fix(ci): set build_target to 'application' to reduce Docker image size#7913
Conversation
Should be done after getsentry#7909 is merged
|
@kylemumma I don't have write access. Any chance I can get this merged before May 14? |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 0b7b2c8. Configure here.
| image_name: 'snuba' | ||
| platforms: linux/${{ matrix.platform }} | ||
| dockerfile_path: 'Dockerfile' | ||
| build_target: 'application' |
There was a problem hiding this comment.
Production build job missing build_target setting
High Severity
The build_target: 'application' is added to build-multiplatform but not to the build-production job (line 49–60), which pushes to Google Artifact Registry. Without build_target, Docker defaults to building the last stage in the Dockerfile, which is testing — a bloated image containing dev dependencies and Rust toolchains. The Google AR "production" image now diverges from the GHCR images in a way it didn't before this change.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 0b7b2c8. Configure here.
There was a problem hiding this comment.
Self-hosted build does not care about the build-production. This is wrong.
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| platforms: linux/${{ matrix.platform }} | ||
| dockerfile_path: 'Dockerfile' | ||
| build_target: 'application' | ||
| tag_suffix: -${{ matrix.platform }} |
There was a problem hiding this comment.
Bug: The build-production job is missing build_target: 'application', causing the production image to be built from the testing stage with unnecessary dev dependencies and build artifacts.
Severity: HIGH
Suggested Fix
In the .github/workflows/image.yml file, add the build_target: 'application' parameter to the build-production job, similar to how it has been added to the build-multiplatform job in this pull request. This will ensure the correct, stripped-down application stage is used for the production image.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .github/workflows/image.yml#L35
Potential issue: The `build-production` job in the `image.yml` workflow does not specify
a `build_target`. Because the final stage in the associated Dockerfile is `testing`,
Docker defaults to building this stage for production. This `testing` stage includes
development dependencies, the full Rust toolchain, and source code, none of which should
be in a production image. This results in a significantly larger and potentially less
secure production container. While the pull request correctly adds `build_target:
'application'` to the `build-multiplatform` job, it fails to apply the same necessary
fix to the `build-production` job.
Did we get this right? 👍 / 👎 to inform future reviews.
There was a problem hiding this comment.
Invalid. There is:
Lines 146 to 152 in b5a6b12
3 participants
Should be done after #7909 is merged