From 4f4d69eb3af357331967e401084c08eb20e5715f Mon Sep 17 00:00:00 2001
From: Reinaldy Rafli <aldy505@proton.me>
Date: Thu, 23 Jan 2025 18:05:34 +0700
Subject: [PATCH 01/10] build: download arm64 version of gosu and tini

Based on the Sentry-ARM commit: https://github.com/getsentry/sentry/commit/0572d2fc1eb8b78b002e7f2e71e019ea91685d7a

Co-authored-by: Vita Chumakova <me@ezhevita.dev>
---
 self-hosted/Dockerfile | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/self-hosted/Dockerfile b/self-hosted/Dockerfile
index 8ce254848f9d7d..371a8e362ed3f9 100644
--- a/self-hosted/Dockerfile
+++ b/self-hosted/Dockerfile
@@ -19,9 +19,14 @@ RUN : \
     && rm -rf /var/lib/apt/lists/*
 
 ARG GOSU_VERSION=1.17
-ARG GOSU_SHA256=bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3
+ARG GOSU_SHA256_AMD64=bbc4136d03ab138b1ad66fa4fc051bafc6cc7ffae632b069a53657279a450de3
+ARG GOSU_SHA256_ARM64=c3805a85d17f4454c23d7059bcb97e1ec1af272b90126e79ed002342de08389b
 ARG TINI_VERSION=0.19.0
-ARG TINI_SHA256=93dcc18adc78c65a028a84799ecf8ad40c936fdfc5f2a57b1acda5a8117fa82c
+ARG TINI_SHA256_AMD64=93dcc18adc78c65a028a84799ecf8ad40c936fdfc5f2a57b1acda5a8117fa82c
+ARG TINI_SHA256_ARM64=07952557df20bfd2a95f9bef198b445e006171969499a1d361bd9e6f8e5e0e81
+
+ARG TARGETARCH
+SHELL ["/bin/bash", "-c"]
 
 RUN set -x \
   && buildDeps=" \
@@ -30,15 +35,18 @@ RUN set -x \
   && apt-get update && apt-get install -y --no-install-recommends $buildDeps \
   && rm -rf /var/lib/apt/lists/* \
   # grab gosu for easy step-down from root
-  && wget --quiet -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-amd64" \
-  && echo "$GOSU_SHA256 /usr/local/bin/gosu" | sha256sum --check --status \
+  && wget --quiet -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-${TARGETARCH}" \
+  && gosu_hash_var_name="GOSU_SHA256_$(echo $TARGETARCH | tr '[:lower:]' '[:upper:]')" \
+  && echo "${!gosu_hash_var_name} /usr/local/bin/gosu" | sha256sum --check --status \
   && chmod +x /usr/local/bin/gosu \
   # grab tini for signal processing and zombie killing
-  && wget --quiet -O /usr/local/bin/tini "https://github.com/krallin/tini/releases/download/v$TINI_VERSION/tini-amd64" \
-  && echo "$TINI_SHA256 /usr/local/bin/tini" | sha256sum --check --status \
+  && wget --quiet -O /usr/local/bin/tini "https://github.com/krallin/tini/releases/download/v$TINI_VERSION/tini-${TARGETARCH}" \
+  && tini_hash_var_name="TINI_SHA256_$(echo $TARGETARCH | tr '[:lower:]' '[:upper:]')" \
+  && echo "${!tini_hash_var_name} /usr/local/bin/tini" | sha256sum --check --status \
   && chmod +x /usr/local/bin/tini \
   && apt-get purge -y --auto-remove $buildDeps
 
+SHELL ["/bin/sh", "-c"]
 WORKDIR /usr/src/sentry
 
 ENV PATH=/.venv/bin:$PATH PIP_NO_CACHE_DIR=1 PIP_DISABLE_PIP_VERSION_CHECK=1

From a149bfb7d5136705c0c4d55d5895bd1d93d100ea Mon Sep 17 00:00:00 2001
From: Reinaldy Rafli <aldy505@proton.me>
Date: Thu, 23 Jan 2025 18:15:42 +0700
Subject: [PATCH 02/10] ci: build arm64 image with github arm runners

---
 .github/workflows/self-hosted.yml | 38 ++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/self-hosted.yml b/.github/workflows/self-hosted.yml
index 5b58cf84604187..4c63888e9a662f 100644
--- a/.github/workflows/self-hosted.yml
+++ b/.github/workflows/self-hosted.yml
@@ -19,7 +19,14 @@ env:
 
 jobs:
   self-hosted:
-    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
+    runs-on: |-
+      ${{fromJson('{
+        "amd64": "ubuntu-latest",
+        "arm64": "ubuntu-24.04-arm"
+      }')[matrix.arch] }}
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
@@ -81,10 +88,35 @@ jobs:
 
           docker buildx build \
             --pull \
-            --cache-from ghcr.io/getsentry/sentry-self-hosted:latest \
             --cache-to type=inline \
-            --tag ghcr.io/getsentry/sentry-self-hosted:${{ github.sha }} \
+            --tag ghcr.io/getsentry/sentry-self-hosted:${{ matrix.arch }}-${{ github.sha }} \
             --file self-hosted/Dockerfile \
             --build-arg SOURCE_COMMIT=${{ github.sha }} \
+            --build-arg TARGETARCH=${{ matrix.arch }} \
+            --platform linux/${{ matrix.arch }} \
             "${args[@]}" \
             .
+
+      - run: docker push ghcr.io/getsentry/sentry-self-hosted:${{ matrix.arch }}-${{ github.sha }}
+        if: github.event_name != 'pull_request'
+
+  assemble:
+    needs: build-image
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Docker Login
+        run: docker login --username '${{ github.actor }}' --password '${{ secrets.GITHUB_TOKEN }}' ghcr.io
+
+      - name: Assemble Sha Image
+        run: |
+          docker buildx imagetools create -t "ghcr.io/getsentry/sentry-self-hosted:${{ github.sha }}" \
+            "ghcr.io/getsentry/sentry-self-hosted:arm64-${{ github.sha }}" \
+            "ghcr.io/getsentry/sentry-self-hosted:amd64-${{ github.sha }}"
+
+      - name: Assemble Latest Image
+        if: github.ref_name == 'master'
+        run: |
+          docker buildx imagetools create -t "ghcr.io/getsentry/sentry-self-hosted:latest" \
+            "ghcr.io/getsentry/sentry-self-hosted:arm64-${{ github.sha }}" \
+            "ghcr.io/getsentry/sentry-self-hosted:amd64-${{ github.sha }}"

From 18a452c27c15f0f25d3ecf52e5bae4e719675a5c Mon Sep 17 00:00:00 2001
From: Reinaldy Rafli <aldy505@proton.me>
Date: Thu, 23 Jan 2025 18:18:34 +0700
Subject: [PATCH 03/10] ci: move dockerhub publishing after image built

---
 .github/workflows/publish-dockerhub.yml | 49 -------------------------
 .github/workflows/self-hosted.yml       | 47 ++++++++++++++++++++++--
 2 files changed, 44 insertions(+), 52 deletions(-)
 delete mode 100644 .github/workflows/publish-dockerhub.yml

diff --git a/.github/workflows/publish-dockerhub.yml b/.github/workflows/publish-dockerhub.yml
deleted file mode 100644
index d352eb39d28df4..00000000000000
--- a/.github/workflows/publish-dockerhub.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: Publish Sentry image to DockerHub
-on:
-  push:
-    branches:
-      - master
-      - releases/**
-jobs:
-  publish-sentry:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - name: Pull the test image
-        id: image_pull
-        env:
-          IMAGE_URL: ghcr.io/getsentry/sentry-self-hosted:${{ github.sha }}
-        shell: bash
-        run: |
-          echo "We poll for the Docker image that the GCB/GHA build produces until it succeeds or this job times out."
-          echo "Polling for $IMAGE_URL"
-          timeout 20m bash -c 'until docker pull "$IMAGE_URL" 2>/dev/null; do sleep 10; done'
-      - name: Get short SHA for docker tag
-        id: short_sha
-        shell: bash
-        run: |
-          SHORT_SHA=$(git rev-parse --short "$GITHUB_SHA")
-          if [[ -z "$SHORT_SHA" ]]; then
-            echo "Short SHA empty? Re-running rev-parse."
-            git rev-parse --short "$GITHUB_SHA"
-          else
-            echo "sha=$SHORT_SHA" >> $GITHUB_OUTPUT
-          fi
-      - name: Push built docker image
-        shell: bash
-        env:
-          SHORT_SHA: ${{ steps.short_sha.outputs.sha }}
-          IMAGE_URL: ghcr.io/getsentry/sentry-self-hosted:${{ github.sha }}
-        run: |
-          # only login if the password is set
-          if [[ "${{ secrets.DOCKER_HUB_RW_TOKEN }}" ]]; then echo "${{ secrets.DOCKER_HUB_RW_TOKEN }}" | docker login --username=sentrybuilder --password-stdin; fi
-          # We push 3 tags to Dockerhub:
-          # first, the full sha of the commit
-          docker tag ${IMAGE_URL} getsentry/sentry:${GITHUB_SHA}
-          docker push getsentry/sentry:${GITHUB_SHA}
-          # second, the short sha of the commit
-          docker tag ${IMAGE_URL} getsentry/sentry:${SHORT_SHA}
-          docker push getsentry/sentry:${SHORT_SHA}
-          # finally, nightly
-          docker tag ${IMAGE_URL} getsentry/sentry:nightly
-          docker push getsentry/sentry:nightly
diff --git a/.github/workflows/self-hosted.yml b/.github/workflows/self-hosted.yml
index 4c63888e9a662f..d37c8700613d96 100644
--- a/.github/workflows/self-hosted.yml
+++ b/.github/workflows/self-hosted.yml
@@ -98,11 +98,11 @@ jobs:
             .
 
       - run: docker push ghcr.io/getsentry/sentry-self-hosted:${{ matrix.arch }}-${{ github.sha }}
-        if: github.event_name != 'pull_request'
+        if: github.ref_name == 'master'
 
   assemble:
-    needs: build-image
-    if: github.event_name != 'pull_request'
+    needs: self-hosted
+    if: ${{ (github.ref_name == 'master') }}
     runs-on: ubuntu-20.04
     steps:
       - name: Docker Login
@@ -120,3 +120,44 @@ jobs:
           docker buildx imagetools create -t "ghcr.io/getsentry/sentry-self-hosted:latest" \
             "ghcr.io/getsentry/sentry-self-hosted:arm64-${{ github.sha }}" \
             "ghcr.io/getsentry/sentry-self-hosted:amd64-${{ github.sha }}"
+
+  publish-sentry:
+    needs: assemble
+    runs-on: ubuntu-24.04
+    if: ${{ (github.ref_name == 'master') }}
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Pull the test image
+        id: image_pull
+        env:
+          IMAGE_URL: ghcr.io/getsentry/sentry-self-hosted:${{ github.sha }}
+        run: docker pull "$IMAGE_URL"
+      - name: Get short SHA for docker tag
+        id: short_sha
+        shell: bash
+        run: |
+          SHORT_SHA=$(git rev-parse --short "$GITHUB_SHA")
+          if [[ -z "$SHORT_SHA" ]]; then
+            echo "Short SHA empty? Re-running rev-parse."
+            git rev-parse --short "$GITHUB_SHA"
+          else
+            echo "sha=$SHORT_SHA" >> $GITHUB_OUTPUT
+          fi
+      - name: Push built docker image
+        shell: bash
+        env:
+          SHORT_SHA: ${{ steps.short_sha.outputs.sha }}
+          IMAGE_URL: ghcr.io/getsentry/sentry-self-hosted:${{ github.sha }}
+        run: |
+          # only login if the password is set
+          if [[ "${{ secrets.DOCKER_HUB_RW_TOKEN }}" ]]; then echo "${{ secrets.DOCKER_HUB_RW_TOKEN }}" | docker login --username=sentrybuilder --password-stdin; fi
+          # We push 3 tags to Dockerhub:
+          # first, the full sha of the commit
+          docker tag ${IMAGE_URL} getsentry/sentry:${GITHUB_SHA}
+          docker push getsentry/sentry:${GITHUB_SHA}
+          # second, the short sha of the commit
+          docker tag ${IMAGE_URL} getsentry/sentry:${SHORT_SHA}
+          docker push getsentry/sentry:${SHORT_SHA}
+          # finally, nightly
+          docker tag ${IMAGE_URL} getsentry/sentry:nightly
+          docker push getsentry/sentry:nightly

From f056374eb7dfef5d3e98aad74ddca0c79160d280 Mon Sep 17 00:00:00 2001
From: Reinaldy Rafli <aldy505@proton.me>
Date: Thu, 30 Jan 2025 08:19:18 +0700
Subject: [PATCH 04/10] ci: use similar approach with other repositories

---
 .github/workflows/self-hosted.yml | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/self-hosted.yml b/.github/workflows/self-hosted.yml
index d37c8700613d96..79e674e488eb07 100644
--- a/.github/workflows/self-hosted.yml
+++ b/.github/workflows/self-hosted.yml
@@ -28,6 +28,9 @@ jobs:
         "arm64": "ubuntu-24.04-arm"
       }')[matrix.arch] }}
     timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
@@ -69,10 +72,8 @@ jobs:
           python3 -m tools.fast_editable --path .
           python3 -m sentry.build.main
 
-      - run: docker login --username '${{ github.actor }}' --password-stdin ghcr.io <<< "$GHCR_TOKEN"
-        env:
-          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        if: github.event_name != 'pull_request'
+      - run: docker login --username '${{ github.actor }}' --password '${{ github.token }}' ghcr.io
+        if: github.ref_name == 'master' && github.event_name != 'pull_request'
 
       - run: docker buildx create --driver docker-container --use
 
@@ -98,15 +99,18 @@ jobs:
             .
 
       - run: docker push ghcr.io/getsentry/sentry-self-hosted:${{ matrix.arch }}-${{ github.sha }}
-        if: github.ref_name == 'master'
+        if: github.ref_name == 'master' && github.event_name != 'pull_request'
 
   assemble:
     needs: self-hosted
-    if: ${{ (github.ref_name == 'master') }}
-    runs-on: ubuntu-20.04
+    if: github.ref_name == 'master' && github.event_name != 'pull_request'
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Docker Login
-        run: docker login --username '${{ github.actor }}' --password '${{ secrets.GITHUB_TOKEN }}' ghcr.io
+        run: docker login --username '${{ github.actor }}' --password '${{ github.token }}' ghcr.io
 
       - name: Assemble Sha Image
         run: |
@@ -115,7 +119,6 @@ jobs:
             "ghcr.io/getsentry/sentry-self-hosted:amd64-${{ github.sha }}"
 
       - name: Assemble Latest Image
-        if: github.ref_name == 'master'
         run: |
           docker buildx imagetools create -t "ghcr.io/getsentry/sentry-self-hosted:latest" \
             "ghcr.io/getsentry/sentry-self-hosted:arm64-${{ github.sha }}" \

From b3832418d6d6f5211fcfe60dc736551642149e68 Mon Sep 17 00:00:00 2001
From: Reinaldy Rafli <github@reinaldyrafli.com>
Date: Thu, 12 Jun 2025 22:06:53 +0700
Subject: [PATCH 05/10] ci: pass docker tarball between jobs

---
 .github/workflows/self-hosted.yml | 158 ++++++++++++++++++++----------
 1 file changed, 105 insertions(+), 53 deletions(-)

diff --git a/.github/workflows/self-hosted.yml b/.github/workflows/self-hosted.yml
index 4b7b468de512e5..7c94b39c1b002f 100644
--- a/.github/workflows/self-hosted.yml
+++ b/.github/workflows/self-hosted.yml
@@ -19,15 +19,14 @@ env:
 
 jobs:
   self-hosted:
+    runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        arch: [amd64, arm64]
-    runs-on: |-
-      ${{fromJson('{
-        "amd64": "ubuntu-latest",
-        "arm64": "ubuntu-24.04-arm"
-      }')[matrix.arch] }}
-    timeout-minutes: 30
+        include:
+          - os: ubuntu-24.04
+            platform: amd64
+          - os: ubuntu-24.04-arm
+            platform: arm64
     permissions:
       contents: read
       packages: write
@@ -77,58 +76,111 @@ jobs:
       - run: docker login --username '${{ github.actor }}' --password '${{ github.token }}' ghcr.io
         if: github.ref_name == 'master' && github.event_name != 'pull_request'
 
-      - run: docker buildx create --driver docker-container --use
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
-      - run: |
-          if [ ${{ github.event_name }} = 'push' ]; then
-            args=(
-              --tag ghcr.io/getsentry/sentry-self-hosted:latest
-              --push
-            )
-          else
-            args=()
-          fi
-
-          docker buildx build \
-            --pull \
-            --cache-to type=inline \
-            --tag ghcr.io/getsentry/sentry-self-hosted:${{ matrix.arch }}-${{ github.sha }} \
-            --file self-hosted/Dockerfile \
-            --build-arg SOURCE_COMMIT=${{ github.sha }} \
-            --build-arg TARGETARCH=${{ matrix.arch }} \
-            --platform linux/${{ matrix.arch }} \
-            "${args[@]}" \
-            .
-
-      - run: docker push ghcr.io/getsentry/sentry-self-hosted:${{ matrix.arch }}-${{ github.sha }}
-        if: github.ref_name == 'master' && github.event_name != 'pull_request'
+      - name: Build
+        uses: docker/build-push-action@32945a339266b759abcbdc89316275140b0fc960 # v6.8.10
+        with:
+          context: .
+          cache-from: ghcr.io/getsentry/sentry:latest
+          cache-to: type=inline
+          platforms: linux/${{ matrix.platform }}
+          tags: sentry:${{ matrix.platform }}
+          outputs: type=docker,dest=/tmp/sentry-${{ matrix.platform }}.tar
+          push: false
+          build-args:
+              - SOURCE_COMMIT=${{ github.sha }}
+              - TARGETARCH=${{ matrix.arch }}
+
+      - name: Upload Image
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: sentry-${{ matrix.platform }}
+          path: /tmp/sentry-${{ matrix.platform }}.tar
 
   assemble:
-    needs: self-hosted
-    if: github.ref_name == 'master' && github.event_name != 'pull_request'
-    runs-on: ubuntu-22.04
+    needs: [self-hosted]
+    if: ${{ github.ref_name == 'master' && github.event_name != 'pull_request' }}
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
     steps:
       - name: Docker Login
-        run: docker login --username '${{ github.actor }}' --password '${{ github.token }}' ghcr.io
+      - run: docker login --username '${{ github.actor }}' --password-stdin ghcr.io <<< "$GHCR_TOKEN"
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Assemble Sha Image
-        run: |
-          docker buildx imagetools create -t "ghcr.io/getsentry/sentry-self-hosted:${{ github.sha }}" \
-            "ghcr.io/getsentry/sentry-self-hosted:arm64-${{ github.sha }}" \
-            "ghcr.io/getsentry/sentry-self-hosted:amd64-${{ github.sha }}"
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+
+      - name: Download amd64 Image
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.2
+        with:
+          name: sentry-amd64
+          path: /tmp
+
+      - name: Load amd64 Image
+        run: docker load --input /tmp/sentry-amd64.tar
+
+      - name: Download arm64 Image
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.2
+        with:
+          name: sentry-arm64
+          path: /tmp
+
+      - name: Load arm64 Image
+        run: docker load --input /tmp/sentry-arm64.tar
 
-      - name: Assemble Latest Image
+      - name: Push to GitHub Container Registry
         run: |
-          docker buildx imagetools create -t "ghcr.io/getsentry/sentry-self-hosted:latest" \
-            "ghcr.io/getsentry/sentry-self-hosted:arm64-${{ github.sha }}" \
-            "ghcr.io/getsentry/sentry-self-hosted:amd64-${{ github.sha }}"
+          docker tag sentry:amd64 ghcr.io/getsentry/sentry:${{ github.sha }}-amd64
+          docker push ghcr.io/getsentry/sentry:${{ github.sha }}-amd64
 
-  publish-sentry:
-    needs: assemble
-    runs-on: ubuntu-24.04
+          docker tag sentry:arm64 ghcr.io/getsentry/sentry:${{ github.sha }}-arm64
+          docker push ghcr.io/getsentry/sentry:${{ github.sha }}-arm64
+
+          docker manifest create \
+            ghcr.io/getsentry/sentry:${{ github.sha }} \
+            --amend ghcr.io/getsentry/sentry:${{ github.sha }}-amd64 \
+            --amend ghcr.io/getsentry/sentry:${{ github.sha }}-arm64
+
+          docker manifest push ghcr.io/getsentry/sentry:${{ github.sha }}
+
+          docker manifest create \
+            ghcr.io/getsentry/sentry:latest \
+            --amend ghcr.io/getsentry/sentry:${{ github.sha }}-amd64 \
+            --amend ghcr.io/getsentry/sentry:${{ github.sha }}-arm64
+
+          docker manifest push ghcr.io/getsentry/sentry:latest
+
+          docker manifest create \
+            ghcr.io/getsentry/sentry:nightly \
+            --amend ghcr.io/getsentry/sentry:${{ github.sha }}-amd64 \
+            --amend ghcr.io/getsentry/sentry:${{ github.sha }}-arm64
+
+          docker manifest push ghcr.io/getsentry/sentry:nightly
+
+          # These manifests below are being used for development purposes.
+          # We shall keep it as is.
+          docker manifest create \
+            ghcr.io/getsentry/sentry-self-hosted:${{ github.sha }} \
+            --amend ghcr.io/getsentry/sentry:${{ github.sha }}-amd64 \
+            --amend ghcr.io/getsentry/sentry:${{ github.sha }}-arm64
+
+          docker manifest push ghcr.io/getsentry/sentry-self-hosted:${{ github.sha }}
+
+          docker manifest create \
+            ghcr.io/getsentry/sentry-self-hosted:latest \
+            --amend ghcr.io/getsentry/sentry:${{ github.sha }}-amd64 \
+            --amend ghcr.io/getsentry/sentry:${{ github.sha }}-arm64
+
+          docker manifest push ghcr.io/getsentry/sentry-self-hosted:latest
+
+  publish-dockerhub:
+    needs: [assemble]
+    runs-on: ubuntu-latest
     if: ${{ (github.ref_name == 'master') }}
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
@@ -156,13 +208,13 @@ jobs:
         run: |
           # only login if the password is set
           if [[ "${{ secrets.DOCKER_HUB_RW_TOKEN }}" ]]; then echo "${{ secrets.DOCKER_HUB_RW_TOKEN }}" | docker login --username=sentrybuilder --password-stdin; fi
+
           # We push 3 tags to Dockerhub:
           # first, the full sha of the commit
-          docker tag ${IMAGE_URL} getsentry/sentry:${GITHUB_SHA}
-          docker push getsentry/sentry:${GITHUB_SHA}
+          docker buildx imagetools create --tag getsentry/sentry:${GITHUB_SHA} ghcr.io/getsentry/sentry:${{ github.sha }}
+
           # second, the short sha of the commit
-          docker tag ${IMAGE_URL} getsentry/sentry:${SHORT_SHA}
-          docker push getsentry/sentry:${SHORT_SHA}
+          docker buildx imagetools create --tag getsentry/sentry:${SHORT_SHA} ghcr.io/getsentry/sentry:${{ github.sha }}
+
           # finally, nightly
-          docker tag ${IMAGE_URL} getsentry/sentry:nightly
-          docker push getsentry/sentry:nightly
+          docker buildx imagetools create --tag getsentry/sentry:nightly ghcr.io/getsentry/sentry:${{ github.sha }}

From aa9ec5a53c280ecf97c9079e90f1a9c2a1e4bcd3 Mon Sep 17 00:00:00 2001
From: Reinaldy Rafli <github@reinaldyrafli.com>
Date: Thu, 12 Jun 2025 22:24:43 +0700
Subject: [PATCH 06/10] ci: pre-commit schema lint

---
 .github/workflows/self-hosted.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/self-hosted.yml b/.github/workflows/self-hosted.yml
index 7c94b39c1b002f..f692cd685c3a86 100644
--- a/.github/workflows/self-hosted.yml
+++ b/.github/workflows/self-hosted.yml
@@ -89,9 +89,9 @@ jobs:
           tags: sentry:${{ matrix.platform }}
           outputs: type=docker,dest=/tmp/sentry-${{ matrix.platform }}.tar
           push: false
-          build-args:
-              - SOURCE_COMMIT=${{ github.sha }}
-              - TARGETARCH=${{ matrix.arch }}
+          build-args: |
+              SOURCE_COMMIT=${{ github.sha }}
+              TARGETARCH=${{ matrix.platform }}
 
       - name: Upload Image
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
@@ -108,7 +108,7 @@ jobs:
       packages: write
     steps:
       - name: Docker Login
-      - run: docker login --username '${{ github.actor }}' --password-stdin ghcr.io <<< "$GHCR_TOKEN"
+        run: docker login --username '${{ github.actor }}' --password-stdin ghcr.io <<< "$GHCR_TOKEN"
         env:
           GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

From b5651cb7483ba4d47d279bd9788c0ced6cdfd093 Mon Sep 17 00:00:00 2001
From: Reinaldy Rafli <github@reinaldyrafli.com>
Date: Thu, 12 Jun 2025 22:33:25 +0700
Subject: [PATCH 07/10] chore: prettier issue

---
 .github/workflows/self-hosted.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/self-hosted.yml b/.github/workflows/self-hosted.yml
index f692cd685c3a86..e90dd8b4deacfa 100644
--- a/.github/workflows/self-hosted.yml
+++ b/.github/workflows/self-hosted.yml
@@ -90,8 +90,8 @@ jobs:
           outputs: type=docker,dest=/tmp/sentry-${{ matrix.platform }}.tar
           push: false
           build-args: |
-              SOURCE_COMMIT=${{ github.sha }}
-              TARGETARCH=${{ matrix.platform }}
+            SOURCE_COMMIT=${{ github.sha }}
+            TARGETARCH=${{ matrix.platform }}
 
       - name: Upload Image
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

From dfb63e340e135672a183d07264e939b3b2ef7164 Mon Sep 17 00:00:00 2001
From: Reinaldy Rafli <github@reinaldyrafli.com>
Date: Thu, 12 Jun 2025 22:37:28 +0700
Subject: [PATCH 08/10] ci: specify dockerfile path

---
 .github/workflows/self-hosted.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/self-hosted.yml b/.github/workflows/self-hosted.yml
index e90dd8b4deacfa..8871780b7413b4 100644
--- a/.github/workflows/self-hosted.yml
+++ b/.github/workflows/self-hosted.yml
@@ -83,6 +83,7 @@ jobs:
         uses: docker/build-push-action@32945a339266b759abcbdc89316275140b0fc960 # v6.8.10
         with:
           context: .
+          file: "{context}/self-hosted/Dockerfile"
           cache-from: ghcr.io/getsentry/sentry:latest
           cache-to: type=inline
           platforms: linux/${{ matrix.platform }}

From 146ae518070fe4874b1613ca87114fe5beb5b29b Mon Sep 17 00:00:00 2001
From: Reinaldy Rafli <aldy505@proton.me>
Date: Thu, 12 Jun 2025 22:52:03 +0700
Subject: [PATCH 09/10] Update self-hosted.yml

---
 .github/workflows/self-hosted.yml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/.github/workflows/self-hosted.yml b/.github/workflows/self-hosted.yml
index 8871780b7413b4..4afe29e2e312e4 100644
--- a/.github/workflows/self-hosted.yml
+++ b/.github/workflows/self-hosted.yml
@@ -185,11 +185,6 @@ jobs:
     if: ${{ (github.ref_name == 'master') }}
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - name: Pull the test image
-        id: image_pull
-        env:
-          IMAGE_URL: ghcr.io/getsentry/sentry-self-hosted:${{ github.sha }}
-        run: docker pull "$IMAGE_URL"
       - name: Get short SHA for docker tag
         id: short_sha
         shell: bash

From a6466854079fd5bd8d67dac691b608144b5062e6 Mon Sep 17 00:00:00 2001
From: Reinaldy Rafli <github@reinaldyrafli.com>
Date: Fri, 13 Jun 2025 05:15:04 +0700
Subject: [PATCH 10/10] chore: run prettier

---
 .github/workflows/self-hosted.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/self-hosted.yml b/.github/workflows/self-hosted.yml
index 4afe29e2e312e4..aa68e63b7eef53 100644
--- a/.github/workflows/self-hosted.yml
+++ b/.github/workflows/self-hosted.yml
@@ -83,7 +83,7 @@ jobs:
         uses: docker/build-push-action@32945a339266b759abcbdc89316275140b0fc960 # v6.8.10
         with:
           context: .
-          file: "{context}/self-hosted/Dockerfile"
+          file: '{context}/self-hosted/Dockerfile'
           cache-from: ghcr.io/getsentry/sentry:latest
           cache-to: type=inline
           platforms: linux/${{ matrix.platform }}