Repository navigation
feat(sourcemaps): Log the placeholder release name on artifact bundle assembly - #127101
Merged
Merged
Conversation
… assembly The `assemble.artifact_bundle.placeholder_release` log counts uploads whose release looks like a placeholder, but not which placeholder they send. For the `env_var` kind that hides which variable names are leaking into release names, such as `VERCEL_GIT_COMMIT_SHA`. A placeholder is a generic token or an environment variable's name, so log it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WgDm3ijhQZQUHGAFFqQzKQ
github-actions
Bot
added
the
Scope: Backend
loewenheim
approved these changes
Oct 12, 2026
elramen
approved these changes
Oct 12, 2026
3 tasks done
isaacs
pushed a commit
to getsentry/sentry-javascript
that referenced
this pull request
Oct 16, 2026
…ars set to their own name (#25244) Some builds have `VERCEL_GIT_COMMIT_SHA` set to the literal string `VERCEL_GIT_COMMIT_SHA` instead of a SHA. Release auto-detection took that value as the release name, so every build of the app uploaded its source maps into, and reported events against, one release that never changes. This is not theoretical: Sentry has received source map uploads and events whose release is the literal string `VERCEL_GIT_COMMIT_SHA` from a number of organizations deploying on Vercel. Some were large enough to contribute to [INC-2566](https://firetower.getsentry.net/INC-2566). How those builds end up with that value is still being investigated; getsentry/sentry#127101 logs the placeholder name at upload time to help with that. This guard stops the value from becoming the release either way. Release detection in the bundler plugins and the Node and Vercel Edge SDKs now skips a commit env var whose value is its own name, warns, and moves on to the next candidate. Candidates are read in order and only until one is found, so a placeholder is only warned about when it would otherwise have become the release. In the bundler plugins, the Vercel commit association in `setCommits` uses the same check, so a placeholder SHA falls back to automatic commit association instead of being sent as the commit. Claude-Session: https://claude.ai/code/session_01WgDm3ijhQZQUHGAFFqQzKQ Co-authored-by: Claude <noreply@anthropic.com>
2 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
assemble.artifact_bundle.placeholder_releaselog counts uploads whose release looks like a placeholder, but not which placeholder they send. For theenv_varkind that hides which variable names are leaking into release names, such asVERCEL_GIT_COMMIT_SHA. A placeholder is a generic token or an environment variable's name, so log it.Claude-Session: https://claude.ai/code/session_01WgDm3ijhQZQUHGAFFqQzKQ