admin/openhuman
1
0
Fork 0
mirror of https://github.com/tinyhumansai/openhuman.git synced 2026-07-30 06:32:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sentry): Rust source context + per-release deploy marker (#405) (#1067)

Browse Source
This commit is contained in:
CodeGhost21
2026-05-01 17:06:31 +05:30
committed by GitHub
parent 6ac7885cfe
commit cd7a56581c
9 changed files with 445 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release-staging.yml
+141
View File
@@ -22,9 +22,21 @@ jobs:
prepare-build:
name: Prepare build context
runs-on: ubuntu-latest
# Reuse the Production GitHub Actions environment so Sentry vars
# (`OPENHUMAN_*_SENTRY_DSN`, `SENTRY_PROJECT_*`, `SENTRY_ORG`,
# `SENTRY_AUTH_TOKEN`) and `VITE_DEBUG` resolve here too. Staging
# events differentiate from production via the `environment` tag set
# at runtime — separate Sentry projects are not needed.
environment: Production
outputs:
version: ${{ steps.resolve.outputs.version }}
sha: ${{ steps.resolve.outputs.sha }}
# First 12 chars of `sha`. Matches the truncation runtime code in
# config.ts / vite.config.ts / main.rs / app/src-tauri/src/lib.rs
# applies when computing `openhuman@<version>+<short_sha>`. Use this
# (not `sha`) anywhere CI constructs SENTRY_RELEASE so uploaded
# artifacts attach to the same release events report.
short_sha: ${{ steps.resolve.outputs.short_sha }}
build_ref: ${{ steps.resolve.outputs.build_ref }}
base_url: ${{ steps.resolve.outputs.base_url }}
steps:
@@ -48,8 +60,14 @@ jobs:
run: |
VERSION="$(node -p "require('./app/package.json').version")"
SHA="$(git rev-parse HEAD)"
# Match the 12-char truncation runtime code applies to
# VITE_BUILD_SHA / OPENHUMAN_BUILD_SHA when constructing the
# release tag at startup, so SENTRY_RELEASE assembled in CI
# agrees with the tag events emit.
SHORT_SHA="${SHA:0:12}"
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
echo "sha=$SHA" >> "$GITHUB_OUTPUT"
echo "short_sha=$SHORT_SHA" >> "$GITHUB_OUTPUT"
echo "build_ref=$SHA" >> "$GITHUB_OUTPUT"
echo "base_url=https://staging-api.tinyhumans.ai/" >> "$GITHUB_OUTPUT"
@@ -60,6 +78,13 @@ jobs:
name: "Desktop: ${{ matrix.settings.artifact_suffix }}"
needs: [prepare-build]
runs-on: ${{ matrix.settings.platform }}
# Reuse the Production GH Actions environment so the Sentry vars and
# `SENTRY_AUTH_TOKEN` secret resolve here. Staging builds tag their
# events with `environment: staging` at runtime (set by APP_ENVIRONMENT
# in app/src/utils/config.ts and resolve_sentry_environment() in the
# Rust shell), so they're filterable in Sentry without separate
# projects.
environment: Production
strategy:
fail-fast: false
matrix:
@@ -271,12 +296,87 @@ jobs:
BASE_URL: ${{ needs.prepare-build.outputs.base_url }}
VITE_BACKEND_URL: ${{ needs.prepare-build.outputs.base_url }}
VITE_DEBUG: ${{ vars.VITE_DEBUG }}
# ----- Sentry wiring (mirrors release.yml's build-desktop step) -----
# React frontend Sentry DSN — baked by the Vite plugin via
# `import.meta.env.VITE_SENTRY_DSN`. Without this, `Sentry.init`
# in app/src/services/analytics.ts returns early and no events
# report from the staging build.
VITE_SENTRY_DSN: ${{ vars.OPENHUMAN_REACT_SENTRY_DSN }}
# Tauri shell DSN — baked into the shell binary via
# `option_env!("OPENHUMAN_TAURI_SENTRY_DSN")` at compile time.
OPENHUMAN_TAURI_SENTRY_DSN: ${{ vars.OPENHUMAN_TAURI_SENTRY_DSN }}
# Build SHA threaded through to both the Vite bundle and the
# Tauri shell so all surfaces emit the same release tag.
OPENHUMAN_BUILD_SHA: ${{ needs.prepare-build.outputs.sha }}
VITE_BUILD_SHA: ${{ needs.prepare-build.outputs.sha }}
# Use short_sha (12 chars) — matches what config.ts /
# vite.config.ts / main.rs / app/src-tauri/src/lib.rs all slice
# VITE_BUILD_SHA / OPENHUMAN_BUILD_SHA down to at runtime when
# emitting events. The vite plugin reads SENTRY_RELEASE raw, so
# a long-SHA value here would tag uploads against a different
# release than events report.
SENTRY_RELEASE:
openhuman@${{ needs.prepare-build.outputs.version }}+${{
needs.prepare-build.outputs.short_sha }}
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
SENTRY_ORG: ${{ vars.SENTRY_ORG }}
# SENTRY_PROJECT here is consumed by sentry-vite-plugin during
# the Vite build — uploads frontend source maps to the React
# Sentry project. The Rust DIFs go to SENTRY_PROJECT_CORE in the
# dedicated step below.
SENTRY_PROJECT: ${{ vars.SENTRY_PROJECT_REACT }}
MACOSX_DEPLOYMENT_TARGET: ${{ matrix.settings.platform == 'macos-latest' && '10.15' || '' }}
TAURI_CONFIG_OVERRIDE: ${{ steps.config-overrides.outputs.json }}
MATRIX_ARGS: ${{ matrix.settings.args }}
run: |
NODE_OPTIONS="--max-old-space-size=8192" cargo tauri build --debug -c "$TAURI_CONFIG_OVERRIDE" $MATRIX_ARGS
# Upload Rust debug info to Sentry so backend + Tauri-shell stack
# traces symbolicate in the staging Sentry project too. Frontend
# source maps are handled by sentry-vite-plugin in the build step
# above; this is the Rust half. Symbols are keyed by debug-ID, so
# it's safe to run per-matrix-target without collisions — Sentry
# merges artifacts across platforms.
- name: Upload core sidecar debug symbols to Sentry
if: env.SENTRY_AUTH_TOKEN != ''
shell: bash
env:
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
SENTRY_ORG: ${{ vars.SENTRY_ORG }}
SENTRY_PROJECT: ${{ vars.SENTRY_PROJECT_CORE }}
# Must match the release tag the running core binary reports
# (`openhuman@<version>+<short_sha>`, see `build_release_tag` in
# src/main.rs). Uses short_sha (12 chars) — see the prepare-build
# outputs comment. If this drifts, DIFs attach to a different
# release than events and stack traces stay un-symbolicated.
SENTRY_RELEASE:
openhuman@${{ needs.prepare-build.outputs.version }}+${{
needs.prepare-build.outputs.short_sha }}
VERSION: ${{ needs.prepare-build.outputs.version }}
MATRIX_TARGET: ${{ matrix.settings.target }}
run: |
set -euo pipefail
# Two DIF locations on staging:
# - `app/src-tauri/target/<triple>/debug` — Tauri shell binary
# (which links the core as a path dep, so its DWARF covers core
# too).
# - `target/<triple>/debug` — standalone `openhuman-core` CLI
# binary built by the "Build sidecar core binary" step earlier
# and published as a separate artifact. Crashes from operators
# running the standalone CLI need its DIFs to symbolicate.
# Symbols are keyed by debug-ID so cross-platform / cross-binary
# uploads don't collide — Sentry just merges them.
for dif_dir in \
"app/src-tauri/target/${MATRIX_TARGET}/debug" \
"target/${MATRIX_TARGET}/debug"; do
if [ -d "$dif_dir" ]; then
echo "==> Uploading symbols from $dif_dir to ${SENTRY_PROJECT}"
bash scripts/upload_sentry_symbols.sh "$VERSION" "$dif_dir"
else
echo "==> Skipping $dif_dir (not present)"
fi
done
- name: Upload staging desktop bundles
uses: actions/upload-artifact@v4
with:
@@ -294,3 +394,44 @@ jobs:
}}
path: |
${{ steps.core-paths.outputs.core_target_dir }}/${{ steps.core-paths.outputs.core_bin_name }}${{ matrix.settings.platform == 'windows-latest' && '.exe' || '' }}
# =========================================================================
# Phase 3: Record a single Sentry deploy marker once the matrix is
# complete. Lives in its own job (not inside `build-desktop`) because
# `sentry-cli releases deploys ... new` does NOT deduplicate by
# (release, env) — running it inside the matrix would add one row per
# platform (×4 on this workflow). One row per release is the right
# shape: re-runs of CI for the same release intentionally produce
# additional rows representing separate deploy attempts.
# =========================================================================
record-sentry-deploy:
name: Record Sentry deploy marker
runs-on: ubuntu-latest
environment: Production
needs: [prepare-build, build-desktop]
env:
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
steps:
- name: Install sentry-cli
if: env.SENTRY_AUTH_TOKEN != ''
shell: bash
run: curl -sSf https://sentry.io/get-cli/ | bash
- name: Record deploy marker
if: env.SENTRY_AUTH_TOKEN != ''
shell: bash
env:
SENTRY_ORG: ${{ vars.SENTRY_ORG }}
# Marker lives on the React project's release; events from all
# surfaces share the same `openhuman@<version>+<short_sha>`
# release tag, so the marker on any single project's release
# shows in Sentry's "Deploys" tab for that release group.
SENTRY_PROJECT: ${{ vars.SENTRY_PROJECT_REACT }}
SENTRY_RELEASE:
openhuman@${{ needs.prepare-build.outputs.version }}+${{
needs.prepare-build.outputs.short_sha }}
SENTRY_ENVIRONMENT: staging
run: |
set -euo pipefail
echo "==> Recording deploy marker: ${SENTRY_RELEASE} -> ${SENTRY_ENVIRONMENT}"
sentry-cli releases deploys "${SENTRY_RELEASE}" new \
-e "${SENTRY_ENVIRONMENT}"
.github/workflows/release.yml
+69 -4
View File
@@ -54,6 +54,13 @@ jobs:
version: ${{ steps.resolve.outputs.version }}
tag: ${{ steps.resolve.outputs.tag }}
sha: ${{ steps.resolve.outputs.sha }}
# First 12 chars of `sha` — matches the truncation done at runtime by
# app/src/utils/config.ts, app/vite.config.ts, src/main.rs, and
# app/src-tauri/src/lib.rs when they compute the canonical
# `openhuman@<version>+<short_sha>` release tag. Use this (not the
# full `sha`) anywhere CI constructs SENTRY_RELEASE so uploaded
# artifacts attach to the same release events report.
short_sha: ${{ steps.resolve.outputs.short_sha }}
build_ref: ${{ steps.resolve.outputs.build_ref }}
release_enabled: ${{ steps.resolve.outputs.release_enabled }}
base_url: ${{ steps.resolve.outputs.base_url }}
@@ -150,9 +157,15 @@ jobs:
RELEASE_ENABLED="false"
BASE_URL="https://staging-api.tinyhumans.ai/"
fi
# Match the 12-char truncation runtime code applies to
# VITE_BUILD_SHA / OPENHUMAN_BUILD_SHA when constructing the release
# tag at startup, so SENTRY_RELEASE assembled in CI agrees with
# the tag events emit.
SHORT_SHA="${SHA:0:12}"
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
echo "sha=$SHA" >> "$GITHUB_OUTPUT"
echo "short_sha=$SHORT_SHA" >> "$GITHUB_OUTPUT"
echo "build_ref=$BUILD_REF" >> "$GITHUB_OUTPUT"
echo "release_enabled=$RELEASE_ENABLED" >> "$GITHUB_OUTPUT"
echo "base_url=$BASE_URL" >> "$GITHUB_OUTPUT"
@@ -467,9 +480,14 @@ jobs:
# by Tauri so source maps uploaded there resolve correctly against the
# final bundle produced by the tauri-driven build.
VITE_BUILD_SHA: ${{ needs.prepare-build.outputs.sha }}
# Use short_sha (12 chars) — matches what config.ts / vite.config.ts /
# main.rs / app/src-tauri/src/lib.rs all slice VITE_BUILD_SHA /
# OPENHUMAN_BUILD_SHA down to at runtime when emitting events. The
# vite plugin reads SENTRY_RELEASE raw, so a long-SHA value here
# would tag uploads against a different release than events report.
SENTRY_RELEASE:
openhuman@${{ needs.prepare-build.outputs.version }}+${{
needs.prepare-build.outputs.sha }}
needs.prepare-build.outputs.short_sha }}
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
SENTRY_ORG: ${{ vars.SENTRY_ORG }}
# SENTRY_PROJECT here is consumed by sentry-vite-plugin during the
@@ -513,12 +531,13 @@ jobs:
SENTRY_ORG: ${{ vars.SENTRY_ORG }}
SENTRY_PROJECT: ${{ vars.SENTRY_PROJECT_CORE }}
# Must match the release tag the running core binary reports
# (`openhuman@<version>+<sha>`, see `build_release_tag` in
# src/main.rs). If this drifts, DIFs attach to a different
# (`openhuman@<version>+<short_sha>`, see `build_release_tag` in
# src/main.rs). Uses short_sha (12 chars) — see the prepare-build
# outputs comment. If this drifts, DIFs attach to a different
# release than events and stack traces stay un-symbolicated.
SENTRY_RELEASE:
openhuman@${{ needs.prepare-build.outputs.version }}+${{
needs.prepare-build.outputs.sha }}
needs.prepare-build.outputs.short_sha }}
VERSION: ${{ needs.prepare-build.outputs.version }}
MATRIX_TARGET: ${{ matrix.settings.target }}
run: |
@@ -666,6 +685,52 @@ jobs:
app/src-tauri/target/${{ matrix.settings.target }}/${{ inputs.build_target == 'staging' && 'debug' || 'release' }}/bundle/**
target/${{ matrix.settings.target }}/${{ inputs.build_target == 'staging' && 'debug' || 'release' }}/bundle/**
# =========================================================================
# Phase 5: Record a single Sentry deploy marker once the release has
# actually been published. Hangs off `publish-release` rather than
# `build-desktop` so we don't write a Sentry deploy row for a release
# that subsequently fails `build-docker` / `publish-updater-manifest`
# and gets deleted by `cleanup-failed-release`. `publish-release` itself
# already requires the full build matrix + docker + updater manifest to
# succeed, so this transitively waits for all of them.
#
# `sentry-cli releases deploys ... new` does NOT deduplicate by
# (release, env), so this job stays single-runner — running it inside
# the matrix would add one row per platform.
# =========================================================================
record-sentry-deploy:
name: Record Sentry deploy marker
runs-on: ubuntu-latest
environment: Production
needs: [prepare-build, publish-release]
if: needs.prepare-build.outputs.release_enabled == 'true'
env:
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
steps:
- name: Install sentry-cli
if: env.SENTRY_AUTH_TOKEN != ''
shell: bash
run: curl -sSf https://sentry.io/get-cli/ | bash
- name: Record deploy marker
if: env.SENTRY_AUTH_TOKEN != ''
shell: bash
env:
SENTRY_ORG: ${{ vars.SENTRY_ORG }}
# Marker lives on the React project's release; events from all
# surfaces share the same `openhuman@<version>+<short_sha>`
# release tag, so the marker on any single project's release
# shows in Sentry's "Deploys" tab for that release group.
SENTRY_PROJECT: ${{ vars.SENTRY_PROJECT_REACT }}
SENTRY_RELEASE:
openhuman@${{ needs.prepare-build.outputs.version }}+${{
needs.prepare-build.outputs.short_sha }}
SENTRY_ENVIRONMENT: ${{ inputs.build_target == 'staging' && 'staging' || 'production' }}
run: |
set -euo pipefail
echo "==> Recording deploy marker: ${SENTRY_RELEASE} -> ${SENTRY_ENVIRONMENT}"
sentry-cli releases deploys "${SENTRY_RELEASE}" new \
-e "${SENTRY_ENVIRONMENT}"
# =========================================================================
# Phase 3b: Build & push Docker image (runs parallel with build-desktop)
# =========================================================================