[sentry-junior]

Moves Snuba CI to ubuntu-26.04-arm, including the test matrix, the snuba CI image build, the ClickHouse version matrix, and the 16 sentry shards. getsentry/sentry made the same move for backend tests. Every event runs these jobs on Arm, including pushes to master, so the two paths match.

Now on Arm

• All of ci.yml: snuba CI image, docker-deps, Tests and code coverage, clickhouse versions, sentry, Linting - Rust, and the jobs from the first commit (detect what files changed, bump_version test, pre-commit, config validation, admin tests, image smoke test, validate-devservices-config)
• admin-sourcemaps, ddl-changes, dependency-review, docs-pr, docs, validate-pipelines, validate-sentry-options, and the assemble / assemble-debug manifest jobs in image.yml

What had to change

• Kafka and ZooKeeper: the old Kafka and ZooKeeper images were amd64-only. docker-compose.gcb.yml now runs a newer multi-arch Kafka in KRaft mode, and ClickHouse Keeper replaces ZooKeeper (config/clickhouse/keeper.xml). Keeper runs from the same multi-arch ClickHouse image and serves zookeeper:2181, so the ClickHouse configs don't change. With clickhouse-versions, Keeper uses each matrix image.
• snuba-ci image: built for linux/arm64 with docker/build-push-action. It has its own registry cache, snuba-ci:buildcache-arm64, which only master writes. It also reads the snuba-arm64 gha cache that image.yml writes. On this PR the image built in about 2.7m with no warm registry cache.
• Cache keys: the docker-deps tarball and the Rust test target cache now include runner.arch. docker save keeps only the pulled platform, and the rustc commit hash is the same on both architectures.
• Rust test_python segfault: in the arm64 image, /etc/ld.so.conf.d/aarch64-linux-gnu.conf comes before libc.conf. So the test binary loaded Debian's /lib/aarch64-linux-gnu/libpython3.13.so instead of the image's 3.13.17 in /usr/local/lib, and importing ctypes segfaulted. On amd64, x86_64-linux-gnu.conf sorts after libc.conf, which is why x64 never hit it. scripts/rust-envvars now puts the interpreter's LIBDIR on LD_LIBRARY_PATH. gdb confirmed which libpython was loaded.

Left on x64

• enforce-license-compliance: the action installs FOSSA CLI v3.7.8, which has no linux arm64 binary.
• image.yml build-production (the production image stays amd64), build-amd64, and self-hosted-end-to-end. codeql, release, bump-version, labeler, and fast-revert don't run on PRs, so this PR can't check them on Arm.

Timing (one Arm run, so treat it as directional)
The x64 baseline is the median of 8 recent successful PR runs of ci. Wall time is measured from the first job start to the last job end.

• Wall time: 19.9m on Arm vs 19.0m median on x64 (x64 range 13.9 to 22.8m)
• sentry shards: median 7.7m and max 8.0m on Arm, vs median 9.1m and max 10.8m on x64
• Slowest job: test_distributed shard 1 at 17.1m (pytest step 939s), vs 15.4 to 15.9m on x64 (pytest step 886s in the comparison run). This shard sets the wall time on both architectures.
• Linting - Rust took 1.9m with a cold Arm rust-cache. It should drop back to about 0.5m after master saves an Arm cache.

test_distributed shard 1 took 15m on a later run, so that number is noisy. Wall time now depends on the test_distributed shards, not the runner type. Splitting that suite into more shards is the next way to cut it.

via @joshuarli.

--

View Session [Sentry]