From 07de925c2f4531c48e8d89492676adf99ef3cbc9 Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Fri, 9 Oct 2026 21:44:57 +0000
Subject: [PATCH] ci: pull Docker Hub images from getsentry/image-mirror

Docker Hub has been rate limiting and timing out anonymous pulls from GitHub-hosted runners. Use the GHCR copies from getsentry/image-mirror, pinned to the patch tag each floating tag resolved to.

Co-Authored-By: Joshua Li <14209781+joshuarli@users.noreply.github.com>
---
 .github/workflows/openapi-diff.yml | 12 +++++++-----
 .github/workflows/self-hosted.yml  |  6 ++++++
 self-hosted/Dockerfile             |  2 +-
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/openapi-diff.yml b/.github/workflows/openapi-diff.yml
index c7b200dace2a..08f985e903dd 100644
--- a/.github/workflows/openapi-diff.yml
+++ b/.github/workflows/openapi-diff.yml
@@ -63,10 +63,12 @@ jobs:
           mkdir schemas
           sentry rpcschema --loglevel=WARNING > rpc_method_schema.json
 
+      # Runs oasdiff directly from the getsentry/image-mirror copy instead of
+      # oasdiff/oasdiff-action, which builds FROM tufin/oasdiff:main on Docker Hub.
       - name: Output RPC schema comparison
-        uses: oasdiff/oasdiff-action/breaking@a2ff6682b27d175162a74c09ace8771bd3d512f8 # A few commits after v0.0.19 to get fixes
         if: steps.changes.outputs.api_docs == 'true'
-        with:
-          base: sentry-api-schema/rpc_method_schema.json
-          revision: ./rpc_method_schema.json
-          fail-on: WARN
+        run: |
+          docker run --rm -v "$PWD:$PWD" -w "$PWD" \
+            ghcr.io/getsentry/image-mirror-tufin-oasdiff:v1.33.0 \
+            breaking sentry-api-schema/rpc_method_schema.json ./rpc_method_schema.json \
+            --fail-on WARN --format githubactions
diff --git a/.github/workflows/self-hosted.yml b/.github/workflows/self-hosted.yml
index 80d6b28129b1..8cc0e335c4bf 100644
--- a/.github/workflows/self-hosted.yml
+++ b/.github/workflows/self-hosted.yml
@@ -100,6 +100,9 @@ jobs:
       # daily and manual distroless builds use the Docker actions directly.
       - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
         if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+        with:
+          # Mirrored via getsentry/image-mirror to avoid Docker Hub rate limits.
+          driver-opts: image=ghcr.io/getsentry/image-mirror-moby-buildkit:v0.33.1
 
       - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         if: (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && github.ref_name == 'master'
@@ -137,6 +140,9 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+        with:
+          # Mirrored via getsentry/image-mirror to avoid Docker Hub rate limits.
+          driver-opts: image=ghcr.io/getsentry/image-mirror-moby-buildkit:v0.33.1
 
       - name: Create multiplatform manifests
         if: github.event_name == 'push'
diff --git a/self-hosted/Dockerfile b/self-hosted/Dockerfile
index 75425550e699..b29cc928f8fd 100644
--- a/self-hosted/Dockerfile
+++ b/self-hosted/Dockerfile
@@ -13,7 +13,7 @@ ADD --chmod=755 \
 ARG TARGETARCH
 FROM odiff-${TARGETARCH} AS odiff
 
-FROM python:3.13.15-slim-trixie AS application
+FROM ghcr.io/getsentry/image-mirror-library-python:3.13.15-slim-trixie AS application
 
 LABEL maintainer="oss@sentry.io"
 LABEL org.opencontainers.image.title="Sentry"