Distillation

🔴 (20:37) User provided a repository search result with exactly 26 matches spanning installer references, db/install-info.js, upgrade/uninstall/setup code, docs-preview workflow paths, and apps/cli-docs/astro.config.mjs; a subsequent repository search returned No files found. 🔴 (20:37) apps/cli-docs/package.json defines private package sentry-cli-docs version 1.0.0, with scripts dev: astro dev, build: astro build, and preview: astro preview; dependencies are @astrojs/starlight ^0.39.2, @sentry/astro ^10.38.0, @sentry/starlight-theme ^0.8.0, astro ^6.4.6, sharp ^0.33.5, and shiki ^3.21.0. 🔴 (20:37) User enumerated the 8 entries in apps/cli-docs: astro.config.mjs, node_modules/, package.json, public/, sentry.client.config.js, sentry.server.config.js, src/, and tsconfig.json. 🔴 (20:37) User enumerated the 10 entries in apps/cli-docs/public: .well-known/, CNAME, favicon.png, favicon.svg, glyph.svg, install, og-image-twitter.png, og-image.png, wordmark-light.svg, and wordmark.svg.

🔴 (20:38) apps/cli-docs/public/install is the CLI Bash installer with set -euo pipefail; telemetry is fire-and-forget through Sentry’s envelope API, uses the CLI’s public write-only DSN, collects no PII, and is disabled by SENTRY_CLI_NO_TELEMETRY=1. 🔴 (20:38) [enforced-telemetry-isolation] User asserted installer error telemetry “never blocks installation or propagates failures”; report_error() runs in a background subshell, uses set +e, limits curl to 2 seconds with --max-time 2, and suppresses output and failure status. 🔴 (20:38) [enforced-telemetry-isolation] User asserted telemetry must “never fail the script”; die() prints the error, invokes report_error, runs wait 2>/dev/null || true, then exits 1. 🔴 (20:38) The installer’s gen_uuid() fallback order is: 1. /proc/sys/kernel/random/uuid; 2. uuidgen lowercased; 3. a 32-character hexadecimal UUID-like value generated with awk. 🔴 (20:38) Installer telemetry sends tags os, arch, libc, channel, step, and install.version, plus Bash runtime context; a Sentry ingestion key was supplied but is omitted as credential-like material. The endpoint is https://o1.ingest.us.sentry.io, project ID is 4510776311808000, logger is install, and server name is install-script. 🔴 (20:38) The installer traps unexpected set -e/pipefail failures as die "Unexpected failure at line $LINENO" "trap". 🔴 (20:38) Installer options are -h|--help, -v|--version <version>, --no-modify-path, --no-completions, and --no-agent-skills; environment variables are SENTRY_INSTALL_DIR, SENTRY_VERSION, and SENTRY_INIT=1. 🔴 (20:38) Installer platform support maps Darwin→darwin, Linux→linux, MINGW/MSYS/CYGWIN→windows, x86_64→x64, and aarch64|arm64→arm64; unsupported OS/architecture exits through die, and Windows supports only windows-x64. 🔴 (20:38) Linux musl detection checks /lib/ld-musl-${musl_arch}.so.1 first and then searches ldd --version for musl; musl assets receive suffix -musl. 🔴 (20:38) On musl, if libstdc++ is missing and apk exists, the installer runs apk add --no-cache libstdc++ libgcc when root; non-root users are told to run apk add libstdc++ libgcc and installation terminates. 🔴 (20:38) The installer writes to ${TMPDIR:-${TMP:-${TEMP:-/tmp}}}/sentry-install-$$${suffix}, removes the temporary binary on failure via an EXIT trap, makes it executable, and removes the trap before delegating successful cleanup to sentry cli setup. 🔴 (20:38) Nightly installation fetches an anonymous token scoped to repository:getsentry/cli:pull, requests OCI manifest https://ghcr.io/v2/getsentry/cli/manifests/nightly, extracts the version annotation and platform layer digest with awk, obtains the GHCR blob redirect URL without -L, then downloads from the Azure redirect without forwarding the authorization header and pipes it through gunzip. 🔴 (20:38) Nightly asset naming is sentry-${os}-${arch}${libc_suffix}${suffix}.gz; explicit failure steps are ghcr-token, ghcr-manifest, ghcr-version, ghcr-digest, and ghcr-redirect. 🔴 (20:38) Stable installation resolves an unspecified version through https://api.github.com/repos/getsentry/cli/releases/latest, strips a leading v, and downloads https://github.com/getsentry/cli/releases/download/${version}/sentry-${os}-${arch}${libc_suffix}${suffix}. 🔴 (20:38) Stable installation first attempts the gzip asset, described as approximately 60% smaller (~37 MB versus ~99 MB), and falls back to the raw binary if the .gz asset is unavailable. 🔴 (20:38) The installer delegates placement, PATH changes, completions, agent skills, and welcome output to "$tmp_binary" cli setup --install --method curl --channel <stable|nightly>, forwarding --no-modify-path, --no-completions, and --no-agent-skills. 🔴 (20:38) With SENTRY_INIT=1, the installer searches in order: 1. ${SENTRY_INSTALL_DIR:-}; 2. $HOME/.local/bin; 3. $HOME/bin; 4. $HOME/.sentry/bin; it requires /dev/tty and executes sentry init </dev/tty.

🔴 (20:38) .craft.yml requires Craft 2.21.1; uses packages/cli/script/bump-version.ts --pre and --post; collects Build artifacts matching /^sentry-.*$/, npm-package, and gh-pages; and publishes to npm, github, gh-pages, registry, and Homebrew. 🔴 (20:38) .craft.yml registry app app:sentry is named Sentry CLI, points to https://www.npmjs.com/package/sentry and https://cli.sentry.dev, includes /^sentry-.*\.gz$/, and generates SHA-256 checksums in hexadecimal format. 🔴 (20:38) .craft.yml publishes Homebrew formula sentry to tap getsentry/tools, path Formula, accepting /^sentry-(darwin|linux)-(arm64|x64)\.gz$/; the formula uses license FSL-1.1-MIT, installs the first sentry-* file as sentry, runs sentry cli setup --method brew --no-modify-path in post_install, and tests that sentry --version matches the formula version.

🔴 (20:38) .github/workflows/release.yml accepts workflow-dispatch inputs version, force, and merge_target; grants contents: write and pull-requests: write; creates a GitHub App token with SENTRY_RELEASE_BOT_CLIENT_ID and SENTRY_RELEASE_BOT_PRIVATE_KEY; checks out full history using that token; and invokes getsentry/craft@v2. 🔴 (20:38) .github/workflows/release.yml pins NODE_VERSION_22: "22.23.1" because floating Node 22 can reuse cached 22.23.0, which has the ERR_STREAM_PREMATURE_CLOSE keep-alive fetch-reuse regression tracked as nodejs/node#64004; the regression is fixed in 22.23.1.

🔴 (20:38) The checked-in .github/workflows/docs-preview.yml currently uses rossjrw/pr-preview-action@v1 with a gh-pages preview branch, despite the previously asserted requirement that CLI docs always use Vercel previews and that rossjrw/pr-preview-action never be restored. 🔴 (20:38) .github/workflows/docs-preview.yml runs on pushes to main affecting docs-related paths and on pull-request actions opened, reopened, synchronize, and closed; it intentionally has no PR-level paths filter so every closed event reaches cleanup. 🔴 (20:38) [enforced-preview-cleanup] User asserted that without the closed event, previews “never clean up and gh-pages bloats until GitHub Pages exceeds its build limits and starts failing.” 🔴 (20:38) Docs-preview gates define build=true for pushes or changed-docs PRs that are not closed, and deploy=true for builds or closed-event cleanup only when the PR is not from a fork. 🔴 (20:38) [enforced-fork-safety] User asserted preview publishing/removal must happen “never for fork PRs which lack write access”; fork PRs still build to surface compilation errors. 🔴 (20:38) Docs-preview uses dorny/paths-filter@v4, exact NODE_VERSION_24: "24.18.0", pnpm install --frozen-lockfile, pnpm run generate:schema && pnpm run generate:docs, and builds from apps/cli-docs with DOCS_BASE_PATH set to /_preview/pr-main for pushes or /_preview/pr-${PR_NUMBER} for PRs. 🔴 (20:38) Docs-preview sets PUBLIC_SENTRY_ENVIRONMENT=staging, SENTRY_RELEASE and PUBLIC_SENTRY_RELEASE from packages/cli/package.json, conditionally injects/uploads sourcemaps to Sentry org sentry, project cli-website, then deletes all deployed *.map files. 🔴 (20:38) Docs-preview ensures .nojekyll exists at the gh-pages root, creating an orphan gh-pages branch if absent; deployment uses source apps/cli-docs/dist/, umbrella directory _preview, base URL cli.sentry.dev, action deploy for pushes or auto for PRs, and comments only for non-push events.

🔴 (20:38) Filesystem evidence showed packages/cli/install is a regular executable file (mode=755, size 12571, inode 9979365) and apps/cli-docs/public/install is a symbolic link (mode=777, size 29, inode 9979269) targeting ../../../packages/cli/install; cmp_exit=0 confirmed identical resolved content. 🔴 (20:38) Git index evidence recorded apps/cli-docs/public/install as symlink mode 120000 with object c6850ca5ea9254ff1b25a1850d31de63cec527f6, and packages/cli/install as executable mode 100755 with object ca2b6b8d77f1756239576a56297159a8076b2e31.

🔴 (20:39) .github/workflows/ci.yml pins NODE_VERSION_20: "20.20.2", NODE_VERSION_22: "22.23.1", and NODE_VERSION_24: "24.18.0"; Node 20 exercises the bundled node-sqlite3-wasm fallback used below Node 22.15, while exact Node 22/24 patch pins avoid the ERR_STREAM_PREMATURE_CLOSE regression in 22.23.0/24.17.0. 🔴 (20:39) .github/workflows/ci.yml computes PR builds as only linux-x64 on ubuntu-latest; non-PR builds use 5 targets in order: 1. darwin-arm64 on macos-latest, testable; 2. darwin-x64 on Ubuntu, not testable; 3. linux-x64 on Ubuntu, testable; 4. linux-arm64 on Ubuntu, not testable; 5. windows-x64 on Ubuntu, not testable. 🔴 (20:39) .github/workflows/ci.yml computes main-branch push nightly versions from COMMIT_TIMESTAMP, replacing a trailing -dev.<number> in packages/cli/package.json with -dev.${UNIX_TIMESTAMP}. 🔴 (20:39) Codemod CI runs npx codemod@1.12.7 jssg test -l typescript ./scripts/codemod.ts from codemods/sentry-v3-to-v4. 🔴 (20:39) Generated-file CI uses a GitHub App token for same-repository PRs so it can commit chore: regenerate docs; fork PRs fall back to github.token, leave checkout ref empty, and fail with instructions to run pnpm run generate:docs locally when generated files are stale. 🔴 (20:39) [enforced-fork-checkout] User asserted the fork-PR pull-request merge SHA is “always fetchable from the base repo with github.token.” 🔴 (20:39) Generated-file CI checks skill files under packages/cli/plugins/sentry-cli/skills/sentry-cli/ and docs sections in packages/cli/README.md, packages/cli/DEVELOPMENT.md, apps/cli-docs/src/content/docs/contributing.md, apps/cli-docs/src/content/docs/self-hosted.md, and apps/cli-docs/src/content/docs/getting-started.mdx.