ci: upload browser source maps to Bugsink and keep every map out of what ships

Every image, the standalone tarballs and the Lite zips are built with
source maps (`BULWARK_SOURCE_MAPS=1`). Turbopack builds give each chunk
a debug ID themselves; the webpack build in the Docker image gets them
from `sentry-cli sourcemaps inject`. `scripts/sourcemaps.mjs collect`
then moves every map out of the build before anything is packed, and
`scripts/sourcemaps.mjs check` fails the build when a `.map` file, an
inline map or a `sourceMappingURL` to a missing file would ship.

- Docker images: a `sourcemaps` stage holds only the maps; the amd64
  job exports it (a cache hit) and uploads it, since both platforms
  build identical chunks
- standalone tarballs, the Lite zips and the Lite image upload their
  own maps and check what they ship
- `scripts/upload-sourcemaps.sh` uploads to `bulwark-instances` and
  `bulwark-telemetry` (Bugsink keeps maps per project) and skips with a
  notice when the `BUGSINK_AUTH_TOKEN` secret is missing

.github/workflows/docker-publish-lite.yml

@@ -178,9 +178,31 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             GIT_COMMIT=${{ github.sha }}
+            BULWARK_SOURCE_MAPS=1
           cache-from: type=gha,scope=lite
           cache-to: type=gha,mode=max,scope=lite
 
+      # The same build again, a cache hit, for the stage that holds only the
+      # source maps; the image never has them. One export for both platforms.
+      # https://bulwarkmail.org/docs/admin/monitoring
+      - name: Export source maps
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: Dockerfile.lite
+          platforms: linux/amd64
+          target: sourcemaps
+          build-args: |
+            GIT_COMMIT=${{ github.sha }}
+            BULWARK_SOURCE_MAPS=1
+          outputs: type=local,dest=sourcemaps
+          cache-from: type=gha,scope=lite
+
+      - name: Upload source maps to Bugsink
+        env:
+          BUGSINK_AUTH_TOKEN: ${{ secrets.BUGSINK_AUTH_TOKEN }}
+        run: bash scripts/upload-sourcemaps.sh sourcemaps
+
       - name: Inspect image
         run: docker buildx imagetools inspect ${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
 

.github/workflows/docker-publish-releases.yml

@@ -59,10 +59,34 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             GIT_COMMIT=${{ github.sha }}
+            BULWARK_SOURCE_MAPS=1
           outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
           cache-from: type=gha,scope=${{ matrix.platform }}
           cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
 
+      # The same build again, a cache hit on this builder, for the stage that
+      # holds only the source maps (Dockerfile, "sourcemaps"); the image never
+      # has them. Both platforms build identical chunks, so amd64 uploads.
+      # https://bulwarkmail.org/docs/admin/monitoring
+      - name: Export source maps
+        if: matrix.platform == 'linux/amd64'
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          target: sourcemaps
+          build-args: |
+            GIT_COMMIT=${{ github.sha }}
+            BULWARK_SOURCE_MAPS=1
+          outputs: type=local,dest=sourcemaps
+          cache-from: type=gha,scope=${{ matrix.platform }}
+
+      - name: Upload source maps to Bugsink
+        if: matrix.platform == 'linux/amd64'
+        env:
+          BUGSINK_AUTH_TOKEN: ${{ secrets.BUGSINK_AUTH_TOKEN }}
+        run: bash scripts/upload-sourcemaps.sh sourcemaps
+
       - name: Export digest
         run: |
           mkdir -p /tmp/digests
@@ -184,10 +208,35 @@ jobs:
           build-args: |
             GIT_COMMIT=${{ github.sha }}
             NEXT_PUBLIC_LOCALE_PREFIX=always
+            BULWARK_SOURCE_MAPS=1
           outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
           cache-from: type=gha,scope=always-${{ matrix.platform }}
           cache-to: type=gha,mode=max,scope=always-${{ matrix.platform }}
 
+      # The same build again, a cache hit on this builder, for the stage that
+      # holds only the source maps (Dockerfile, "sourcemaps"); the image never
+      # has them. Both platforms build identical chunks, so amd64 uploads.
+      # https://bulwarkmail.org/docs/admin/monitoring
+      - name: Export source maps
+        if: matrix.platform == 'linux/amd64'
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          target: sourcemaps
+          build-args: |
+            GIT_COMMIT=${{ github.sha }}
+            NEXT_PUBLIC_LOCALE_PREFIX=always
+            BULWARK_SOURCE_MAPS=1
+          outputs: type=local,dest=sourcemaps
+          cache-from: type=gha,scope=always-${{ matrix.platform }}
+
+      - name: Upload source maps to Bugsink
+        if: matrix.platform == 'linux/amd64'
+        env:
+          BUGSINK_AUTH_TOKEN: ${{ secrets.BUGSINK_AUTH_TOKEN }}
+        run: bash scripts/upload-sourcemaps.sh sourcemaps
+
       - name: Export digest
         run: |
           mkdir -p /tmp/digests-always

.github/workflows/docker-publish.yml

@@ -18,6 +18,9 @@ on:
       - "public/**"
       - "package.json"
       - "package-lock.json"
+      - "scripts/healthcheck.mjs"
+      - "scripts/sourcemaps.mjs"
+      - "scripts/upload-sourcemaps.sh"
       - ".github/workflows/docker-publish.yml"
   workflow_dispatch:
 
@@ -89,10 +92,34 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             GIT_COMMIT=${{ github.sha }}
+            BULWARK_SOURCE_MAPS=1
           outputs: type=image,name=${{ needs.prepare.outputs.image_name }},push-by-digest=true,name-canonical=true,push=true
           cache-from: type=gha,scope=${{ matrix.platform }}
           cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
 
+      # The same build again, a cache hit on this builder, for the stage that
+      # holds only the source maps (Dockerfile, "sourcemaps"); the image never
+      # has them. Both platforms build identical chunks, so amd64 uploads.
+      # https://bulwarkmail.org/docs/admin/monitoring
+      - name: Export source maps
+        if: matrix.platform == 'linux/amd64'
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          target: sourcemaps
+          build-args: |
+            GIT_COMMIT=${{ github.sha }}
+            BULWARK_SOURCE_MAPS=1
+          outputs: type=local,dest=sourcemaps
+          cache-from: type=gha,scope=${{ matrix.platform }}
+
+      - name: Upload source maps to Bugsink
+        if: matrix.platform == 'linux/amd64'
+        env:
+          BUGSINK_AUTH_TOKEN: ${{ secrets.BUGSINK_AUTH_TOKEN }}
+        run: bash scripts/upload-sourcemaps.sh sourcemaps
+
       - name: Export digest
         run: |
           mkdir -p /tmp/digests

.github/workflows/standalone-release.yml

@@ -40,9 +40,24 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      # With browser and server source maps; Turbopack gives every chunk a
+      # debug ID. The maps go to Bugsink and never into the tarball.
+      # https://bulwarkmail.org/docs/admin/monitoring
       - name: Build standalone
+        env:
+          BULWARK_SOURCE_MAPS: "1"
         run: npm run build
 
+      - name: Move source maps out of the build
+        run: node scripts/sourcemaps.mjs collect --out sourcemaps .next/static .next/standalone
+
+      # Turbopack chunks were not checked for being the same on both
+      # platforms, so each one uploads its own.
+      - name: Upload source maps to Bugsink
+        env:
+          BUGSINK_AUTH_TOKEN: ${{ secrets.BUGSINK_AUTH_TOKEN }}
+        run: bash scripts/upload-sourcemaps.sh sourcemaps
+
       - name: Package tarball
         env:
           REF_NAME: ${{ github.ref_name }}
@@ -59,6 +74,9 @@ jobs:
           tar -czf "$TARBALL" bulwark-standalone/
           echo "TARBALL=$TARBALL" >> "$GITHUB_ENV"
 
+      - name: Check the tarball holds no source maps
+        run: node scripts/sourcemaps.mjs check "$TARBALL"
+
       - name: Upload artifact
         uses: actions/upload-artifact@v7
         with:

.github/workflows/static-lite.yml

@@ -79,8 +79,18 @@ jobs:
           LITE_APP_NAME: ${{ inputs.app_name }}
           LITE_LOCALES: ${{ inputs.locales }}
           LITE_DEMO_MODE: ${{ inputs.demo }}
+          # Browser source maps for Bugsink; build:lite moves them out of out/
+          # before anything is packed. https://bulwarkmail.org/docs/admin/monitoring
+          BULWARK_SOURCE_MAPS: "1"
+          SOURCEMAPS_OUT: sourcemaps
         run: npm run build:lite
 
+      # Each target is its own build with its own chunks, so each uploads.
+      - name: Upload source maps to Bugsink
+        env:
+          BUGSINK_AUTH_TOKEN: ${{ secrets.BUGSINK_AUTH_TOKEN }}
+        run: bash scripts/upload-sourcemaps.sh sourcemaps
+
       # Every host literal in the bundle must be a placeholder, the configured
       # JMAP server, a built-in host the no-third-party switch turns off, or a
       # string listed as never requested (#903).
@@ -107,6 +117,9 @@ jobs:
           echo "ZIP=${ZIP}" >> "$GITHUB_ENV"
           ls -la "${ZIP}"
 
+      - name: Check the zip holds no source maps
+        run: node scripts/sourcemaps.mjs check "$ZIP"
+
       - name: Upload artifact
         uses: actions/upload-artifact@v7
         with: