Repository navigation
ci: migrate Docker builds to Blacksmith using existing registries - #9715
mattinannt wants to merge 11 commits into
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
mattinannt
changed the title
mattinannt
changed the title
🚨 PR Size WarningThis PR has approximately 1051 lines of changes (624 additions, 427 deletions across 19 files). Large PRs (>800 lines) are significantly harder to review and increase the chance of merge conflicts. Consider splitting this into smaller, self-contained PRs. 💡 Suggestions:
📊 What was counted:
📚 Guidelines:
If this large PR is unavoidable (e.g., migration, dependency update, major refactor), please explain in the PR description why it couldn't be split. |
This comment has been minimized.
This comment has been minimized.
mattinannt
changed the title
|
No ticket: infrastructure evaluation.
What & why
Was: PR and release Docker builds used Depot builders and its private intermediate registry.
Now: Blacksmith builds directly into the existing ECR/GHCR repositories; native checks gate release tags on the tested digest.
Draft pending evaluation of release performance/cost; complete publishing trials passed.
Where to look
Breaking changes
None. Internal CI only.
Migrations & env
How this was tested
219 Docker tests and workflow lint passed. Rerun:
pnpm --dir docker test; publishing commands are in the runbook.Coverage
image-promotion.test.ts: rejects changed digests and cross-repository promotion before writing tags.image-promotion.test.ts: correct credentials; both native checks gate release tags.image-promotion.test.tsverifies fork isolation.Open gaps
Release-speed improvements and monthly savings remain unproven; no production cutover has occurred.
Risks
Complete publishing trials — October 21, 2026
Both workflows passed on
53619d171e5991ae77f28628ec0d419ee696dd18:ECR and
experimental GHCR.
They built the actual cloud/community profiles, uploaded candidates to the existing repositories,
assembled multi-platform indexes, passed runtime and browser checks on native AMD64 and ARM64,
and promoted the tested digests without rebuilding. Sentry source-map uploads succeeded.
All four builds reused the compiled Node layer and rebuilt the application.
The workflows ran concurrently for functional validation, so these are observations rather than a controlled performance comparison.
The ECR trial published only
0.0.0-blacksmith.20261021131225; production/staging tags were disabled.The GHCR trial used the existing experimental package and its trial-branch alias.
Independent registry reads confirmed that the candidate, version, and branch tags all point to
sha256:82b0db27a97fee7571a56122ad3c720de53c6d612ece18b45d84b5f4df7cbba9, containing both architectures.Independent Cosign verification passed with the expected workflow identity and GitHub OIDC issuer.
No new registry repository, IAM grants, lifecycle policy, or repository variable was used.
Local validation: all 219 Docker tests, actionlint on changed workflows, full repository formatting, and
git diff --checkpassed.PR Docker validation, full unit tests, E2E tests, type checks, and linting passed on this revision.
Native build and PR trial evidence
AMD64 cold: 42m49s build, 44m01s job, native runtime/browser smoke passed.
AMD64 warm: 3m build, 4m09s job. Another warm rebuild: 3m37s build. Both smoke checks passed.
ARM64 32-vCPU cold: 39m28s build, 41m52s job. Warm rebuild: 18m51s build, 22m27s job. Native smoke passed both times; Node compilation was cached in the warm run, while the application rebuild took 969.9s.
An earlier ARM64 follow-up restored an old cache snapshot. A later inspection, about eight minutes after the successful cold build, restored matching database hashes and the compiled Node layer. The initial miss remains unexplained; a commit request alone does not establish immediate cache availability.
PR cold build: 20m20s build, 22m23s job. Warm PR build: 2m49s build, 4m48s job. The preceding Depot PR run took 7m34s and 10m06s respectively. This compares CI-only revisions, not controlled release workloads.
Later PR validation: 3m16s build, 5m15s job; cache cleanup reclaimed 1.483 GB and reported 31.97 GB remaining. The
30gbpruning setting is not a guaranteed billing cap.The native benchmarks omitted telemetry credentials. The October 21 full workflows above also exercised Sentry uploads and the actual cloud/community profiles.
Note
AI model used —
unknown, reasoning effortunknown.