[NA] [INFRA] chore: add Paperboy Cloud Build images by Levi-Wu-777 · Pull Request #2 · paperboytm/opik

Levi-Wu-777 · 2026-07-01T10:04:38Z

Details

Add a Paperboy-owned image build path for the paperboytm/opik fork. The workflow resolves a Paperboy image tag, submits the build to Google Cloud Build, and publishes the four Opik runtime images into Paperboy Artifact Registry.

Adds cloudbuild.paperboy-images.yaml with E2_HIGHCPU_32, 200GB disk, BuildKit-enabled Docker builds, and parallel backend/frontend/sandbox builds.
Adds .gcloudignore.paperboy-images so Cloud Build uploads only the image build contexts instead of local caches such as node_modules.
Adds a manual GitHub Actions workflow that delegates build/push work to Cloud Build.
Adds PAPERBOY_IMAGE_BUILD.md, a Paperboy runbook for tag selection, GCP setup, manual Cloud Build, workflow dispatch, GAR verification, Platform deployment linkage, and common failure modes.

Operational prerequisite: the GitHub workflow expects secrets.GCP_SA_KEY to be configured for paperboytm/opik or its google-cloud-prod environment. The current manual verification used local gcloud auth instead.

Impact

This does not change Opik application behavior. It adds Paperboy infrastructure and documentation for building fork-owned images so Paperboy deployments can run images from us-central1-docker.pkg.dev/gen-lang-client-0436525842/paperboy instead of official upstream application images.

Test

ruby -e 'require "yaml"; %w[.github/workflows/paperboy-build-images.yml cloudbuild.paperboy-images.yaml].each { |f| YAML.load_file(f); puts "#{f} ok" }'
awk '/^```/{c++} END{print c, (c%2==0 ? "fences balanced" : "fences unbalanced")}' PAPERBOY_IMAGE_BUILD.md -> 74 fences balanced
gcloud meta list-files-for-upload . with .gcloudignore.paperboy-images temporarily copied to .gcloudignore, confirming 5876 upload files and no node_modules upload.
gcloud builds submit --project=gen-lang-client-0436525842 --config=cloudbuild.paperboy-images.yaml --substitutions="_REGISTRY=us-central1-docker.pkg.dev/gen-lang-client-0436525842/paperboy,_TAG=2.1.11-paperboy-d80c0bfb59b0" --ignore-file=.gcloudignore.paperboy-images .
Successful Cloud Build: b2676833-d39f-467b-a712-d89d36f754de, duration 3m58s.
Verified pushed tags with gcloud artifacts docker tags list for all four images:
- opik-sandbox-executor-python:2.1.11-paperboy-d80c0bfb59b0 -> sha256:e0beed45de29f724fa67d12124538f5294f3a7b75fd98a726603b7bee667aa4a
- opik-backend:2.1.11-paperboy-d80c0bfb59b0 -> sha256:395cefa6e21b15efd470d9cb7809e121a9fedae8c647e0aac4631010f4f3a199
- opik-python-backend:2.1.11-paperboy-d80c0bfb59b0 -> sha256:da561eeec69dcd2876e70d4dddd3191581389e2f1ad84be52fcd6e3c00c51725
- opik-frontend:2.1.11-paperboy-d80c0bfb59b0 -> sha256:2155a9c952749390727fa3986c1fe4b554696c57b441b215d5cab3e1ee5d58cc
actionlint was not installed locally; workflow syntax was checked with YAML parsing and should still be linted by CI.

Rollback

Revert this PR to remove the Paperboy workflow, Cloud Build config, and runbook. Already-pushed GAR images are immutable deployment artifacts and can be left unused; Platform deployments can roll back by pointing Helm values back to the official upstream image registry/tag.

Change checklist

User facing
Documentation update

Issues

No Jira issue.

AI-WATERMARK

AI-WATERMARK: yes

Tools: Codex, gcloud, gh, Docker/Cloud Build, GitHub Actions YAML validation
Model(s): GPT-5
Scope: authored CI/Cloud Build configuration, documented the Paperboy image build flow, and ran operational verification
Human verification: requested by Paperboy team; manual Cloud Build and GAR tag verification completed

Testing

See ## Test above for exact commands, build id, pushed image digests, and doc validation. This PR does not include UI behavior changes, so no browser recording was produced.

Documentation

Added root-level Paperboy runbook: PAPERBOY_IMAGE_BUILD.md.

greptile-apps · 2026-07-01T10:07:18Z

Greptile Summary

This PR adds a Paperboy-owned image build path for Opik. The main changes are:

A manual GitHub Actions workflow for submitting Paperboy image builds.
A Cloud Build config for backend, frontend, python-backend, and sandbox executor images.
A scoped Cloud Build ignore file for the image build contexts.

Confidence Score: 4/5

The manual image tag path needs a fix before merging.

The Cloud Build steps and sandbox tarball handoff look consistent.
The free-form tag input can break output parsing, Cloud Build substitutions, or Docker image refs.
The scoped ignore file covers the inspected build contexts.

.github/workflows/paperboy-build-images.yml

Important Files Changed

Filename	Overview
.github/workflows/paperboy-build-images.yml	Adds the manual Paperboy build workflow; the tag input is propagated without validation.
cloudbuild.paperboy-images.yaml	Adds the Cloud Build image pipeline with consistent sandbox tarball ordering for the python backend image.
.gcloudignore.paperboy-images	Adds a scoped Cloud Build upload filter for the four image build contexts.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Manual workflow dispatch] --> B[Checkout selected ref]
  B --> C[Resolve registry and tag]
  C --> D[Submit Cloud Build]
  D --> E1[Build sandbox executor]
  D --> E2[Build backend]
  D --> E3[Build frontend]
  E1 --> F1[Push sandbox executor]
  E1 --> F2[Save sandbox tarball]
  F2 --> G[Build python backend]
  E2 --> H1[Push backend]
  E3 --> H2[Push frontend]
  G --> H3[Push python backend]

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
  A[Manual workflow dispatch] --> B[Checkout selected ref]
  B --> C[Resolve registry and tag]
  C --> D[Submit Cloud Build]
  D --> E1[Build sandbox executor]
  D --> E2[Build backend]
  D --> E3[Build frontend]
  E1 --> F1[Push sandbox executor]
  E1 --> F2[Save sandbox tarball]
  F2 --> G[Build python backend]
  E2 --> H1[Push backend]
  E3 --> H2[Push frontend]
  G --> H3[Push python backend]

_{Reviews (1): Last reviewed commit: "[NA] [INFRA] chore: add Paperboy Cloud B..." | Re-trigger Greptile}

greptile-apps · 2026-07-01T10:07:21Z

+          echo "registry=${registry}" >> "$GITHUB_OUTPUT"
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+          echo "Submitting Cloud Build for ${registry}/<image>:${tag}"


Free-Form Tag Breaks Build Inputs

When a manual run supplies a tag containing a comma, newline, slash, colon, whitespace, or other invalid Docker tag character, this workflow writes it directly to $GITHUB_OUTPUT and then passes it into gcloud --substitutions and Docker image refs. That can corrupt the step output, make Cloud Build parse the tag as multiple substitutions, or fail the docker build/docker push with an invalid image reference.

Suggested change

echo "registry=${registry}" >> "$GITHUB_OUTPUT"

echo "tag=${tag}" >> "$GITHUB_OUTPUT"

echo "Submitting Cloud Build for ${registry}/<image>:${tag}"

if [[ ! "${tag}" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]]; then

echo "Invalid image tag: ${tag}" >&2

echo "Tags must match [A-Za-z0-9_][A-Za-z0-9_.-]{0,127}." >&2

exit 1

fi

echo "registry=${registry}" >> "$GITHUB_OUTPUT"

echo "tag=${tag}" >> "$GITHUB_OUTPUT"

echo "Submitting Cloud Build for ${registry}/<image>:${tag}"

[NA] [INFRA] chore: add Paperboy Cloud Build images

a78f5c7

github-actions Bot assigned Levi-Wu-777 Jul 1, 2026

github-actions Bot added the Infrastructure label Jul 1, 2026

docs(paperboy): document image build flow

7d0ea61

greptile-apps Bot reviewed Jul 1, 2026

View reviewed changes

github-actions Bot added the documentation Improvements or additions to documentation label Jul 1, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[NA] [INFRA] chore: add Paperboy Cloud Build images#2

[NA] [INFRA] chore: add Paperboy Cloud Build images#2
Levi-Wu-777 wants to merge 2 commits into
mainfrom
codex/paperboy-gar-images

Levi-Wu-777 commented Jul 1, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jul 1, 2026

Important Files Changed

Uh oh!

greptile-apps Bot Jul 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

Levi-Wu-777 commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Impact

Test

Rollback

Change checklist

Issues

AI-WATERMARK

Testing

Documentation

Uh oh!

greptile-apps Bot commented Jul 1, 2026

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Flowchart

Uh oh!

greptile-apps Bot Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Levi-Wu-777 commented Jul 1, 2026 •

edited

Loading