Distillation

["lore_tm_v1_PC4-_7pKwuYEe8de7J5UKzBTyzrqrqHYekpRkXARH5Y","lore_tm_v1_5dHs0oN7y-DZyaKK5_gkYx13IQFJUcT8c401c0Qb-_E"]

🔴 (20:39) .github/workflows/ci.yml job test-unit needs changes, runs only when needs.changes.outputs.code == 'true', uses Node ${{ env.NODE_VERSION_24 }}, caches root/package/app node_modules under key node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'packages/cli/patches/**') }}, runs pnpm run generate:schema and pnpm run test:unit, then uploads ./coverage/lcov.info through getsentry/codecov-action@main; informational-patch is true on pushes.

🔴 (20:39) .github/workflows/ci.yml job build-binary needs changes, lint, and test-unit, uses the computed build-target matrix with fail-fast: false, and selects the production environment only on main or release/ refs so environment-scoped SENTRY_AUTH_TOKEN permits sourcemap upload; without it, binary stack traces retain minified names such as xE.

🔴 (20:39) build-binary uses Node ${{ env.NODE_VERSION_22 }} and caches dependencies under OS-specific key node-modules-${{ matrix.os }}-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'packages/cli/patches/**') }}.

🔴 (20:39) build-binary installs rcodesign from apple-platform-rs version 0.29.0 with platform-specific archives and SHA-256 checks: apple-codesign-0.29.0-aarch64-apple-darwin.tar.gz → d1a532150adaf90048260d76359261aa716abafc45c53c5dc18845029184334a; apple-codesign-0.29.0-x86_64-apple-darwin.tar.gz → 14ef11bedd51a8d95eafd767939ae96d5900e5a61511bef75bb21db6e7c74140; Linux fallback apple-codesign-0.29.0-x86_64-unknown-linux-musl.tar.gz → dbe85cedd8ee4217b64e9a0e4c2aef92ab8bcaaa41f20bde99781ff02e600002.

🔴 (20:39) build-binary decodes APPLE_CERT_DATA to /tmp/certs.p12 and exports APPLE_CERT_PATH; it decodes APPLE_API_KEY to /tmp/apple_key.json, extracts /tmp/apple_key.pem, and exports APPLE_API_KEY_ISSUER_ID, APPLE_API_KEY_ID, APPLE_API_KEY_P8_PATH, and APPLE_API_KEY_PATH. Secret values were not shown.

🔴 (20:39) When needs.changes.outputs.nightly-version is nonempty, build-binary rewrites .version in packages/cli/package.json with jq before invoking pnpm run build -- --target ${{ matrix.target }}.

🔴 (20:39) The binary Build step sets step-level SENTRY_AUTH_TOKEN because workflow-level environment evaluation occurs before job environment: application; sets RELEASE_BUILD=1 outside pull requests to create .gz archives; and sets FOSSILIZE_SIGN=y only for pushes to main or release/, otherwise n. Apple signing also uses APPLE_CERT_PASSWORD and APPLE_TEAM_ID.

🔴 (20:39) build-binary performs a basic --help smoke test on testable targets, using packages/cli/dist-bin/sentry-windows-x64.exe for Windows and packages/cli/dist-bin/sentry-${{ matrix.target }} otherwise.

🔴 (20:39) The deep binary smoke test clears SENTRY_AUTH_TOKEN and SENTRY_TOKEN, runs auth status, and requires exit code 10 (AUTH_NOT_AUTHENTICATED) plus case-insensitive output containing not authenticated; this exercises SQLite initialization, schema migrations, telemetry lazy import, and the CJS require chain.

🔴 (20:39) Darwin signature verification runs only for darwin* targets on pushes to main or release/ and executes rcodesign verify; the workflow notes that ordinary smoke tests cannot detect invalid signatures because AMFI SIGKILL applies to quarantined downloaded binaries rather than freshly built binaries on the build machine.

🔴 (20:39) build-binary uploads uncompressed packages/cli/dist-bin/sentry-* artifacts via actions/upload-artifact@v7, excluding *.gz; non-PR builds separately upload packages/cli/dist-bin/*.gz as sentry-${{ matrix.target }}-gz.

🔴 (20:39) .github/workflows/ci.yml job generate-patches needs changes and build-binary, runs only outside pull requests on main nightlies and release/ stable branches, and has continue-on-error: true.

🔴 (20:39) generate-patches installs ORAS CLI 1.3.1 on main from oras_1.3.1_linux_amd64.tar.gz, verifying SHA-256 d52c4af76ce6a3ceb8579e51fb751a43ac051cca67f965f973a0b0e897a2bb86; it also installs zig-bsdiff 0.1.19 from zig-bsdiff-linux-x64.tar.gz, verifying SHA-256 9f1ac75a133ee09883ad2096a86d57791513de5fc6f262dfadee8dcee94a71b9.

🔴 (20:39) generate-patches downloads current artifacts matching sentry-*-* into new-binaries with merge-multiple: true, intentionally matching platform binary and -gz artifacts but not sentry-patches.

🔴 (20:39) For main, generate-patches logs into ghcr.io with ORAS, lists versioned tags matching ^nightly-[0-9] from ghcr.io/getsentry/cli, sorts them with sort -V, selects the latest tag before nightly-${VERSION}, sets HAS_PREV=true, fetches its manifest, selects .gz layers by OCI title annotation, downloads blobs by digest into old-binaries, and gunzips them.

🔴 (20:39) For release/**, generate-patches queries the latest non-prerelease, nondraft release among per_page=5, sets HAS_PREV=true, downloads matching .gz assets for current binaries from that tag with gh release download, warns and skips missing assets, and decompresses available files.

🔴 (20:39) Patch generation iterates uncompressed new-binaries/sentry-*, skips .gz files and targets lacking an old counterpart, and runs bsdiff "$old_binary" "$new_binary" "patches/${name}.patch" --use-zstd; it reports each patch’s exact byte size and percentage of the new uncompressed binary and tracks the exact generated count.

🔴 (20:39) Patch-size validation compares each patch against its new gzipped binary and rejects ratios above MAX_RATIO: 50; client-side SIZE_THRESHOLD_RATIO in src/lib/delta-upgrade.ts rejects chains above 60%, so CI uses 50% to preserve margin for single-step patches.

🔴 (20:39) Oversized patches are deleted and excluded from upload; CI opens or comments on an existing bug issue titled Delta patch generation produced oversized patches, including patch ratios, byte sizes, branch, commit, and workflow-run URL. The workflow says oversized output usually indicates an empty or incorrect old-binary download.

🔴 (20:39) Valid delta patches are uploaded via actions/upload-artifact@v7 as artifact sentry-patches from patches/*.patch; any generate-patches failure opens or comments on a deduplicated issue titled Delta patch generation failed with branch, commit, and run details.

🔴 (20:39) .github/workflows/ci.yml job publish-nightly needs changes, build-binary, and generate-patches, and runs only for pushes to main; it downloads sentry-*-gz into artifacts, matching uncompressed sentry-*-* into binaries, and optional sentry-patches into patches.

🔴 (20:39) publish-nightly installs ORAS CLI 1.3.1 with SHA-256 d52c4af76ce6a3ceb8579e51fb751a43ac051cca67f965f973a0b0e897a2bb86, logs into GHCR, and pushes *.gz from inside artifacts to ghcr.io/getsentry/cli:nightly with artifact type application/vnd.sentry.cli.nightly, source annotation https://github.com/getsentry/cli, and version=${VERSION}; using the artifacts working directory preserves bare layer titles such as sentry-linux-x64.gz for findLayerByFilename().

🔴 (20:39) After pushing :nightly, publish-nightly creates immutable zero-copy tag nightly-${VERSION} with oras tag, enabling patch-chain resolution against specific nightly versions.

🔴 (20:39) Nightly delta-patch publication is optional and nonfatal (continue-on-error: true): for each patch it computes the corresponding uncompressed binary SHA-256 and adds annotation sha256-${basename_patch}=${sha256}, finds the previous versioned nightly tag, then pushes ghcr.io/getsentry/cli:patch-${VERSION} with artifact type application/vnd.sentry.cli.patch, annotation from-version=${PREV_VERSION}, SHA-256 annotations, and patch files.

🔴 (20:39) .github/workflows/ci.yml job test-e2e needs build-binary and changes, uses Node ${{ env.NODE_VERSION_24 }}, caches dependencies, downloads artifact sentry-linux-x64 to dist-bin, makes it executable, runs pnpm run generate:schema, and executes pnpm run test:e2e with SENTRY_CLI_BINARY=${{ github.workspace }}/dist-bin/sentry-linux-x64.

🔴 (20:39) E2E skill evaluation receives OPENROUTER_API_KEY and fallback ANTHROPIC_API_KEY only when needs.changes.outputs.skill == 'true'; the skill-eval test auto-skips when no provider key is present, preventing non-skill PRs from being affected. Secret values were not shown.

🔴 (20:39) The next CI job begins as build-npm, named Build npm Package (smoke Node ${{ matrix.node }}), needs lint and test-unit, and runs on ubuntu-latest.