nonroot #6

	name: Build and publish sc-www image for prod
	on:
	push:
	branches:
	- main

	jobs:
	build-and-push-image:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- name: Inject legal docs
	env:
	LEGAL_TOKEN: ${{ secrets.LEGAL_TOKEN }}
	LEGAL_URL: ${{ secrets.LEGAL_URL }}
	run: 'curl -s -L -H "Authorization: token ${LEGAL_TOKEN}" ${LEGAL_URL} \| tar xz --strip-components=1'
	- name: Configure AWS credentials
	uses: aws-actions/configure-aws-credentials@v4
	with:
	aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
	aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
	aws-region: eu-central-1
	- name: Login to Amazon ECR
	id: login-ecr
	uses: aws-actions/amazon-ecr-login@v2
	- name: Build and push Docker image
	uses: docker/build-push-action@v5
	with:
	file: Dockerfile
	context: .
	push: true
	tags: ${{ steps.login-ecr.outputs.registry }}/${{ secrets.ECR_REPO_NAME }}:latest
	build-args: \|
	POSTHOG_KEY=${{ secrets.POSTHOG_KEY }}
	POSTHOG_HOST=${{ secrets.POSTHOG_HOST }}
	SENTRY_DSN=${{ secrets.SENTRY_DSN }}
	SENTRY_ENVIRONMENT=production
	SENTRY_ORG=${{ secrets.SENTRY_ORG }}
	SENTRY_PROJECT=${{ secrets.SENTRY_PROJECT }}
	SENTRY_URL=${{ secrets.SENTRY_URL }}
	SENTRY_RELEASE=${{ env.GITHUB_SHA }}

	- name: Sentry release
	env:
	DOCKER_IMAGE: ${{ steps.login-ecr.outputs.registry }}/${{ secrets.ECR_REPO_NAME }}:latest
	SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
	run: docker run --rm -v "$GITHUB_WORKSPACE":/repo -w /repo -e SENTRY_AUTH_TOKEN --user 1000:1000 ${DOCKER_IMAGE} npm run sentry:release

Provide feedback