build.yml

name: 'CI: Build & Test'
on:
  push:
    branches:
      - develop
      - master
      - v10
      - v9
      - v8
      - release/**
  pull_request:
  merge_group:
    branches: [develop]
  workflow_dispatch:
    inputs:
      commit:
        description: If the commit you want to test isn't the head of a branch, provide its SHA here
        required: false
  schedule:
    # Run every day at midnight (without cache)
    - cron: '0 0 * * *'

# Cancel in progress workflows on pull_requests.
# https://docs.github.com/en/actions/using-jobs/using-concurrency#example-using-a-fallback-value
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

env:
  HEAD_COMMIT: ${{ github.event.inputs.commit || github.sha }}

  # build-output artifact paths are computed in job_build (step output from
  # pnpm run ci:print-build-artifact-paths — Nx merged outputs for build:transpile, and build:types).

  # upload-artifact globs drop the path through the first `*` (see upload-artifact
  # README). Tarballs therefore land in the artifact as <pkg>/*.tgz; download
  # build-tarball-output into packages/ so they resolve to packages/<pkg>/*.tgz.
  TARBALL_ARTIFACT_GLOB: packages/*/*.tgz
  TARBALL_ARTIFACT_DOWNLOAD_PATH: ${{ github.workspace }}/packages

  BUILD_LAYER_PATH: ${{ github.workspace }}/packages/aws-serverless/build/aws/dist-serverless

  # Same glob / download split as TARBALL_ARTIFACT_*: upload-artifact strips the path through
  # the first `*`, so bundle trees are stored as <pkg>/build/bundles/...; download into packages/.
  BUNDLE_ARTIFACT_GLOB: packages/*/build/bundles
  BUNDLE_ARTIFACT_DOWNLOAD_PATH: ${{ github.workspace }}/packages

  NX_CACHE_KEY: nx-Linux-${{ github.head_ref || github.ref }}-${{ github.run_id }}

  # https://bsky.app/profile/joyeecheung.bsky.social/post/3lhy6o54fo22h
  # Apparently some of our CI failures are attributable to a corrupt v8 cache, causing v8 failures with: "Check failed: current == end_slot_index.".
  # This option both controls the `v8-compile-cache-lib` and `v8-compile-cache` packages.
  DISABLE_V8_COMPILE_CACHE: '1'

# Jobs that install the monorepo dependencies share one Namespace cache volume through `overrides.cache-tag`, E2E jobs
# share another one (`-e2e`). The optional Cloudflare integration tests replace the installed wrangler with the latest
# one, so they use a third one (`-latest-wrangler`). Jobs that do not use a cache volume have no cache tag. Pull request
# jobs get their own volumes (`-pr`), so they cannot change the node_modules that develop and release builds install
# from.
jobs:
  job_get_metadata:
    uses: ./.github/workflows/ci-metadata.yml
    name: Get CI Metadata
    with:
      head_commit: ${{ github.event.inputs.commit || github.sha }}
    permissions:
      pull-requests: read

  job_build:
    name: Build
    needs: job_get_metadata
    runs-on:
      namespace-profile-sentry-javascript-large;overrides.cache-tag=sentry-javascript${{ github.event_name ==
      'pull_request' && '-pr' || '' }}
    timeout-minutes: 15
    if: |
      needs.job_get_metadata.outputs.changed_any_code == 'true' ||
      needs.job_get_metadata.outputs.is_base_branch == 'true' ||
      needs.job_get_metadata.outputs.is_release == 'true' ||
      (needs.job_get_metadata.outputs.is_gitflow_sync == 'false' && needs.job_get_metadata.outputs.has_gitflow_label == 'false' && needs.job_get_metadata.outputs.changed_any_code == 'true')
    steps:
      - name: Check out base commit (${{ github.event.pull_request.base.sha }})
        uses: actions/checkout@v7
        if: github.event_name == 'pull_request'
        with:
          ref: ${{ github.event.pull_request.base.sha }}

      - name: 'Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})'
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'

      - name: Install Dependencies
        uses: ./.github/actions/install-dependencies

      - name: Check for Affected Nx Projects
        uses: ./.github/actions/nx-affected-list
        id: checkForAffected
        if: github.event_name == 'pull_request'
        with:
          base: ${{ github.event.pull_request.base.sha }}
          head: ${{ env.HEAD_COMMIT }}

      - name: Build packages
        run: pnpm run build:ci

      - name: Compute build artifact paths from Nx
        id: nx_build_paths
        run: |
          {
            echo 'paths<<EOF'
            pnpm --silent run ci:print-build-artifact-paths
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"

      - name: Store NX cache
        uses: actions/cache/save@v6.1.0
        # Only cache this per-PR to speed up CI.
        if: github.event_name == 'pull_request'
        with:
          path: |
            .nx/cache
            .nx/workspace-data
          key: ${{ env.NX_CACHE_KEY }}

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: build-output
          path: ${{ steps.nx_build_paths.outputs.paths }}
          retention-days: 4
          compression-level: 6
          overwrite: true

      - name: Determine which test applications should be run
        id: matrix
        run:
          pnpm --silent run ci:build-matrix --shards=2 --base=${{ (github.event_name == 'pull_request' &&
          needs.job_get_metadata.outputs.changed_ci != 'true' && github.event.pull_request.base.sha) || '' }} >>
          $GITHUB_OUTPUT
        working-directory: dev-packages/e2e-tests

      - name: Determine which optional E2E test applications should be run
        id: matrix-optional
        run:
          pnpm --silent run ci:build-matrix-optional --base=${{ (github.event_name == 'pull_request' &&
          needs.job_get_metadata.outputs.changed_ci != 'true' && github.event.pull_request.base.sha) || '' }} >>
          $GITHUB_OUTPUT
        working-directory: dev-packages/e2e-tests

    outputs:
      changed_node_integration:
        ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
        '@sentry-internal/node-integration-tests') }}
      changed_node:
        ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
        '@sentry/node') }}
      changed_deno:
        ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
        '@sentry/deno') }}
      changed_bun:
        ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
        '@sentry/bun') }}
      changed_bun_integration:
        ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
        '@sentry-internal/bun-integration-tests') }}
      changed_deno_integration:
        ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
        '@sentry-internal/deno-integration-tests') }}
      changed_browser_integration:
        ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
        '@sentry-internal/browser-integration-tests') }}
      changed_cloudflare_integration:
        ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
        '@sentry-internal/cloudflare-integration-tests') }}
      changed_bundler_plugin_integration:
        ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
        '@sentry-internal/bundler-plugin-integration-tests') }}
      changed_aws_serverless:
        ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
        '@sentry/aws-serverless') }}
      e2e-matrix-1: ${{ steps.matrix.outputs.matrix-1 }}
      e2e-matrix-2: ${{ steps.matrix.outputs.matrix-2 }}
      e2e-matrix-optional: ${{ steps.matrix-optional.outputs.matrix }}

  job_build_layer:
    name: Build Lambda layer
    needs: [job_get_metadata, job_build]
    if:
      needs.job_build.outputs.changed_aws_serverless == 'true' || contains(needs.job_build.outputs.e2e-matrix-1,
      'aws-serverless') || contains(needs.job_build.outputs.e2e-matrix-2, 'aws-serverless') || github.event_name !=
      'pull_request'
    timeout-minutes: 10
    runs-on:
      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript${{ github.event_name == 'pull_request'
      && '-pr' || '' }}
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Restore NX cache
        uses: actions/cache/restore@v6.1.0
        with:
          path: |
            .nx/cache
            .nx/workspace-data
          key: ${{ env.NX_CACHE_KEY }}

      - name: Restore caches
        uses: ./.github/actions/restore-cache

      - name: Build Lambda layer
        run: pnpm run build:layer

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: build-layer-output
          path: ${{ env.BUILD_LAYER_PATH }}
          retention-days: 4
          compression-level: 6
          overwrite: true

  job_build_bundles:
    name: Build bundles
    needs: [job_get_metadata, job_build]
    timeout-minutes: 10
    runs-on:
      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript${{ github.event_name == 'pull_request'
      && '-pr' || '' }}
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Restore NX cache
        uses: actions/cache/restore@v6.1.0
        with:
          path: |
            .nx/cache
            .nx/workspace-data
          key: ${{ env.NX_CACHE_KEY }}

      - name: Restore caches
        uses: ./.github/actions/restore-cache

      - name: Build bundles
        run: pnpm run build:bundle

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: build-bundle-output
          path: ${{ env.BUNDLE_ARTIFACT_GLOB }}
          retention-days: 4
          compression-level: 6
          overwrite: true

  job_check_branches:
    name: Check PR branches
    needs: job_get_metadata
    runs-on: namespace-profile-sentry-javascript-small
    if: github.event_name == 'pull_request'
    permissions:
      pull-requests: write
    steps:
      - name: PR is opened against master
        uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59
        if: ${{ github.base_ref == 'master' && !startsWith(github.head_ref, 'prepare-release/') }}
        with:
          message: |
            ⚠️ This PR is opened against **master**. You probably want to open it against **develop**.

  job_size_check:
    name: Size Check
    needs: [job_get_metadata, job_build, job_build_bundles]
    timeout-minutes: 15
    runs-on:
      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript${{ github.event_name == 'pull_request'
      && '-pr' || '' }}
    if:
      github.event_name == 'pull_request' || needs.job_get_metadata.outputs.is_base_branch == 'true' ||
      needs.job_get_metadata.outputs.is_release == 'true'
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Restore caches
        uses: ./.github/actions/restore-cache
      - name: Restore build bundle artifacts
        uses: actions/download-artifact@v8
        with:
          name: build-bundle-output
          path: ${{ env.BUNDLE_ARTIFACT_DOWNLOAD_PATH }}
      - name: Check bundle sizes
        uses: ./dev-packages/size-limit-gh-action
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          # Only run comparison against develop if this is a PR
          comparison_branch: ${{ (github.event_name == 'pull_request' && github.base_ref) ||  ''}}

  job_lint:
    name: Lint
    # Even though the linter only checks source code, not built code, it needs the built code in order check that all
    # inter-package dependencies resolve cleanly.
    needs: [job_get_metadata, job_build]
    timeout-minutes: 10
    runs-on:
      namespace-profile-sentry-javascript-large;overrides.cache-tag=sentry-javascript${{ github.event_name ==
      'pull_request' && '-pr' || '' }}
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Restore caches
        uses: ./.github/actions/restore-cache
      - parallel:
          - name: Lint source files
            run: pnpm run lint
          - name: Lint for ES compatibility
            run: pnpm run lint:es-compatibility
          - name: Lint types
            run: pnpm run lint:types
          - name: Check for circular dependencies
            run: pnpm run circularDepCheck
          - name: Check for dts files that reference stuff in the temporary build folder
            run: |
              if grep -r --include "*.d.ts" --exclude-dir ".nx" 'import("@sentry(-internal)?/[^/]*/build' .; then
                echo "Found illegal TypeScript import statement."
                exit 1
              fi
          - name: Check Playwright versions
            run: |
              version=$(node -p "require('./dev-packages/test-utils/package.json').devDependencies['@playwright/test']")
              if git grep -n '"@playwright/test": "' -- '*package.json' | grep -vF "\"$version\""; then
                echo "::error::All @playwright/test dependencies must be pinned to $version (from @sentry-internal/test-utils)."
                exit 1
              fi

  job_check_lockfile:
    name: Check lockfile
    needs: [job_get_metadata]
    # `pnpm dedupe --check` fetches metadata for every package from npm, so this job can take 8+ min on PRs.
    timeout-minutes: 20
    runs-on: namespace-profile-sentry-javascript
    if: |
      needs.job_get_metadata.outputs.changed_deps == 'true' ||
      needs.job_get_metadata.outputs.is_base_branch == 'true' ||
      needs.job_get_metadata.outputs.is_release == 'true'
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Install pnpm
        uses: ./.github/actions/install-pnpm
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Install dependencies
        run: pnpm install --no-frozen-lockfile
      - name: Check that pnpm-lock.yaml is stable
        run: |
          if ! git diff --exit-code pnpm-lock.yaml; then
            echo "::error::pnpm-lock.yaml has uncommitted changes after running 'pnpm install'. Please run 'pnpm install' locally and commit the updated pnpm-lock.yaml."
            exit 1
          fi
      - name: Check for duplicate dependencies in lockfile
        run: pnpm run dedupe-deps:check

  job_check_format:
    name: Check file formatting
    needs: [job_get_metadata]
    timeout-minutes: 10
    runs-on:
      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript${{ github.event_name == 'pull_request'
      && '-pr' || '' }}
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'

      - name: Install Dependencies
        uses: ./.github/actions/install-dependencies

      - name: Check file formatting
        run: pnpm run format:check

  job_artifacts:
    name: Upload Artifacts
    needs: [job_get_metadata, job_build, job_build_layer, job_build_bundles, job_build_tarballs]
    runs-on:
      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript${{ github.event_name == 'pull_request'
      && '-pr' || '' }}
    # Build artifacts are only needed for releasing workflow.
    if: needs.job_get_metadata.outputs.is_release == 'true'
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Restore caches
        uses: ./.github/actions/restore-cache

      - name: Restore tarball artifacts
        uses: actions/download-artifact@v8
        with:
          name: build-tarball-output
          path: ${{ env.TARBALL_ARTIFACT_DOWNLOAD_PATH }}

      - name: Restore build bundle artifacts
        uses: actions/download-artifact@v8
        with:
          name: build-bundle-output
          path: ${{ env.BUNDLE_ARTIFACT_DOWNLOAD_PATH }}

      - name: Restore build layer artifacts
        uses: actions/download-artifact@v8
        with:
          name: build-layer-output
          path: ${{ env.BUILD_LAYER_PATH }}

      - name: Archive artifacts
        uses: actions/upload-artifact@v7
        with:
          name: ${{ github.sha }}
          retention-days: 90
          path: |
            ${{ github.workspace }}/packages/browser/build/bundles/**
            ${{ github.workspace }}/packages/replay-internal/build/bundles/**
            ${{ github.workspace }}/packages/replay-canvas/build/bundles/**
            ${{ github.workspace }}/packages/feedback/build/bundles/**
            ${{ github.workspace }}/packages/*/*.tgz
            ${{ github.workspace }}/packages/aws-serverless/build/aws/dist-serverless/*.zip
            # `node_modules` contains links to the workspace packages. Without this line, the globs above might upload duplicate tarballs.
            !${{ github.workspace }}/packages/**/node_modules/**

  job_browser_unit_tests:
    name: Browser Unit Tests
    needs: [job_get_metadata, job_build]
    timeout-minutes: 10
    runs-on:
      namespace-profile-sentry-javascript-large;overrides.cache-tag=sentry-javascript${{ github.event_name ==
      'pull_request' && '-pr' || '' }}
    steps:
      - name: Check out base commit (${{ github.event.pull_request.base.sha }})
        uses: actions/checkout@v7
        if: github.event_name == 'pull_request'
        with:
          ref: ${{ github.event.pull_request.base.sha }}

      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Restore caches
        uses: ./.github/actions/restore-cache

      - name: Run affected tests
        run: pnpm run test:pr:browser --base=${{ github.event.pull_request.base.sha }}
        if: github.event_name == 'pull_request'

      - name: Run all tests
        run: pnpm run test:ci:browser
        if: github.event_name != 'pull_request'

  job_bun_unit_tests:
    name: Bun (${{ matrix.bun }}) Unit Tests
    needs: [job_get_metadata, job_build]
    if: needs.job_build.outputs.changed_bun == 'true' || github.event_name != 'pull_request'
    timeout-minutes: 10
    runs-on:
      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript${{ github.event_name == 'pull_request'
      && '-pr' || '' }}
    strategy:
      fail-fast: false
      matrix:
        # 1.3.14 is the oldest supported Bun version
        bun: ['1.3.14', '1.4']
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ matrix.bun }}
      - name: Restore caches
        uses: ./.github/actions/restore-cache
      - name: Run tests
        run: |
          pnpm run test:ci:bun

  job_deno_unit_tests:
    name: Deno Unit Tests
    needs: [job_get_metadata, job_build]
    if: needs.job_build.outputs.changed_deno == 'true' || github.event_name != 'pull_request'
    timeout-minutes: 10
    runs-on:
      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript${{ github.event_name == 'pull_request'
      && '-pr' || '' }}
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Set up Deno
        uses: denoland/setup-deno@v2.0.5
        with:
          deno-version: 'v2.8.3'
      - name: Restore caches
        uses: ./.github/actions/restore-cache
      - name: Run tests
        run: |
          cd packages/deno
          pnpm run build
          pnpm run test

  job_node_unit_tests:
    name: Node (${{ matrix.node }}) Unit Tests
    needs: [job_get_metadata, job_build]
    timeout-minutes: 10
    runs-on:
      namespace-profile-sentry-javascript-large;overrides.cache-tag=sentry-javascript${{ github.event_name ==
      'pull_request' && '-pr' || '' }}
    strategy:
      fail-fast: false
      matrix:
        node: [20.19, 22, 24, 26]
    steps:
      - name: Check out base commit (${{ github.event.pull_request.base.sha }})
        uses: actions/checkout@v7
        if: github.event_name == 'pull_request'
        with:
          ref: ${{ github.event.pull_request.base.sha }}
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node }}
      - name: Restore caches
        uses: ./.github/actions/restore-cache

      - name: Run affected tests
        run: pnpm run test:pr:node --base=${{ github.event.pull_request.base.sha }}
        if: github.event_name == 'pull_request'
        env:
          NODE_VERSION: ${{ matrix.node }}

      - name: Run all tests
        run: pnpm run test:ci:node
        if: github.event_name != 'pull_request'
        env:
          NODE_VERSION: ${{ matrix.node }}

  job_browser_playwright_tests:
    name:
      Playwright ${{ matrix.bundle }}${{ matrix.project && matrix.project != 'chromium' && format(' {0}',
      matrix.project) || ''}}${{ matrix.shard && format(' ({0}/{1})', matrix.shard, matrix.shards) || ''}} Tests
    needs: [job_get_metadata, job_build, job_build_bundles]
    if: needs.job_build.outputs.changed_browser_integration == 'true' || github.event_name != 'pull_request'
    runs-on:
      namespace-profile-sentry-javascript-large;overrides.cache-tag=sentry-javascript${{ github.event_name ==
      'pull_request' && '-pr' || '' }}
    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
        bundle:
          - esm
          - bundle
          - bundle_min
          - bundle_logs_metrics
          - bundle_replay
          - bundle_replay_logs_metrics
          - bundle_tracing
          - bundle_tracing_logs_metrics
          - bundle_tracing_replay
          - bundle_tracing_replay_logs_metrics
          - bundle_tracing_replay_feedback
          - bundle_tracing_replay_feedback_logs_metrics
          - bundle_tracing_replay_feedback_logs_metrics_min
        project:
          - chromium
        include:
          # Only check all projects for full bundle
          # We also shard the tests as they take the longest
          - bundle: bundle_tracing_replay_feedback_logs_metrics_min
            project: 'webkit'
          - bundle: bundle_tracing_replay_feedback_logs_metrics_min
            project: 'firefox'
          - bundle: esm
            project: chromium
            shard: 1
            shards: 4
          - bundle: esm
            project: chromium
            shard: 2
            shards: 4
          - bundle: esm
            project: chromium
            shard: 3
            shards: 4
          - bundle: esm
            project: chromium
            shard: 4
            shards: 4
        exclude:
          # Do not run the un-sharded esm tests
          - bundle: esm
            project: 'chromium'

    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Restore caches
        uses: ./.github/actions/restore-cache

      - name: Restore build bundle artifacts
        uses: actions/download-artifact@v8
        with:
          name: build-bundle-output
          path: ${{ env.BUNDLE_ARTIFACT_DOWNLOAD_PATH }}

      - name: Install Playwright
        uses: ./.github/actions/install-playwright
        with:
          browsers: ${{ matrix.project }}
          cwd: dev-packages/browser-integration-tests

      - name: Run Playwright tests
        env:
          PW_BUNDLE: ${{ matrix.bundle }}
        working-directory: dev-packages/browser-integration-tests
        run:
          pnpm run test:all${{ matrix.project && format(' --project={0}', matrix.project) || '' }}${{ matrix.shard &&
          format(' --shard={0}/{1}', matrix.shard, matrix.shards) || '' }}

      - name: Upload Playwright Traces
        uses: actions/upload-artifact@v7
        if: failure()
        with:
          name:
            playwright-traces-job_browser_playwright_tests-${{ matrix.bundle}}-${{matrix.project}}-${{matrix.shard ||
            '0'}}
          path: dev-packages/browser-integration-tests/test-results
          overwrite: true
          retention-days: 7

  job_browser_loader_tests:
    name: PW ${{ matrix.bundle }} Tests
    needs: [job_get_metadata, job_build, job_build_bundles]
    if: needs.job_build.outputs.changed_browser_integration == 'true' || github.event_name != 'pull_request'
    runs-on:
      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript${{ github.event_name == 'pull_request'
      && '-pr' || '' }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        bundle:
          - loader_base
          - loader_eager
          - loader_debug
          - loader_tracing
          - loader_replay
          - loader_replay_buffer
          - loader_tracing_replay

    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Restore caches
        uses: ./.github/actions/restore-cache

      - name: Restore build bundle artifacts
        uses: actions/download-artifact@v8
        with:
          name: build-bundle-output
          path: ${{ env.BUNDLE_ARTIFACT_DOWNLOAD_PATH }}

      - name: Install Playwright
        uses: ./.github/actions/install-playwright
        with:
          browsers: chromium
          cwd: dev-packages/browser-integration-tests

      - name: Run Playwright Loader tests
        env:
          PW_BUNDLE: ${{ matrix.bundle }}
        run: |
          cd dev-packages/browser-integration-tests
          pnpm run test:loader

      - name: Upload Playwright Traces
        uses: actions/upload-artifact@v7
        if: failure()
        with:
          name: playwright-traces-job_browser_loader_tests-${{ matrix.bundle}}
          path: dev-packages/browser-integration-tests/test-results
          overwrite: true
          retention-days: 7

  job_node_integration_tests:
    name: Node (${{ matrix.node }}) Integration Tests (${{ matrix.shard }}/3)
    needs: [job_get_metadata, job_build]
    if: needs.job_build.outputs.changed_node_integration == 'true' || github.event_name != 'pull_request'
    runs-on:
      namespace-profile-sentry-javascript-large;overrides.cache-tag=sentry-javascript${{ github.event_name ==
      'pull_request' && '-pr' || '' }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        node: [20.19, 22, 24, 26]
        shard: [1, 2, 3]
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Free up disk space if low
        # The full suite pulls several DB docker images (mssql alone is ~1.5GB)
        # Available disk space is not consistent, if we detect low space this cleans up some unused toolchains
        run: |
          df -h /
          avail_kb=$(df -k --output=avail / | tail -1)
          if [ "$avail_kb" -lt $((40 * 1024 * 1024)) ]; then
            echo "Low disk space (<40GB free) — reclaiming unused toolchains"
            sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup /opt/hostedtoolcache/CodeQL
            df -h /
          else
            echo "Sufficient disk space — skipping cleanup"
          fi
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node }}
      - name: Restore caches
        uses: ./.github/actions/restore-cache

      - name: Run integration tests
        working-directory: dev-packages/node-integration-tests
        run: pnpm run test --shard=${{ matrix.shard }}/3

  # Runs on the wrangler pinned in the package, so the required run stays on a fixed, older runtime.
  job_cloudflare_integration_tests:
    name: Cloudflare Integration Tests (${{ matrix.shard }}/2)
    needs: [job_get_metadata, job_build]
    if: needs.job_build.outputs.changed_cloudflare_integration == 'true' || github.event_name != 'pull_request'
    runs-on:
      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript${{ github.event_name == 'pull_request'
      && '-pr' || '' }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2]
    steps: &cloudflare_integration_tests_steps
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Restore caches
        uses: ./.github/actions/restore-cache

      # The Vite plugin depends on wrangler and writes config for it, so both move together. In the hoisted layout,
      # pnpm keeps the nested `node_modules` folders of the old versions (for example an old workerd under
      # `node_modules/wrangler`), so the install starts from empty `node_modules` folders. They are mount points of the
      # cache volume, so only their contents are deleted.
      - name: Install the latest wrangler
        if: matrix.wrangler == 'latest'
        run: |
          pnpm --filter @sentry-internal/cloudflare-integration-tests add --save-dev --lockfile-only wrangler@latest @cloudflare/vite-plugin@latest
          find -H node_modules packages/*/node_modules dev-packages/*/node_modules -mindepth 1 -maxdepth 1 -exec rm -rf {} +
          pnpm install --frozen-lockfile --filter @sentry-internal/cloudflare-integration-tests...

      - name: Run integration tests
        working-directory: dev-packages/cloudflare-integration-tests
        run: pnpm run test --shard=${{ matrix.shard }}/2

  # Shows breakage from new wrangler and workerd releases early. It is not in `job_required_jobs_passed`, so it cannot
  # block a PR, and like the optional E2E tests it does not run on release branches.
  job_optional_cloudflare_integration_tests:
    name: Cloudflare Integration Tests (${{ matrix.shard }}/2, latest wrangler) (optional)
    needs: [job_get_metadata, job_build]
    if:
      needs.job_get_metadata.outputs.is_release != 'true' && (needs.job_build.outputs.changed_cloudflare_integration ==
      'true' || github.event_name != 'pull_request')
    runs-on:
      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript-latest-wrangler${{ github.event_name ==
      'pull_request' && '-pr' || '' }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2]
        wrangler: [latest]
    steps: *cloudflare_integration_tests_steps

  job_bundler_plugin_integration_tests:
    name: Bundler Plugin Integration Tests (Node ${{ matrix.node }})
    needs: [job_get_metadata, job_build]
    if: needs.job_build.outputs.changed_bundler_plugin_integration == 'true' || github.event_name != 'pull_request'
    runs-on:
      namespace-profile-sentry-javascript-large;overrides.cache-tag=sentry-javascript${{ github.event_name ==
      'pull_request' && '-pr' || '' }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        node: [20.19, 22, 24, 26]
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node }}
      - name: Restore caches
        uses: ./.github/actions/restore-cache

      - name: Run integration tests
        working-directory: dev-packages/bundler-plugin-integration-tests
        run: pnpm run test

  job_bun_integration_tests:
    name: Bun (${{ matrix.bun }}) Integration Tests (${{ matrix.shard }}/2)
    needs: [job_get_metadata, job_build]
    if: needs.job_build.outputs.changed_bun_integration == 'true' || github.event_name != 'pull_request'
    runs-on:
      namespace-profile-sentry-javascript-large;overrides.cache-tag=sentry-javascript${{ github.event_name ==
      'pull_request' && '-pr' || '' }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        # 1.3.14 is the oldest supported Bun version
        bun: ['1.3.14', '1.4']
        shard: [1, 2]
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ matrix.bun }}
      - name: Restore caches
        uses: ./.github/actions/restore-cache

      - name: Run integration tests
        working-directory: dev-packages/bun-integration-tests
        run: pnpm run test --shard=${{ matrix.shard }}/2

  job_deno_integration_tests:
    name: Deno Integration Tests (${{ matrix.shard }}/2)
    needs: [job_get_metadata, job_build]
    if: needs.job_build.outputs.changed_deno_integration == 'true' || github.event_name != 'pull_request'
    runs-on:
      namespace-profile-sentry-javascript-large;overrides.cache-tag=sentry-javascript${{ github.event_name ==
      'pull_request' && '-pr' || '' }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2]
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Set up Deno
        uses: denoland/setup-deno@v2.0.5
        with:
          deno-version: 'v2.8.3'
      - name: Restore caches
        uses: ./.github/actions/restore-cache
      - name: Build @sentry/deno
        working-directory: packages/deno
        run: pnpm run build
      - name: Run native Deno integration tests
        if: matrix.shard == 1
        working-directory: dev-packages/deno-integration-tests
        run: |
          pnpm run install:deno
          pnpm run deno-types
          pnpm run test:unit
      - name: Run shared Node integration tests
        working-directory: dev-packages/deno-integration-tests
        run: pnpm run test:node-suites --shard=${{ matrix.shard }}/2

  job_build_tarballs:
    name: Build tarballs
    # We want to run this if:
    # - The build job was successful, not skipped
    if: |
      always() &&
      needs.job_build.result == 'success'
    needs: [job_get_metadata, job_build]
    runs-on:
      namespace-profile-sentry-javascript-large;overrides.cache-tag=sentry-javascript${{ github.event_name ==
      'pull_request' && '-pr' || '' }}
    timeout-minutes: 15
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Restore NX cache
        uses: actions/cache/restore@v6.1.0
        with:
          path: |
            .nx/cache
            .nx/workspace-data
          key: ${{ env.NX_CACHE_KEY }}

      - name: Restore caches
        uses: ./.github/actions/restore-cache

      - name: Build tarballs
        run: pnpm run build:tarball

      - name: Upload tarball artifacts
        uses: actions/upload-artifact@v7
        with:
          name: build-tarball-output
          path: ${{ env.TARBALL_ARTIFACT_GLOB }}
          if-no-files-found: error
          retention-days: 4
          compression-level: 6
          overwrite: true

      - name: Upload test-utils tarball artifact
        uses: actions/upload-artifact@v7
        with:
          name: build-test-utils-tarball-output
          path: dev-packages/test-utils/*.tgz
          if-no-files-found: error
          retention-days: 4
          compression-level: 6
          overwrite: true

  # GitHub Actions allows at most 256 jobs in one matrix, so the E2E tests are split into two jobs that share `env`
  # and `steps`.
  job_e2e_tests_1:
    name: E2E ${{ matrix.label || matrix.test-application }} Test
    # We need to add the `always()` check here because the previous step has this as well :(
    # See: https://github.com/actions/runner/issues/2205
    if:
      always() && needs.job_build_tarballs.result == 'success' && needs.job_build.outputs.e2e-matrix-1 !=
      '{"include":[]}'
    needs: [job_get_metadata, job_build, job_build_layer, job_build_tarballs]
    # Most apps finish in under a minute on 4 vCPUs, so they run on 2. Apps that take longer set `sentryTest.runner`.
    runs-on:
      ${{ matrix.runner || 'namespace-profile-sentry-javascript-small' }};overrides.cache-tag=sentry-javascript-e2e${{
      github.event_name == 'pull_request' && '-pr' || '' }}
    timeout-minutes: 15
    # We just use a dummy DSN here, only send to the tunnel anyhow
    env: &e2e-env
      E2E_TEST_DSN: 'https://username@domain/123'
      # Needed because some apps expect a certain prefix
      NEXT_PUBLIC_E2E_TEST_DSN: 'https://username@domain/123'
      PUBLIC_E2E_TEST_DSN: 'https://username@domain/123'
      REACT_APP_E2E_TEST_DSN: 'https://username@domain/123'
      E2E_TEST_SENTRY_ORG_SLUG: 'sentry-javascript-sdks'
      E2E_TEST_SENTRY_PROJECT: 'sentry-javascript-e2e-tests'
      # The `runtime` of a runtime variant, see dev-packages/e2e-tests/README.md
      RUNTIME: ${{ matrix.runtime }}
      # Without the root node_modules, `pnpm run` would first install the whole workspace.
      pnpm_config_verify_deps_before_run: 'false'
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.job_build.outputs.e2e-matrix-1) }}
    steps: &e2e-steps
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Prepare E2E test application
        uses: ./.github/actions/prepare-e2e-test
        with:
          test-application: ${{ matrix.test-application }}
          runtime: ${{ matrix.runtime }}
          deno-version: ${{ matrix.deno-version }}

      # Installs Playwright while the app installs and builds. Keep it right before the install: the runner sets up a
      # background composite action's steps from the job's shared `github` context, which fails with "Collection was
      # modified" if a foreground step starts at that moment. Starting next to `download-artifact` also made it fail to
      # read the event file.
      - name: Install Playwright
        id: install-playwright
        background: true
        uses: ./.github/actions/install-playwright
        with:
          browsers: chromium
          cwd: dev-packages/e2e-tests/test-applications/${{ matrix.test-application }}

      # Every build command runs `pnpm install`, so installing first makes that a no-op. Some downloads from the npm
      # registry crawl at tens of kB/s for the whole 7 minutes of the build step, and pnpm does not give up on a slow
      # download. Another attempt reuses what is already in the store and opens new connections.
      # The hoisted variant installs with another node linker, so installing first would only redo the install.
      - name: Install E2E app dependencies
        if: ${{ !contains(matrix.build-command, 'hoisted') }}
        working-directory: ${{ runner.temp }}/test-application
        timeout-minutes: 7
        run: |
          for attempt in 1 2; do
            timeout 150 pnpm install && exit 0
            echo "::warning::pnpm install attempt $attempt failed or did not finish in 150 s, retrying"
          done
          pnpm install
        env:
          SENTRY_E2E_WORKSPACE_ROOT: ${{ github.workspace }}

      - name: Build E2E app
        working-directory: ${{ runner.temp }}/test-application
        timeout-minutes: 7
        run: ${{ matrix.build-command || 'pnpm test:build' }}
        env:
          SENTRY_E2E_WORKSPACE_ROOT: ${{ github.workspace }}

      - wait: [install-playwright]

      - name: Run E2E test
        working-directory: ${{ runner.temp }}/test-application
        timeout-minutes: 10
        run: ${{ matrix.assert-command || 'pnpm test:assert' }}
        env:
          SENTRY_E2E_WORKSPACE_ROOT: ${{ github.workspace }}

      - name: Upload Playwright Traces
        uses: actions/upload-artifact@v7
        if: failure()
        with:
          name: playwright-traces-job_e2e_playwright_tests-${{ matrix.test-application}}
          path: ${{ runner.temp }}/test-application/test-results
          overwrite: true
          retention-days: 7

  job_e2e_tests_2:
    name: E2E ${{ matrix.label || matrix.test-application }} Test
    if:
      always() && needs.job_build_tarballs.result == 'success' && needs.job_build.outputs.e2e-matrix-2 !=
      '{"include":[]}'
    needs: [job_get_metadata, job_build, job_build_layer, job_build_tarballs]
    runs-on:
      ${{ matrix.runner || 'namespace-profile-sentry-javascript-small' }};overrides.cache-tag=sentry-javascript-e2e${{
      github.event_name == 'pull_request' && '-pr' || '' }}
    timeout-minutes: 15
    env: *e2e-env
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.job_build.outputs.e2e-matrix-2) }}
    steps: *e2e-steps

  # - We skip optional tests on release branches
  # - The tests run in optional-e2e.yml, so their failures do not mark the PR as failed. This job only waits for
  #   them. optional-e2e.yml reports the results in a PR comment.
  job_optional_e2e_tests:
    name: E2E Tests (optional)
    # We only run E2E tests for non-fork PRs because the E2E tests require secrets to work and they can't be accessed from forks
    # We need to add the `always()` check here because the previous step has this as well :(
    # See: https://github.com/actions/runner/issues/2205
    if:
      always() && needs.job_get_metadata.outputs.is_release != 'true' && needs.job_build_tarballs.result == 'success' &&
      needs.job_build.outputs.e2e-matrix-optional != '{"include":[]}' && (github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository) && github.actor != 'dependabot[bot]'
    needs: [job_get_metadata, job_build, job_build_tarballs]
    # This job only waits for optional-e2e.yml, which can take most of an hour. GitHub runners are free for public
    # repos and Namespace runners are paid per minute, so the wait runs here and the tests run on Namespace.
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      contents: read
      actions: write
    steps:
      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
        uses: actions/checkout@v7
        with:
          ref: ${{ env.HEAD_COMMIT }}
      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version-file: 'package.json'
      - name: Install pnpm
        uses: ./.github/actions/install-pnpm
      # The Namespace cache volume is not available here, so only install what the action needs
      - name: Install action dependencies
        run: pnpm install --frozen-lockfile --filter @sentry-internal/optional-e2e-gh-action
      - name: Run optional E2E tests
        uses: ./dev-packages/optional-e2e-gh-action
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          commit: ${{ env.HEAD_COMMIT }}
          matrix: ${{ needs.job_build.outputs.e2e-matrix-optional }}

  job_required_jobs_passed:
    name: All required jobs passed or were skipped
    needs:
      [
        job_build,
        job_build_bundles,
        job_build_layer,
        job_build_tarballs,
        job_browser_unit_tests,
        job_bun_unit_tests,
        job_deno_unit_tests,
        job_node_unit_tests,
        job_node_integration_tests,
        job_cloudflare_integration_tests,
        job_bundler_plugin_integration_tests,
        job_bun_integration_tests,
        job_deno_integration_tests,
        job_browser_playwright_tests,
        job_browser_loader_tests,
        job_e2e_tests_1,
        job_e2e_tests_2,
        job_artifacts,
        job_lint,
        job_check_lockfile,
        job_check_format,
        job_size_check,
      ]
    # Always run this, even if a dependent job failed
    if: always()
    runs-on: namespace-profile-sentry-javascript-small
    permissions: {}
    steps:
      - name: Check for failures
        if: cancelled() || contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "One of the dependent jobs have failed. You may need to re-run it." && exit 1