build: build symbolicator as multarch image (#1592)

.github/workflows/image.yml

@@ -1,6 +1,7 @@
 name: image
 on:
   pull_request:
+    types: [opened, synchronize, reopened, labeled]
   push:
     branches:
       - master
@@ -11,22 +12,58 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  build-setup:
+    name: Setup build metadata
+    runs-on: ubuntu-latest
+
+    env:
+      FULL_CI: "${{
+        github.event_name != 'pull_request'
+        || contains(github.event.pull_request.labels.*.name, 'Trigger: Full-CI')
+      }}"
+
+    steps:
+      - id: set-outputs
+        run: |
+          echo "full_ci=$FULL_CI" >> $GITHUB_OUTPUT
+
+          if [[ "$FULL_CI" == "true" ]]; then
+            echo "Running full CI"
+            echo 'archs=["amd64", "arm64"]' >> $GITHUB_OUTPUT
+          else
+            echo "Skipping some CI steps"
+            echo 'archs=["amd64"]' >> $GITHUB_OUTPUT
+          fi
+    outputs:
+      archs: "${{ steps.set-outputs.outputs.archs }}"
+      full_ci: "${{ steps.set-outputs.outputs.full_ci }}"
+
+
   build-image:
+    needs: build-setup
+
     strategy:
       matrix:
-        arch: [amd64]
-    runs-on: ubuntu-20.04
+        arch: ${{ fromJson(needs.build-setup.outputs.archs) }}
+
+    runs-on: |-
+      ${{fromJson('{
+        "amd64": "ubuntu-20.04",
+        "arm64": "ubuntu-22.04-arm64-relay"
+      }')[matrix.arch] }}
+
     env:
-      # IMG_CACHE: ghcr.io/getsentry/symbolicator:${{ matrix.arch }}-latest
       IMG_VERSIONED: ghcr.io/getsentry/symbolicator:${{ matrix.arch }}-${{ github.sha }}
       NIGHTLY_IMG_CACHE: ghcr.io/getsentry/symbolicator:${{ matrix.arch }}-nightly
       BUILDER_IMG_CACHE: ghcr.io/getsentry/symbolicator:${{ matrix.arch }}-builder
+
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - run: docker run --rm --privileged tonistiigi/binfmt --install arm64
-        if: matrix.arch == 'arm64'
+
+      - name: Docker Login
+        run: docker login --username '${{ github.actor }}' --password '${{ secrets.GITHUB_TOKEN }}' ghcr.io
 
       - name: build builder img
         run: |
@@ -62,13 +99,34 @@ jobs:
 
       - name: push all images
         if: github.event_name != 'pull_request'
+        run: docker push "$IMG_VERSIONED"
+
+
+  assemble:
+    needs: build-image
+    if: github.event_name != 'pull_request'
+
+    runs-on: ubuntu-20.04
+
+    steps:
+      - name: Docker Login
+        run: docker login --username '${{ github.actor }}' --password '${{ secrets.GITHUB_TOKEN }}' ghcr.io
+
+      - name: Assemble Sha Image
         run: |
-          set -euxo pipefail
-          docker login --username '${{ github.actor }}' --password '${{ secrets.GITHUB_TOKEN }}' ghcr.io
-          docker push "$BUILDER_IMG_CACHE"
-          docker push "$NIGHTLY_IMG_CACHE"
-          docker push "$IMG_VERSIONED"
-
-          # for now arm64 is too slow so just retag this as latest
-          docker tag "$IMG_VERSIONED" ghcr.io/getsentry/symbolicator:latest
-          docker push ghcr.io/getsentry/symbolicator:latest
+          docker manifest create \
+            'ghcr.io/getsentry/symbolicator:${{ github.sha }}' \
+            'ghcr.io/getsentry/symbolicator:arm64-${{ github.sha }}' \
+            'ghcr.io/getsentry/symbolicator:amd64-${{ github.sha }}'
+
+          docker manifest push ghcr.io/getsentry/symbolicator:${{ github.sha }}
+
+      - name: Assemble Latest Image
+        if: github.ref_name == 'master'
+        run: |
+          docker manifest create \
+            'ghcr.io/getsentry/symbolicator:latest' \
+            'ghcr.io/getsentry/symbolicator:arm64-${{ github.sha }}' \
+            'ghcr.io/getsentry/symbolicator:amd64-${{ github.sha }}'
+
+          docker manifest push ghcr.io/getsentry/symbolicator:latest

Dockerfile

@@ -1,5 +1,12 @@
 # CLI
-FROM getsentry/sentry-cli:2 AS sentry-cli
+FROM debian:bookworm-slim AS sentry-cli
+
+RUN apt-get update \
+    && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends ca-certificates curl \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl -sL https://sentry.io/get-cli/ | sh
 
 # Image with cargo-chef as base image to our builder
 FROM rust:slim-bookworm AS symbolicator-chef
@@ -41,7 +48,7 @@ RUN cp target/release-lto/symbolicator target/release-lto/symbolicator.debug \
     && cp ./target/release-lto/symbolicator /usr/local/bin \
     && zip /opt/symbolicator-debug.zip target/release-lto/symbolicator.debug
 
-COPY --from=sentry-cli /bin/sentry-cli /bin/sentry-cli
+COPY --from=sentry-cli /usr/local/bin/sentry-cli /bin/sentry-cli
 RUN sentry-cli --version \
     && SOURCE_BUNDLE="$(sentry-cli difutil bundle-sources ./target/release-lto/symbolicator.debug)" \
     && mv "$SOURCE_BUNDLE" /opt/symbolicator.src.zip