feat(ci): improve container build process v2 by eliotlim · Pull Request #9317 · opengovsg/FormSG

eliotlim · 2026-04-16T12:48:12Z

Problem

The CI pipeline is inefficient, because containers are built several times over and over for each environment.

Closes FRM-2351.

Related to #9276, #9286.

Solution

Breaking Changes

No - this PR is backwards compatible

Improvements:

use GitHub Container Registry (GHCR) to store pre-built base and release images
build images once on the release branch to reduce deployment time
refine hardcoded VITE_APP_* constants
- only constants are built into the Vite output: APP_VERSION, DD_RUM_APP_ID, DD_RUM_CLIENT_TOKEN
- moved to backend-loaded runtimeEnv / clientEnv: appUrl, apiBaseUrl: '/api/v3', gaTrackingId, formsgSdkMode, ddRumEnv, ddSampleRate

Bug Fixes:

Replace npx @datadog/datadog-ci with the binary version for sourcemap upload

Tests

TC1: Deployment and Versioning works correctly

Deployments to STG and PRD should work normally.
The application version should be correctly tagged to logs and metrics in DataDog.

TC2: Admins must be able to download results on the results page

Visit an existing form's results page
Click Download, select all options, and Download.
All the files and CSVs should be downloaded correctly.

Deploy Notes

linear · 2026-04-16T12:51:03Z

FRM-2351 Refactor Container Base / Release images from CI Build

Copilot

Pull request overview

This PR refactors the container build/deploy pipeline by introducing pre-built base images and a release image flow, while moving several frontend configuration values from build-time Vite envs to runtime-injected window.__ENV__ served by the backend.

Changes:

Add runtime frontend env injection (window.__ENV__) from the backend and update the frontend to consume it via a centralized env helper.
Introduce Dockerfile.base (build-base + runtime-base) and update Dockerfile.production to build from those base images.
Update GitHub Actions workflows to (a) ensure base images exist, (b) optionally reuse pre-built release images, and (c) move Datadog sourcemap upload out of the Docker build.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
packages/shared/types/core.ts	Adds `FrontendRuntimeEnv` type shared between backend injection and frontend consumption.
apps/frontend/vite.config.ts	Adds a Vite plugin to replace `@VITE_APP_*` placeholders at build time.
apps/frontend/src/utils/formSdk.ts	Switches FormSG SDK mode selection to use centralized `env`.
apps/frontend/src/services/ApiService.ts	Switches API base URL to use centralized `env`.
apps/frontend/src/index.tsx	Switches GA tracking ID lookup to use centralized `env`.
apps/frontend/src/growthbook.ts	Switches app URL usage to use centralized `env`.
apps/frontend/src/features/public-form/utils/axiosDebugFlow.tsx	Uses centralized `env` for app URL and avoids variable shadowing.
apps/frontend/src/env.ts	New centralized runtime/build-time env resolver using `window.__ENV__` with Vite fallbacks.
apps/frontend/src/app/AppHelmet.tsx	Uses centralized `env` for GA tracking ID.
apps/frontend/src/app/App.tsx	Updates Datadog Logs env selection to prefer runtime `window.__ENV__`.
apps/frontend/index.html	Adds `<!-- __ENV_INJECTION__ -->` placeholder for backend injection.
apps/frontend/datadog-chunk.ts	Moves Datadog RUM env/sample-rate/appUrl to runtime `window.__ENV__` while keeping appId/token/version build-time.
apps/backend/src/app/modules/frontend/frontend.service.ts	Generates runtime env script + CSP hash for inline injection.
apps/backend/src/app/modules/frontend/frontend.controller.ts	Injects the runtime env script into `index.html` before serving.
apps/backend/src/app/loaders/express/constants.ts	Adds CSP allowlist entry for the injected env inline script hash.
Dockerfile.production	Builds from pre-built base images and passes required Vite build-time vars via build args.
Dockerfile.base	New build-base/runtime-base images for caching dependencies and standardizing runtime deps/user.
.github/workflows/deploy-ecs.yml	Ensures base images, optionally reuses release images, builds/pushes to ECR, uploads sourcemaps post-build.
.github/workflows/build-release-image.yml	New workflow to build/push a versioned “release-*” image to GHCR on tag.
.github/workflows/build-base-images.yml	New reusable workflow to build/push build-base and runtime-base images keyed by dependency hash.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

kevin9foong · 2026-04-20T05:52:16Z

There are a couple of copilot review comments that seem to make sense

shall we verify them before merging?

eliotlim · 2026-04-20T06:41:55Z

yup will do! working on it.

# Conflicts: # Dockerfile.production

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

eliotlim · 2026-04-22T05:53:20Z

Tested all TCs on staging!

* feat(ci): improve container build process v2 (#9317) * feat(ci): extract base images # Conflicts: # Dockerfile.production * feat(frontend,backend,ci): streamline frontend and backend build * fix(frontend,backend): env script csp header hash computation * fix(ci): cache built image locally for asset upload step * fix(ci): use datadog-ci binaries instead of npx * fix(ci): pin datadog-ci version to v5.11.0 * feat(ci): update runtime-base image packages * fix(ci): use apk no-cache for upgrades * fix(ci): pin action versions * fix(ci): remove extra Dockerfile build commands * chore: apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix(frontend): address code review comments 2 * fix(frontend): env-free reconstruction of payment download url --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix(frontend): use formsgSdkMode in decryption worker (#9329) * chore: bump version to 7.12.0 --------- Co-authored-by: Kevin Foong <55353265+kevin9foong@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

eliotlim requested a review from a team as a code owner April 16, 2026 12:48

Copilot AI review requested due to automatic review settings April 16, 2026 12:48

Copilot started reviewing on behalf of eliotlim April 16, 2026 12:48 View session

eliotlim self-assigned this Apr 16, 2026

Copilot AI reviewed Apr 16, 2026

View reviewed changes

eliotlim temporarily deployed to stg-alt2 April 17, 2026 04:08 — with GitHub Actions Inactive

eliotlim temporarily deployed to stg-alt2 April 17, 2026 04:12 — with GitHub Actions Inactive

kevin9foong approved these changes Apr 20, 2026

View reviewed changes

eliotlim force-pushed the feat/ci/improve-container-build-process-v2 branch from 9d04344 to 194e69c Compare April 21, 2026 06:19

eliotlim temporarily deployed to stg-alt2 April 21, 2026 06:19 — with GitHub Actions Inactive

eliotlim temporarily deployed to stg-alt2 April 21, 2026 06:22 — with GitHub Actions Inactive

eliotlim and others added 13 commits April 22, 2026 10:26

feat(ci): extract base images

a93e63d

# Conflicts: # Dockerfile.production

feat(frontend,backend,ci): streamline frontend and backend build

f788565

fix(frontend,backend): env script csp header hash computation

b08ecfb

fix(ci): cache built image locally for asset upload step

b0a46d3

fix(ci): use datadog-ci binaries instead of npx

26f26e3

fix(ci): pin datadog-ci version to v5.11.0

eed6d93

feat(ci): update runtime-base image packages

0e6fe8c

fix(ci): use apk no-cache for upgrades

079d585

fix(ci): pin action versions

3c680c3

fix(ci): remove extra Dockerfile build commands

65e3a2f

chore: apply suggestions from code review

de18aaf

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

fix(frontend): address code review comments 2

f52f449

fix(frontend): env-free reconstruction of payment download url

8ee1c1e

eliotlim force-pushed the feat/ci/improve-container-build-process-v2 branch from 194e69c to 8ee1c1e Compare April 22, 2026 04:32

eliotlim temporarily deployed to stg-alt2 April 22, 2026 04:32 — with GitHub Actions Inactive

eliotlim merged commit 65fd6b7 into develop Apr 22, 2026
38 checks passed

eliotlim deleted the feat/ci/improve-container-build-process-v2 branch April 22, 2026 05:56

This was referenced Apr 22, 2026

build: release v7.12.0 #9327

Merged

fix(frontend): use formsgSdkMode in decryption worker #9329

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(ci): improve container build process v2#9317

feat(ci): improve container build process v2#9317
eliotlim merged 13 commits intodevelopfrom
feat/ci/improve-container-build-process-v2

eliotlim commented Apr 16, 2026 •

edited

Loading

Uh oh!

linear Bot commented Apr 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kevin9foong commented Apr 20, 2026

Uh oh!

eliotlim commented Apr 20, 2026

Uh oh!

eliotlim commented Apr 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

eliotlim commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Tests

Deploy Notes

Uh oh!

linear Bot commented Apr 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kevin9foong commented Apr 20, 2026

Uh oh!

eliotlim commented Apr 20, 2026

Uh oh!

eliotlim commented Apr 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

eliotlim commented Apr 16, 2026 •

edited

Loading