ci(docker-release): pass GIT_SHA build-arg to image builds - #20
Merged
Conversation
The build already stamps APP_VERSION (the resolved per-repo 0.0.X). Also pass the git short-SHA so images can surface the exact commit they were built from at runtime. Unlike the per-repo version (an independent build-ID that diverges across a service's parallel lanes), the commit is identical iff the code is identical — the reliable cross-lane "same build?" signal. SHORT_SHA is already computed for the secondary `:<ver>-<sha>` ECR tag, so this just threads it through as a build-arg. Dockerfiles that don't declare `ARG GIT_SHA` ignore it (Docker warns on unused build-args, never fails), so this is a no-op for every service except those that opt in. First consumer: trader-tools backend (bakes GIT_SHA → /api/version `commit`). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Add
--build-arg GIT_SHA=${SHORT_SHA}to the shareddocker-release.ymlbuildx invocation, alongside the existingAPP_VERSIONbuild-arg.Why
The per-repo
0.0.Xversion is a build-ID — it increments independently per ECR repo, so a service running on parallel lanes (e.g.trader-toolsstable vstrader-tools-dev) gets divergent numbers, and a matching number never guarantees matching code. The git commit is identical iff the code is identical, so it's the reliable "is this the same build across lanes?" signal — and the thing a/api/versionendpoint should surface.SHORT_SHA(7-char) is already computed for the secondary:<version>-<sha>ECR tag, so this just threads the same value through as a build-arg.Blast radius
None for existing services. Docker warns on an unused
--build-argbut never fails, so any Dockerfile that doesn't declareARG GIT_SHAsimply ignores it. Opt-in per service.First consumer
trader-tools backend (pinpredict/trader-tools#645) declares
ARG GIT_SHAand bakes it to a runtime env → surfaced at/api/versionascommitand in the UI version tooltip. Until this lands, that field is gracefully omitted.