fix(image): Ensure we install dev dependencies#7578
Conversation
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| ghcr: true | ||
| tag_nightly: false | ||
| tag_latest: false | ||
| # NOTE: This is specifically done to make Snuba image as lightweight as possible. | ||
| # The downside is we lose working stacktrace in Rust. | ||
| build_target: 'application' | ||
| publish_on_pr: true | ||
|
|
||
| build-production: | ||
| runs-on: ubuntu-24.04 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
| publish_on_pr: true | ||
|
|
||
| build-production: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
|
||
| build-production: | ||
| runs-on: ubuntu-24.04 |
There was a problem hiding this comment.
Bug: Removing build_target: 'application' causes production images to be built from the testing stage, including unnecessary dev dependencies.
Severity: CRITICAL | Confidence: High
🔍 Detailed Analysis
The removal of build_target: 'application' from the build-multiplatform and build-production jobs causes the docker build command to default to the final testing stage in the Dockerfile. This stage includes development dependencies like the Rust toolchain and cargo, which are explicitly removed in the application stage. Consequently, production images will be significantly larger and have an increased attack surface, contradicting the documented intent to keep Snuba images lightweight.
💡 Suggested Fix
Restore build_target: 'application' in the build-multiplatform and build-production jobs to ensure production images are built from the lightweight application stage, excluding development dependencies.
🤖 Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/image.yml#L34-L36
Potential issue: The removal of `build_target: 'application'` from the
`build-multiplatform` and `build-production` jobs causes the `docker build` command to
default to the final `testing` stage in the Dockerfile. This stage includes development
dependencies like the Rust toolchain and cargo, which are explicitly removed in the
`application` stage. Consequently, production images will be significantly larger and
have an increased attack surface, contradicting the documented intent to keep Snuba
images lightweight.
Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 5694645
2 participants
No description provided.