From 752542f01d93ab37f474f52d53b6ce2a81edf4ea Mon Sep 17 00:00:00 2001 From: Cagdas Bayram Date: Mon, 8 Jun 2026 13:51:56 -0700 Subject: [PATCH] ci(docker-release): pass GIT_SHA build-arg to image builds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The build already stamps APP_VERSION (the resolved per-repo 0.0.X). Also pass the git short-SHA so images can surface the exact commit they were built from at runtime. Unlike the per-repo version (an independent build-ID that diverges across a service's parallel lanes), the commit is identical iff the code is identical — the reliable cross-lane "same build?" signal. SHORT_SHA is already computed for the secondary `:-` ECR tag, so this just threads it through as a build-arg. Dockerfiles that don't declare `ARG GIT_SHA` ignore it (Docker warns on unused build-args, never fails), so this is a no-op for every service except those that opt in. First consumer: trader-tools backend (bakes GIT_SHA → /api/version `commit`). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/docker-release.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index 5cdac18..ee3e4bc 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -184,6 +184,12 @@ jobs: # for backend services). Dockerfiles that don't declare # `ARG APP_VERSION` silently ignore it. --build-arg "APP_VERSION=${version}" + # Stamp the git short-SHA too. Unlike the per-repo `0.0.X` + # version (a build-ID), the commit is identical iff the code is + # identical — the reliable "is this the same build?" signal for + # services on parallel lanes (e.g. trader-tools stable vs dev). + # Dockerfiles that don't declare `ARG GIT_SHA` silently ignore it. + --build-arg "GIT_SHA=${SHORT_SHA}" ) if [ -n "${TARGET}" ]; then buildx_args+=(--target "${TARGET}")