Skip to content

Commit 62d90f1

Browse files
geclosgeclos
committed
chore: move dd api key to docker secrets and expose a RELEASE_VERSION env var to correctly map source maps to commits/deployments
1 parent b6dc2a7 commit 62d90f1

File tree

11 files changed

+51
-42
lines changed

11 files changed

+51
-42
lines changed

‎.github/workflows/build-and-push.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -228,21 +228,21 @@ jobs:
228228
NEXT_SERVER_ACTIONS_ENCRYPTION_KEY=${{ secrets.NEXT_SERVER_ACTIONS_ENCRYPTION_KEY }}
229229
AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_ID }}
230230
AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_ACCESS_KEY }}
231+
DATADOG_API_KEY=${{ secrets.DATADOG_API_KEY }}
231232
build-args: |
232233
AWS_REGION=${{ vars.AWS_REGION }}
233234
BUILD_ID=${{ github.sha }}
235+
DD_GIT_COMMIT_SHA=${{ github.sha }}
236+
DD_GIT_REPOSITORY_URL=${{ github.server_url }}/${{ github.repository }}
237+
NEXT_PUBLIC_DATADOG_APPLICATION_ID=${{ secrets.NEXT_PUBLIC_DATADOG_APPLICATION_ID }}
238+
NEXT_PUBLIC_DATADOG_CLIENT_TOKEN=${{ secrets.NEXT_PUBLIC_DATADOG_CLIENT_TOKEN }}
239+
NEXT_PUBLIC_DATADOG_SITE=${{ secrets.NEXT_PUBLIC_DATADOG_SITE }}
234240
NEXT_PUBLIC_DOCS_URL=${{ vars.NEXT_PUBLIC_DOCS_URL }}
235241
NEXT_PUBLIC_LATITUDE_CLOUD_PAYMENT_URL=${{ vars.NEXT_PUBLIC_LATITUDE_CLOUD_PAYMENT_URL }}
236242
NEXT_PUBLIC_POSTHOG_HOST=${{ secrets.NEXT_PUBLIC_POSTHOG_HOST }}
237243
NEXT_PUBLIC_POSTHOG_KEY=${{ secrets.NEXT_PUBLIC_POSTHOG_KEY }}
238-
NEXT_PUBLIC_DATADOG_APPLICATION_ID=${{ secrets.NEXT_PUBLIC_DATADOG_APPLICATION_ID }}
239-
NEXT_PUBLIC_DATADOG_CLIENT_TOKEN=${{ secrets.NEXT_PUBLIC_DATADOG_CLIENT_TOKEN }}
240-
NEXT_PUBLIC_DATADOG_SITE=${{ secrets.NEXT_PUBLIC_DATADOG_SITE }}
241-
DATADOG_API_KEY=${{ secrets.DATADOG_API_KEY }}
242244
S3_BUCKET=${{ vars.STATIC_ASSETS_S3_BUCKET }}
243245
STATIC_ASSETS_HOST=${{ vars.STATIC_ASSETS_HOST }}
244-
DD_GIT_REPOSITORY_URL=${{ github.server_url }}/${{ github.repository }}
245-
DD_GIT_COMMIT_SHA=${{ github.sha }}
246246
247247
run-migrations:
248248
needs: [build-and-push-private]

‎apps/gateway/docker/Dockerfile‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ ARG PROJECT="@latitude-data/gateway"
22
ARG PROJECT_PATH="apps/gateway"
33
ARG DD_GIT_REPOSITORY_URL
44
ARG DD_GIT_COMMIT_SHA
5-
ARG DATADOG_API_KEY
65

76
FROM node:22-alpine AS alpine
87

@@ -48,9 +47,9 @@ FROM base AS builder
4847

4948
ARG PROJECT
5049
ARG PROJECT_PATH
51-
ARG DATADOG_API_KEY
50+
ARG DD_GIT_COMMIT_SHA
5251

53-
ENV DATADOG_API_KEY=$DATADOG_API_KEY
52+
ENV RELEASE_VERSION=${DD_GIT_COMMIT_SHA:-unknown}
5453

5554
WORKDIR /app
5655

@@ -71,13 +70,15 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
7170
pnpm turbo build --filter="${PROJECT}..."
7271

7372
# Upload source maps to Datadog
74-
RUN if [ -n "$DATADOG_API_KEY" ]; then \
75-
echo "Uploading gateway source maps to Datadog..."; \
76-
cd apps/gateway && \
77-
pnpm datadog:sourcemaps; \
78-
else \
79-
echo "Skipping Datadog source map upload for gateway - missing required environment variables (DATADOG_API_KEY)"; \
80-
fi
73+
RUN --mount=type=secret,id=DATADOG_API_KEY \
74+
if [ -s /run/secrets/DATADOG_API_KEY ]; then \
75+
echo "Uploading gateway source maps to Datadog..."; \
76+
export DATADOG_API_KEY="$(cat /run/secrets/DATADOG_API_KEY)" && \
77+
cd apps/gateway && \
78+
pnpm datadog:sourcemaps; \
79+
else \
80+
echo "Skipping Datadog source map upload for gateway - DATADOG_API_KEY secret not provided"; \
81+
fi
8182

8283
# Since `pnpm prune` doesn't handle recursive dependencies effectively,
8384
# we follow pnpm's recommended approach: remove node_modules entirely
@@ -104,6 +105,7 @@ ENV NODE_ENV=production
104105
ENV KEEP_ALIVE_TIMEOUT=601000
105106
ENV DD_GIT_REPOSITORY_URL=${DD_GIT_REPOSITORY_URL:-}
106107
ENV DD_GIT_COMMIT_SHA=${DD_GIT_COMMIT_SHA:-}
108+
ENV RELEASE_VERSION=${DD_GIT_COMMIT_SHA:-}
107109

108110
EXPOSE $PORT
109111

‎apps/gateway/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"tc": "tsc --noEmit",
1313
"test": "vitest --run",
1414
"test:watch": "vitest",
15-
"datadog:sourcemaps": "datadog-ci sourcemaps upload dist --service=latitude-gateway --minified-path-prefix=/app/apps/gateway/dist"
15+
"datadog:sourcemaps": "datadog-ci sourcemaps upload dist --service=latitude-llm-gateway --minified-path-prefix=/app/apps/gateway/dist --release-version=${RELEASE_VERSION:-unknown}"
1616
},
1717
"dependencies": {
1818
"@hono/node-server": "1.13.2",

‎apps/web/docker/Dockerfile‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ ARG S3_BUCKET
99
ARG BUILD_ID
1010
ARG DD_GIT_REPOSITORY_URL
1111
ARG DD_GIT_COMMIT_SHA
12-
ARG DATADOK_API_KEY
1312

1413

1514
FROM node:22-alpine AS alpine
@@ -68,11 +67,9 @@ RUN turbo prune "${PROJECT}" --docker
6867
FROM base AS builder
6968

7069
ARG AWS_REGION
71-
ARG S3_BUCKET
7270

7371
ARG BUILD_ID
7472

75-
ARG DATADOK_API_KEY
7673
ARG DD_GIT_COMMIT_SHA
7774
ARG DD_GIT_REPOSITORY_URL
7875

@@ -92,7 +89,6 @@ ENV S3_BUCKET=${S3_BUCKET:-}
9289

9390
ENV BUILD_ID=${BUILD_ID:-}
9491

95-
ENV DATADOG_API_KEY=$DATADOG_API_KEY
9692
ENV DD_GIT_COMMIT_SHA=${DD_GIT_COMMIT_SHA:-}
9793
ENV DD_GIT_REPOSITORY_URL=${DD_GIT_REPOSITORY_URL:-}
9894

@@ -105,6 +101,7 @@ ENV NEXT_PUBLIC_POSTHOG_HOST=$NEXT_PUBLIC_POSTHOG_HOST
105101
ENV NEXT_PUBLIC_POSTHOG_KEY=$NEXT_PUBLIC_POSTHOG_KEY
106102

107103
ENV STATIC_ASSETS_HOST=${STATIC_ASSETS_HOST:-}
104+
ENV RELEASE_VERSION=${DD_GIT_COMMIT_SHA:-unknown}
108105

109106
WORKDIR /app
110107

@@ -135,6 +132,7 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
135132
AWS_REGION=$AWS_REGION && \
136133
S3_BUCKET=$S3_BUCKET && \
137134
BUILD_ID=$BUILD_ID && \
135+
RELEASE_VERSION=$RELEASE_VERSION && \
138136
STATIC_ASSETS_HOST=$STATIC_ASSETS_HOST && \
139137
if [ -n "$STATIC_ASSETS_HOST" ] && [ -n "$BUILD_ID" ]; then NEXT_PUBLIC_STATIC_ASSETS_URL="https://$STATIC_ASSETS_HOST/static-assets/$BUILD_ID"; fi && \
140138
NODE_OPTIONS="--max-old-space-size=8192" && \
@@ -161,13 +159,15 @@ else \
161159
fi
162160

163161
# Upload source maps to Datadog
164-
RUN if [ -n "$DATADOG_API_KEY" ]; then \
165-
echo "Uploading source maps to Datadog..."; \
166-
cd apps/web && \
167-
pnpm datadog:sourcemaps; \
168-
else \
169-
echo "Skipping Datadog source map upload - missing required environment variables (DATADOG_API_KEY)"; \
170-
fi
162+
RUN --mount=type=secret,id=DATADOG_API_KEY \
163+
if [ -s /run/secrets/DATADOG_API_KEY ]; then \
164+
echo "Uploading source maps to Datadog..."; \
165+
export DATADOG_API_KEY="$(cat /run/secrets/DATADOG_API_KEY)" && \
166+
cd apps/web && \
167+
pnpm datadog:sourcemaps; \
168+
else \
169+
echo "Skipping Datadog source map upload - DATADOG_API_KEY secret not provided"; \
170+
fi
171171

172172
RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm prune --prod --no-optional
173173

@@ -185,6 +185,7 @@ ENV NODE_ENV=production
185185
ENV PORT=8080
186186
ENV DD_GIT_REPOSITORY_URL=${DD_GIT_REPOSITORY_URL:-}
187187
ENV DD_GIT_COMMIT_SHA=${DD_GIT_COMMIT_SHA:-}
188+
ENV RELEASE_VERSION=${DD_GIT_COMMIT_SHA:-}
188189

189190
WORKDIR /app
190191

‎apps/web/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
"tc": "tsc --noEmit",
1616
"test": "TZ=UTC vitest --run",
1717
"test:watch": "TZ=UTC vitest",
18-
"datadog:sourcemaps": "datadog-ci sourcemaps upload .next/static --service=latitude-web --minified-path-prefix=/_next/static"
18+
"datadog:sourcemaps": "datadog-ci sourcemaps upload .next/static --service=latitude-llm-web --minified-path-prefix=/_next/static --release-version=${RELEASE_VERSION:-unknown}"
1919
},
2020
"dependencies": {
2121
"@aws-sdk/client-s3": "3.850.0",

‎apps/web/src/envClient.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ export const envClient = createEnv({
1515
NEXT_PUBLIC_DATADOG_CLIENT_TOKEN: z.string().optional(),
1616
NEXT_PUBLIC_DATADOG_SITE: z.string().optional(),
1717
NEXT_PUBLIC_NODE_ENV: z.string().optional(),
18+
NEXT_PUBLIC_RELEASE_VERSION: z.string().optional(),
1819
},
1920
runtimeEnv: {
2021
NEXT_PUBLIC_LATITUDE_CLOUD_PAYMENT_URL:
@@ -32,5 +33,6 @@ export const envClient = createEnv({
3233
NEXT_PUBLIC_DATADOG_SITE:
3334
process.env.NEXT_PUBLIC_DATADOG_SITE ?? 'datadoghq.eu',
3435
NEXT_PUBLIC_NODE_ENV: process.env.NODE_ENV ?? 'development',
36+
NEXT_PUBLIC_RELEASE_VERSION: process.env.RELEASE_VERSION ?? '',
3537
},
3638
})

‎apps/web/src/instrumentation-client.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ if (
1212
applicationId: envClient.NEXT_PUBLIC_DATADOG_APPLICATION_ID,
1313
clientToken: envClient.NEXT_PUBLIC_DATADOG_CLIENT_TOKEN,
1414
site: (envClient.NEXT_PUBLIC_DATADOG_SITE as Site) || 'datadoghq.com',
15-
service: 'latitude-web',
15+
service: 'latitude-llm-web',
1616
env: envClient.NEXT_PUBLIC_NODE_ENV || 'development',
1717
version: '1.0.0',
1818
sessionSampleRate: 100,

‎apps/web/src/instrumentation.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ export async function register() {
44
const { envClient } = await import('./envClient')
55

66
tracer.init({
7-
service: 'latitude-web',
7+
service: 'latitude-llm-web',
88
env: envClient.NEXT_PUBLIC_NODE_ENV || 'development',
99
version: process.env.npm_package_version || '1.0.0',
1010
logInjection: true,

‎apps/workers/docker/Dockerfile‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
ARG PROJECT="@latitude-data/workers"
22
ARG PROJECT_PATH="apps/workers"
3-
ARG DATADOG_API_KEY
43
ARG DD_GIT_REPOSITORY_URL
54
ARG DD_GIT_COMMIT_SHA
65

@@ -36,9 +35,9 @@ FROM base AS builder
3635

3736
ARG PROJECT
3837
ARG PROJECT_PATH
39-
ARG DATADOG_API_KEY
38+
ARG DD_GIT_COMMIT_SHA
4039

41-
ENV DATADOG_API_KEY=$DATADOG_API_KEY
40+
ENV RELEASE_VERSION=${DD_GIT_COMMIT_SHA:-unknown}
4241

4342
WORKDIR /app
4443

@@ -59,13 +58,15 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
5958
pnpm turbo build --filter="${PROJECT}..."
6059

6160
# Upload source maps to Datadog
62-
RUN if [ -n "$DATADOG_API_KEY" ]; then \
63-
echo "Uploading workers source maps to Datadog..."; \
64-
cd apps/workers && \
65-
pnpm datadog:sourcemaps; \
66-
else \
67-
echo "Skipping Datadog source map upload for workers - missing required environment variables (DATADOG_API_KEY)"; \
68-
fi
61+
RUN --mount=type=secret,id=DATADOG_API_KEY \
62+
if [ -s /run/secrets/DATADOG_API_KEY ]; then \
63+
echo "Uploading workers source maps to Datadog..."; \
64+
export DATADOG_API_KEY="$(cat /run/secrets/DATADOG_API_KEY)" && \
65+
cd apps/workers && \
66+
pnpm datadog:sourcemaps; \
67+
else \
68+
echo "Skipping Datadog source map upload for workers - DATADOG_API_KEY secret not provided"; \
69+
fi
6970

7071
# Since `pnpm prune` doesn't handle recursive dependencies effectively,
7172
# we follow pnpm's recommended approach: remove node_modules entirely
@@ -88,6 +89,7 @@ ENV PORT=$PORT
8889
ENV NODE_ENV=production
8990
ENV DD_GIT_REPOSITORY_URL=${DD_GIT_REPOSITORY_URL:-}
9091
ENV DD_GIT_COMMIT_SHA=${DD_GIT_COMMIT_SHA:-}
92+
ENV RELEASE_VERSION=${DD_GIT_COMMIT_SHA:-}
9193

9294
EXPOSE $PORT
9395

‎apps/workers/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
"lint": "eslint src/",
1212
"start": "node -r module-alias/register ./dist --env=production",
1313
"tc": "tsc --noEmit",
14-
"datadog:sourcemaps": "datadog-ci sourcemaps upload dist --service=latitude-workers --minified-path-prefix=/app/apps/workers/dist"
14+
"datadog:sourcemaps": "datadog-ci sourcemaps upload dist --service=latitude-llm-workers --minified-path-prefix=/app/apps/workers/dist --release-version=${RELEASE_VERSION:-unknown}"
1515
},
1616
"dependencies": {
1717
"@bull-board/api": "6.10.1",

0 commit comments

Comments
 (0)