migrations
+ uses: ./.github/actions/check-prisma-migrations
+
+ - name: Configure AWS credentials
+ uses: aws-actions/configure-aws-credentials@v4
+ with:
+ role-to-assume: ${{ vars.AWS_ECR_ROLE_ARN }}
+ aws-region: ${{ inputs.aws_region }}
+
+ - name: Login to Amazon ECR
+ id: ecr
+ uses: aws-actions/amazon-ecr-login@v2
+
+ # Each environment publishes to its own registry (see CicdStack), so a
+ # staging build can never overwrite a prod tag.
+ - name: Extract Docker metadata
+ id: meta
+ uses: docker/metadata-action@v5
+ with:
+ images: ${{ steps.ecr.outputs.registry }}/sourcebot-${{ inputs.environment }}
+ tags: ${{ inputs.docker_tags }}
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
+ - name: Build and push Docker image
+ uses: docker/build-push-action@v7
+ with:
+ context: .
+ platforms: linux/amd64
+ push: true
+ tags: ${{ steps.meta.outputs.tags }}
+ labels: ${{ steps.meta.outputs.labels }}
+ # SENTRY_RELEASE is the commit SHA rather than SOURCEBOT_VERSION so that
+ # every prod build gets a distinct release (prod tracks `main`, where the
+ # version only moves on a tagged release). packages/backend/src/instrument.ts
+ # reports NEXT_PUBLIC_BUILD_COMMIT_SHA as its release to match; the webapp
+ # gets SENTRY_RELEASE injected into its bundle by withSentryConfig.
+ build-args: |
+ NEXT_PUBLIC_BUILD_COMMIT_SHA=${{ steps.commit.outputs.sha }}
+ NEXT_PUBLIC_SENTRY_ENVIRONMENT=${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }}
+ NEXT_PUBLIC_SENTRY_WEBAPP_DSN=${{ vars.NEXT_PUBLIC_SENTRY_WEBAPP_DSN }}
+ NEXT_PUBLIC_SENTRY_BACKEND_DSN=${{ vars.NEXT_PUBLIC_SENTRY_BACKEND_DSN }}
+ NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY=${{ vars.NEXT_PUBLIC_LANGFUSE_PUBLIC_KEY }}
+ NEXT_PUBLIC_LANGFUSE_BASE_URL=${{ vars.NEXT_PUBLIC_LANGFUSE_BASE_URL }}
+ SENTRY_ORG=${{ vars.SENTRY_ORG }}
+ SENTRY_WEBAPP_PROJECT=${{ vars.SENTRY_WEBAPP_PROJECT }}
+ SENTRY_BACKEND_PROJECT=${{ vars.SENTRY_BACKEND_PROJECT }}
+ SENTRY_RELEASE=${{ steps.commit.outputs.sha }}
+ # Passed as a secret, not a build-arg: build args are recorded in layer
+ # metadata that `mode=max` exports to the cache. @see: Dockerfile
+ secrets: |
+ sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+ # Cache scope is per-environment, and distinct from the OSS build's
+ # (which is keyed on platform alone). Sharing a scope would let a build
+ # that never sees SENTRY_AUTH_TOKEN restore layers from one that did.
+ cache-from: type=gha,scope=cloud-${{ inputs.environment }}-amd64
+ cache-to: type=gha,mode=max,scope=cloud-${{ inputs.environment }}-amd64
+
+ - name: Summarize
+ env:
+ ENVIRONMENT: ${{ inputs.environment }}
+ COMMIT_SHA: ${{ steps.commit.outputs.sha }}
+ TAGS: ${{ steps.meta.outputs.tags }}
+ run: |
+ {
+ echo "### Pushed to ECR"
+ echo
+ echo "| | |"
+ echo "|---|---|"
+ echo "| Environment | \`${ENVIRONMENT}\` |"
+ echo "| Commit | \`${COMMIT_SHA}\` |"
+ echo "| Sentry release | \`${COMMIT_SHA}\` |"
+ echo
+ echo '```'
+ echo "$TAGS"
+ echo '```'
+ } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-cloud-prod.yml

@@ -0,0 +1,28 @@
+name: Release Sourcebot (Cloud - Production)
+
+permissions:
+ contents: read
+ id-token: write
+
+on:
+ push:
+ branches: ["main"]
+ tags: ["v*.*.*"]
+ workflow_dispatch:
+
+concurrency:
+ group: release-cloud-prod-${{ github.ref }}
+ cancel-in-progress: false
+
+jobs:
+ build:
+ uses: ./.github/workflows/_build-cloud.yml
+ with:
+ environment: prod
+ git_ref: ${{ github.ref }}
+ docker_tags: |
+ type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
+ type=sha,format=long,enable=${{ github.ref == 'refs/heads/main' }}
+ type=semver,pattern=v{{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+ secrets: inherit

Dockerfile

@@ -61,19 +61,12 @@ ENV NEXT_PUBLIC_LANGFUSE_BASE_URL=$NEXT_PUBLIC_LANGFUSE_BASE_URL
 ARG NEXT_PUBLIC_BUILD_COMMIT_SHA
 ENV NEXT_PUBLIC_BUILD_COMMIT_SHA=$NEXT_PUBLIC_BUILD_COMMIT_SHA
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
-# @see : next.config.mjs
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_WEBAPP_PROJECT
 ENV SENTRY_WEBAPP_PROJECT=$SENTRY_WEBAPP_PROJECT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 # -----------
 
 RUN apk add --no-cache libc6-compat
@@ -92,7 +85,9 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/web install
 
 ENV NEXT_TELEMETRY_DISABLED=1
-RUN yarn workspace @sourcebot/web build
+
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+ yarn workspace @sourcebot/web build
 ENV SKIP_ENV_VALIDATION=0
 # ------------------------------
 
@@ -101,16 +96,10 @@ FROM node-alpine AS backend-builder
 ENV SKIP_ENV_VALIDATION=1
 # -----------
 
-# To upload source maps to Sentry, we need to set the following build-time args.
-# It's important that we don't set these for oss builds, otherwise the Sentry
-# auth token will be exposed.
 ARG SENTRY_ORG
 ENV SENTRY_ORG=$SENTRY_ORG
 ARG SENTRY_BACKEND_PROJECT
 ENV SENTRY_BACKEND_PROJECT=$SENTRY_BACKEND_PROJECT
-# SMUAT = Source Map Upload Auth Token
-ARG SENTRY_SMUAT
-ENV SENTRY_SMUAT=$SENTRY_SMUAT
 ARG SENTRY_RELEASE
 ENV SENTRY_RELEASE=$SENTRY_RELEASE
 # -----------
@@ -129,11 +118,10 @@ COPY --from=shared-libs-builder /app/packages/queryLanguage ./packages/queryLang
 RUN yarn workspace @sourcebot/backend install
 RUN yarn workspace @sourcebot/backend build
 
-# Upload source maps to Sentry if we have the necessary build-time args.
-RUN if [ -n "$SENTRY_SMUAT" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
+RUN --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \
+if [ -n "$SENTRY_AUTH_TOKEN" ] && [ -n "$SENTRY_ORG" ] && [ -n "$SENTRY_BACKEND_PROJECT" ] && [ -n "$SENTRY_RELEASE" ]; then \
  apk add --no-cache curl; \
  curl -sL https://sentry.io/get-cli/ | sh; \
- sentry-cli login --auth-token $SENTRY_SMUAT; \
  sentry-cli sourcemaps inject --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
  sentry-cli sourcemaps upload --org $SENTRY_ORG --project $SENTRY_BACKEND_PROJECT --release $SENTRY_RELEASE ./packages/backend/dist; \
 fi

packages/backend/src/instrument.ts

@@ -7,7 +7,10 @@ const logger = createLogger('instrument');
 if (!!env.NEXT_PUBLIC_SENTRY_BACKEND_DSN && !!env.NEXT_PUBLIC_SENTRY_ENVIRONMENT) {
  Sentry.init({
  dsn: env.NEXT_PUBLIC_SENTRY_BACKEND_DSN,
- release: SOURCEBOT_VERSION,
+ // Must match the release our source maps are uploaded under, which the
+ // Dockerfile sets from SENTRY_RELEASE (the build's commit SHA). Falls back
+ // to the version for builds that don't pass a commit SHA.
+ release: env.NEXT_PUBLIC_BUILD_COMMIT_SHA ?? SOURCEBOT_VERSION,
  environment: env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
  });
 } else {

packages/web/next.config.mjs

@@ -146,8 +146,8 @@ export default withSentryConfig(nextConfig, {
  // For all available options, see:
  org: process.env.SENTRY_ORG,
  project: process.env.SENTRY_WEBAPP_PROJECT,
- authToken: process.env.SENTRY_SMUAT,
- release: process.env.SENTRY_RELEASE,
+ authToken: process.env.SENTRY_AUTH_TOKEN,
+ release: { name: process.env.SENTRY_RELEASE },
 
  // Only print logs for uploading source maps in CI
  silent: !process.env.CI,

packages/web/sentry.client.config.ts → packages/web/src/instrumentation-client.ts

@@ -1,6 +1,10 @@
 // This file configures the initialization of Sentry on the client.
 // The config you add here will be used whenever a users loads a page in their browser.
 // https://docs.sentry.io/platforms/javascript/guides/nextjs/
+//
+// Must be named `instrumentation-client.ts`. Next.js loads this file itself, whereas
+// `sentry.client.config.ts` is only picked up by @sentry/nextjs' webpack plugin,
+// which never runs since `next build` defaults to Turbopack.
 
 import * as Sentry from "@sentry/nextjs";
 
@@ -9,9 +13,15 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });
 } else {
  console.debug("[client] Sentry was not initialized");
 }
+
+// Instruments App Router client-side navigations as spans. Next.js only reads this
+// export from `instrumentation-client.ts`. A no-op when Sentry is uninitialized.
+export const onRouterTransitionStart = Sentry.captureRouterTransitionStart;

packages/web/src/instrumentation.ts

@@ -19,11 +19,11 @@ export async function register() {
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {
- await import('../sentry.server.config');
+ await import('./sentry.server.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'edge') {
- await import('../sentry.edge.config');
+ await import('./sentry.edge.config');
  }
 
  if (process.env.NEXT_RUNTIME === 'nodejs') {

packages/web/sentry.edge.config.ts → packages/web/src/sentry.edge.config.ts

@@ -10,6 +10,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });

packages/web/sentry.server.config.ts → packages/web/src/sentry.server.config.ts

@@ -12,6 +12,8 @@ if (!!process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN && !!process.env.NEXT_PUBLIC_SEN
  dsn: process.env.NEXT_PUBLIC_SENTRY_WEBAPP_DSN,
  environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
 
+ tracesSampleRate: 1.0,
+
  // Setting this option to true will print useful information to the console while you're setting up Sentry.
  debug: false,
  });