Skip to content

feat: publish Docker image to GHCR #218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oioki merged 15 commits into from
Mar 25, 2026
Merged

feat: publish Docker image to GHCR #218

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
bd884e4
ref: publish Docker image to GHCR
aldy505 Oct 20, 2025
869f4c4
ci: craft default release branch name is 'release'
aldy505 Oct 20, 2025
ae8ea58
ref: use ghcr image for devservices
aldy505 Oct 21, 2025
8899d9e
chore: Use bullseye image variant
aldy505 Oct 24, 2025
ba8293d
chore: add libpangocairo
aldy505 Oct 24, 2025
0b4551c
Merge branch 'getsentry:master' into ci/publish-docker-image
aldy505 Oct 26, 2025
605472f
ci: test on forks, I don't have arm64 runner laying around
aldy505 Oct 26, 2025
d4096ce
chore: bump canvas to next major version
aldy505 Oct 26, 2025
5f0c9e8
ci: remove debugging commands
aldy505 Oct 26, 2025
174bbbc
ci: conflicting job name
aldy505 Nov 2, 2025
f5f4e76
ci: don't publish on PR for external contributors
aldy505 Mar 18, 2026
e2fdf9e
Merge remote-tracking branch 'origin/master' into ci/publish-docker-i…
aldy505 Mar 18, 2026
96fbba5
switch base images to GHCR
oioki Mar 20, 2026
5947d0c
Merge branch 'master' into ci/publish-docker-image
oioki Mar 20, 2026
1db8ce6
ci: Run build workflow on pull requests
oioki Mar 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 62 additions & 0 deletions .github/workflows/image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
name: Docker Image

on:
pull_request:
push:
branches:
- master
- release/**
jobs:
build-docker-image:
runs-on: ${{ matrix.os }}
strategy:
matrix:
include:
- os: ubuntu-24.04
platform: amd64
- os: ubuntu-24.04-arm
platform: arm64
name: build-docker-image-${{ matrix.platform }}
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

- name: Build and push chartcuterie image
uses: getsentry/action-build-and-push-images@b172ab61a5f7eabd58bd42ce231b517e79947c01
with:
image_name: 'chartcuterie'
platforms: linux/${{ matrix.platform }}
dockerfile_path: './Dockerfile'
ghcr: ${{ github.event_name != 'pull_request' }}
tag_suffix: -${{ matrix.platform }}
publish_on_pr: ${{ github.event.pull_request.author_association == 'OWNER' || github.event.pull_request.author_association == 'MEMBER' }}
google_ar: false
tag_nightly: false
tag_latest: false

assemble-chartcuterie-image:
runs-on: ubuntu-latest
needs: [build-docker-image]
if: ${{ (github.ref_name == 'master' || startsWith(github.ref_name, 'release/')) && github.event_name != 'pull_request' }}
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

- run: docker login --username '${{ github.actor }}' --password-stdin ghcr.io <<< "$GHCR_TOKEN"
env:
GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

- name: Create multiplatform manifests
run: |
docker buildx imagetools create \
--tag ghcr.io/getsentry/chartcuterie:${{ github.event.pull_request.head.sha || github.sha }} \
--tag ghcr.io/getsentry/chartcuterie:nightly \
Copy link
Copy Markdown

@sentry sentry Bot Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The workflow unconditionally applies the nightly tag to images built from release/** branches, which should only be applied to builds from the master branch.
Severity: HIGH

Suggested Fix

The command that applies the nightly tag should be wrapped in a conditional check to ensure it only executes when the event is triggered from the master branch, for example, by adding an if: github.ref_name == 'master' condition to the step.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/workflows/image.yml#L60

Potential issue: The `assemble-chartcuterie-image` job runs on pushes to both `master`
and `release/**` branches. However, it unconditionally applies the
`ghcr.io/getsentry/chartcuterie:nightly` tag. This means that when a commit is pushed to
a release branch, it will overwrite the `nightly` tag, which is intended to track the
latest development build from `master`. This violates the standard convention for
`nightly` tags and will cause users and development environments expecting the latest
`master` build to receive a release branch build instead.

Did we get this right? 👍 / 👎 to inform future reviews.

Copy link
Copy Markdown

@cursor cursor Bot Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Release pushes overwrite nightly image tag

Medium Severity

assemble-chartcuterie-image runs for both master and release/** pushes, but always retags :nightly. Any release-branch push can replace nightly with a non-master build, so consumers of ghcr.io/getsentry/chartcuterie:nightly may pull an unexpected older or branch-specific image.

Fix in Cursor Fix in Web

ghcr.io/getsentry/chartcuterie:${{ github.event.pull_request.head.sha || github.sha }}-amd64 \
ghcr.io/getsentry/chartcuterie:${{ github.event.pull_request.head.sha || github.sha }}-arm64
28 changes: 28 additions & 0 deletions .github/workflows/release-ghcr-version-tag.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
name: Release GHCR Versioned Image

on:
release:
types: [prereleased, released]
Copy link
Copy Markdown

@cursor cursor Bot Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Prereleases retagged as latest image

Medium Severity

The workflow triggers on prereleased and released, but always runs the latest retag step. Creating a prerelease will overwrite ghcr.io/getsentry/chartcuterie:latest with a prerelease image.

Additional Locations (1)
Fix in Cursor Fix in Web


jobs:
Copy link
Copy Markdown

@sentry sentry Bot Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The release-ghcr-version-tag workflow is missing permissions: { packages: write }. This will cause the job to fail when it attempts to publish images to the GitHub Container Registry.
Severity: CRITICAL

Suggested Fix

Add a permissions block to the release-ghcr-version-tag job to grant write access to packages.

jobs:
  release-ghcr-version-tag:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/workflows/release-ghcr-version-tag.yml#L7

Potential issue: The `release-ghcr-version-tag.yml` workflow is missing a `permissions`
block. By default, the `GITHUB_TOKEN` has only read access to packages. When this
workflow runs, its attempt to push manifest tags to the GitHub Container Registry using
`docker buildx imagetools create` will fail due to insufficient permissions. This will
cause the release workflow to fail, preventing new versioned Docker images from being
published. Other workflows in the repository, like `image.yml`, correctly declare
`packages: write` for similar operations, indicating this was an oversight.

Copy link
Copy Markdown
Contributor Author

@aldy505 aldy505 Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is fine. I'm waiting for #202 to be merged. Only then, we can move the release pipeline into Craft rather than relying on GHA like this.

release-ghcr-version-tag:
runs-on: ubuntu-latest
Copy link
Copy Markdown

@cursor cursor Bot Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing packages write permission blocks GHCR push

High Severity

The release-ghcr-version-tag job lacks a permissions block granting packages: write. GitHub's default GITHUB_TOKEN permissions are read-only (since Feb 2023), so the docker buildx imagetools create commands will fail to push tags to GHCR. The sibling workflow image.yml correctly sets permissions: { contents: read, packages: write } on both its jobs, but this workflow omits it entirely.

Fix in Cursor Fix in Web

steps:
- name: Log in to GitHub Container Registry
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Tag release version
run: |
docker buildx imagetools create --tag \
ghcr.io/getsentry/chartcuterie:${{ github.ref_name }} \
ghcr.io/getsentry/chartcuterie:${{ github.sha }}
Comment thread
aldy505 marked this conversation as resolved.

- name: Tag latest version
run: |
docker buildx imagetools create --tag \
ghcr.io/getsentry/chartcuterie:latest \
ghcr.io/getsentry/chartcuterie:${{ github.sha }}
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM us-docker.pkg.dev/sentryio/dhi/node:24-debian13-dev AS builder
FROM ghcr.io/getsentry/dhi/node:24-debian13-dev AS builder

WORKDIR /build

Expand Down Expand Up @@ -37,7 +37,7 @@ RUN apt-get update -qq && \
rm -rf /var/lib/apt/lists/*


FROM us-docker.pkg.dev/sentryio/dhi/node:24-debian13
FROM ghcr.io/getsentry/dhi/node:24-debian13

ENV NODE_ENV=production

Expand Down
2 changes: 1 addition & 1 deletion devservices/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ x-sentry-service-config:

services:
chartcuterie:
image: us-central1-docker.pkg.dev/sentryio/chartcuterie/image:latest
image: ghcr.io/getsentry/chartcuterie:nightly
environment:
CHARTCUTERIE_CONFIG: /etc/chartcuterie/config.js
CHARTCUTERIE_CONFIG_POLLING: true
Expand Down
2 changes: 1 addition & 1 deletion yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5605,7 +5605,7 @@ safe-array-concat@^1.1.3:

safe-buffer@^5.0.1, safe-buffer@~5.2.0:
version "5.2.1"
resolved "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz"
resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.2.1.tgz#1eaf9fa9bdb1fdd4ec75f58f9cdb4e6b7827eec6"
integrity sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==

safe-push-apply@^1.0.0:
Expand Down
Loading