fix(ci): Install both tarballs in validate job to satisfy cross-dep#6052
Merged
antonis merged 1 commit intorelease/8.9.1from Apr 27, 2026
Merged
fix(ci): Install both tarballs in validate job to satisfy cross-dep#6052antonis merged 1 commit intorelease/8.9.1from
antonis merged 1 commit intorelease/8.9.1from
Conversation
The validate job ran `npm install <core tarball>` only. The published core package.json declares `@sentry/expo-upload-sourcemaps` at the same version as core (workspace:* is resolved at pack time). On a release branch the bumped version is not on the npm registry yet, so npm tried to fetch from registry and failed with ETARGET (e.g. when releasing 8.9.2: "No matching version found for @sentry/expo-upload-sourcemaps@8.9.2"). Install both tarballs together so the sister dep is satisfied from local. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
Contributor
Author
|
@sentry review |
Contributor
Author
|
@cursor review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit ef34373. Configure here.
alwx
approved these changes
Apr 27, 2026
11 tasks
antonis
added a commit
that referenced
this pull request
Apr 27, 2026
* fix(core): Restore tarball script permissions and missing EAS build hook (#6049) * fix(core): Restore tarball script permissions and missing EAS build hook The npm pack -> yarn pack switch in #6037 introduced two regressions: 1. yarn pack stores files with mode 0644. scripts/sentry-xcode.sh, invoked directly by Xcode's build phase, fails with "Permission denied" (#6047). Re-pack the tarball after yarn pack to restore 0755 on shell scripts and bin entrypoints. 2. yarn pack does not auto-include files referenced from the bin field. scripts/eas-build-hook.js was never in the .npmignore allowlist, so the three sentry-eas-build-* bin commands silently stopped working in the tarball (#6048 follow-up). Add it to the allowlist. Add a job_validate_tarball CI job that installs the produced tarball into a fresh project and asserts script modes, bin links, post-install executability, and that workspace:* specs were resolved. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs: Update changelog Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(ci): Install both tarballs in validate job to satisfy cross-dep (#6052) The validate job ran `npm install <core tarball>` only. The published core package.json declares `@sentry/expo-upload-sourcemaps` at the same version as core (workspace:* is resolved at pack time). On a release branch the bumped version is not on the npm registry yet, so npm tried to fetch from registry and failed with ETARGET (e.g. when releasing 8.9.2: "No matching version found for @sentry/expo-upload-sourcemaps@8.9.2"). Install both tarballs together so the sister dep is satisfied from local. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * release: 8.9.2 --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: antonis <304044+antonis@users.noreply.github.com> Co-authored-by: sentry-release-bot[bot] <180476844+sentry-release-bot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📢 Type of change
📜 Description
Follow-up to #6049. The
job_validate_tarballinstall step rannpm install <core tarball>only. Core's publishedpackage.jsondeclares@sentry/expo-upload-sourcemapsat a concrete version (yarn pack resolvesworkspace:*at pack time). On a release branch the bumped version isn't on the npm registry yet, so npm falls back to fetching it and fails withETARGET.Install both tarballs together so the sister dep is satisfied from local.
Reproduced and fixed:
release/8.9.2: https://github.com/getsentry/sentry-react-native/actions/runs/24987090493/job/73163953459 — "No matching version found for @sentry/expo-upload-sourcemaps@8.9.2"8.9.99version (not on registry):npm install --no-save <expo>.tgz <core>.tgzresolves the cross-dep from the local sister tarball.💡 Motivation and Context
Unblocks the 8.9.2 release. The validate job's mode/file checks already pass on the failing run — only the install step was broken, and only by my own validation design (not the underlying tarball fix from #6049).
💚 How did you test it?
8.9.99(not on npm), built tarballs with the newbuild-tarball.sh, and rannpm install --no-save <expo>.tgz <core>.tgzin a fresh dir. Install completes;node_modules/@sentry/expo-upload-sourcemaps/package.jsonshows version8.9.99(resolved from local tarball, not registry).sentry-xcode.shis executable post-install.📝 Checklist
sendDefaultPIIis enabled🔮 Next steps
After merge: delete the failed
release/8.9.2branch (git push origin --delete release/8.9.2) and re-dispatch the Release workflow. The newrelease/8.9.2will be created off the now-fixedrelease/8.9.1and the validate job will pass.🤖 Generated with Claude Code