include db for gitea build

build.sh

@@ -3,6 +3,7 @@ set -euo pipefail
 
 RELEASE="${RELEASE:-$(git rev-parse --short HEAD)}"
 PUBLIC_SOURCEMAPS="${PUBLIC_SOURCEMAPS:-false}"
+UPLOAD_SOURCEMAPS="${UPLOAD_SOURCEMAPS:-true}"
 
 echo "Building Needle 3 sidecar image..."
 docker build -t matst80/needle-sidecar:latest cmd/needle-sidecar
@@ -15,21 +16,12 @@ docker build \
   -t matst80/otel-debug:latest .
 
 docker push matst80/otel-debug:latest
-# Only the app manifests. Not `-f k8s/`: clickhouse.yaml carries a CHANGE_ME
-# password Secret that would overwrite the live one, and auth-dev.yaml is a
-# partial AuthServer that must be applied by hand with
-# `kubectl apply --server-side --field-manager=otel-dev-auth -f k8s/auth-dev.yaml`.
-kubectl apply -f k8s/deployment.yaml -f k8s/service.yaml -f k8s/ingress.yaml
-kubectl rollout restart deployment otel-debug-receiver -n monitoring
-kubectl rollout status deployment/otel-debug-receiver -n monitoring
 
-# Docker builds intentionally omit public source maps. If the public receiver
-# URL is present, build the same release locally and upload maps to the running
-# receiver. Maps persist on the otel-sourcemaps PVC and are reloaded on start;
-# verify with: node scripts/dev-auth.mjs get /api/sourcemaps
-if [[ -n "${OTEL_URL:-}" ]]; then
-  # Take the maps from the exact UI build that went into the image (same
-  # bundle hashes and positions as production), not from a second local build.
+# Docker builds intentionally omit public source maps. Upload maps from the
+# exact UI build that went into the image before rolling it out; otherwise RUM
+# events can arrive with a release that the resolver cannot map.
+if [[ "${UPLOAD_SOURCEMAPS}" == "true" ]]; then
+  : "${OTEL_URL:?set OTEL_URL (for example https://otel.k6n.net), or set UPLOAD_SOURCEMAPS=false}"
   maps_dir="$(mktemp -d)"
   trap 'rm -rf "$maps_dir"' EXIT
   docker build --target ui-builder \
@@ -42,10 +34,18 @@ if [[ -n "${OTEL_URL:-}" ]]; then
   while IFS= read -r -d '' map; do
     found=1
     bundle="${map%.map}"
-    RELEASE="$RELEASE" OTEL_URL="$OTEL_URL" \
+    RELEASE="${RELEASE}" OTEL_URL="${OTEL_URL}" \
       ./scripts/upload-sourcemap.sh "$bundle"
   done < <(find "$maps_dir" -type f -name '*.js.map' -print0)
   [[ "$found" == 1 ]] || { echo "no source maps found in UI build" >&2; exit 1; }
 fi
 
+# Only the app manifests. Not `-f k8s/`: clickhouse.yaml carries a CHANGE_ME
+# password Secret that would overwrite the live one, and auth-dev.yaml is a
+# partial AuthServer that must be applied by hand with
+# `kubectl apply --server-side --field-manager=otel-dev-auth -f k8s/auth-dev.yaml`.
+kubectl apply -f k8s/deployment.yaml -f k8s/service.yaml -f k8s/ingress.yaml
+kubectl rollout restart deployment otel-debug-receiver -n monitoring
+kubectl rollout status deployment/otel-debug-receiver -n monitoring
+
 kubectl logs -f deployment/otel-debug-receiver -n monitoring