Merge remote-tracking branch 'e2b/main' into lev-storage-rationalize

Author: Lev Brouk

.env.gcp.template

@@ -125,7 +125,7 @@ PERSISTENT_VOLUME_TYPES=
 CLIENT_PROXY_OIDC_ISSUER_URL=
 
 # Dashboard API user profile resolver (default: supabase)
-# One of: supabase, ory, supabase-ory-fallback
+# One of: supabase, ory
 USER_PROFILE_PROVIDER=
 # Ory Network admin SDK URL (required when USER_PROFILE_PROVIDER uses ory)
 # e.g. https://<project-slug>.projects.oryapis.com

.github/actions/deploy-setup/action.yml

@@ -16,7 +16,7 @@ runs:
   using: "composite"
   steps:
     - name: Pull infisical secrets into temporary file
-      uses: Infisical/secrets-action@v1.0.15
+      uses: Infisical/secrets-action@v1.0.16
       with:
         method: "oidc"
         identity-id: ${{ inputs.infisical_machine_identity_id }}
@@ -45,7 +45,7 @@ runs:
       shell: bash
 
     - name: Load environment variables from Infisical
-      uses: Infisical/secrets-action@v1.0.15
+      uses: Infisical/secrets-action@v1.0.16
       with:
         method: "oidc"
         identity-id: ${{ inputs.infisical_machine_identity_id }}
@@ -54,14 +54,14 @@ runs:
         export-type: "env"
 
     - name: Setup Service Account
-      uses: google-github-actions/auth@v2
+      uses: google-github-actions/auth@v3
       with:
         project_id: ${{ env.GCP_PROJECT_ID }}
         workload_identity_provider: ${{ env.GH_WORKLOAD_IDENTITY_PROVIDER }}
 
     - name: Set up Cloud SDK
       if: inputs.install_gcloud == 'true'
-      uses: google-github-actions/setup-gcloud@v2
+      uses: google-github-actions/setup-gcloud@v3
 
     - name: Setup Terraform
       uses: hashicorp/setup-terraform@v3

.github/workflows/build-and-upload-images.yml

@@ -0,0 +1,98 @@
+name: Build and upload images
+
+on:
+  push:
+    branches:
+      - main
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  build-images:
+    name: Build and upload images to the ${{ matrix.environment }} environment
+    runs-on: ci-builder
+    strategy:
+      fail-fast: false
+      matrix:
+        environment:
+          - staging
+          - foxtrot
+          - juliett
+    environment: ${{ matrix.environment }}
+    concurrency:
+      group: build-images-${{ matrix.environment }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Pull deployment secrets into temporary file
+        uses: Infisical/secrets-action@v1.0.16
+        with:
+          method: "oidc"
+          identity-id: ${{ vars.INFISICAL_MACHINE_IDENTITY_ID }}
+          project-slug: "infra-deployment"
+          env-slug: ${{ matrix.environment }}
+          export-type: "file"
+          file-output-path: "/.env.infisical"
+
+      - name: Load deployment environment
+        env:
+          ENVIRONMENT: ${{ matrix.environment }}
+        run: |
+          echo "${ENVIRONMENT}" > .last_used_env
+          cat .env.infisical | sed "s/='\(.*\)'$/=\1/g" > ".env.${ENVIRONMENT}"
+
+          set -a
+          . ".env.${ENVIRONMENT}"
+          set +a
+
+          echo "GCP_REGION=${GCP_REGION}" >> "$GITHUB_ENV"
+          echo "GCP_PROJECT_ID=${GCP_PROJECT_ID}" >> "$GITHUB_ENV"
+          echo "GH_WORKLOAD_IDENTITY_PROVIDER=${GH_WORKLOAD_IDENTITY_PROVIDER}" >> "$GITHUB_ENV"
+
+      - name: Load runtime environment
+        uses: Infisical/secrets-action@v1.0.16
+        with:
+          method: "oidc"
+          identity-id: ${{ vars.INFISICAL_MACHINE_IDENTITY_ID }}
+          project-slug: "infra-deployment-env"
+          env-slug: ${{ matrix.environment }}
+          export-type: "env"
+
+      - name: Setup Service Account
+        uses: google-github-actions/auth@v3
+        with:
+          project_id: ${{ env.GCP_PROJECT_ID }}
+          workload_identity_provider: ${{ env.GH_WORKLOAD_IDENTITY_PROVIDER }}
+
+      - name: Set up Cloud SDK
+        uses: google-github-actions/setup-gcloud@v3
+
+      - name: Set up Docker
+        env:
+          GCP_REGION: ${{ env.GCP_REGION }}
+        run: |
+          gcloud auth configure-docker "${GCP_REGION}-docker.pkg.dev" --quiet
+          ACCESS_TOKEN="$(gcloud auth print-access-token)"
+          DOCKER_AUTH_BASE64="$(echo -n "{\"username\":\"oauth2accesstoken\",\"password\":\"$ACCESS_TOKEN\"}" | base64 -w 0)"
+
+          echo "::add-mask::$DOCKER_AUTH_BASE64"
+          echo "DOCKER_AUTH_BASE64=${DOCKER_AUTH_BASE64}" >> "$GITHUB_ENV"
+
+      - name: Build and upload images
+        env:
+          AUTO_CONFIRM_DEPLOY: true
+          ENVD_UPLOAD_MODE: versioned
+        run: make build-and-upload

.github/workflows/pr-tests-arm64.yml

@@ -24,8 +24,25 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
 
+      # Don't use go-setup-cache here: its key has no arch component, so this
+      # job would share it with amd64 jobs and restore a multi-GB cache of
+      # useless amd64 objects, then rebuild everything for arm64 on top —
+      # which can fill the runner disk (and the arm64 objects never get
+      # saved). Keep a dedicated arm64-keyed cache instead.
       - name: Setup Go
-        uses: ./.github/actions/go-setup-cache
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.work
+          cache: false
+
+      - name: Restore ARM64 Go cache
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: go-arm64-cross-${{ hashFiles('go.work', 'packages/*/go.mod', 'packages/*/go.sum') }}
+          restore-keys: go-arm64-cross-
 
       - name: Install ARM64 cross-compiler
         run: sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu