fix(npm): Show publish stderr at info level (#877)

## Summary

npm sends publish notices and warnings to stderr. Craft currently logs
that stream only at Trace, so normal Info-level publish runs hide those
diagnostics even when npm exits successfully.

- Add an opt-in `showStderr` option to `spawnProcess`, matching the
existing `showStdout` behavior.
- Enable it for the npm target's token and OIDC publish paths (including
the existing Yarn fallback).
- Keep other subprocesses trace-only by default. Do not change stdout
return values, exit-code handling, auth, or publish commands.
- Extend the subprocess tests for default logging, visible stderr on
success/failure, and the npm target tests for both auth paths.

This exposes future publish output. It cannot recover stderr from
earlier runs and does not retry or verify a registry publish. The
publishing image must pick up this change after merge/release before it
affects runs.

## Validation

- Frozen pnpm install, 54 focused tests, typecheck, formatting, and diff
checks pass.
- Lint passes with seven existing warnings outside these files.
- Local build and CLI version smoke test pass. The first `pnpm build`
exited 0 but its optional Sentry upload reported HTTP 413; rebuilding
with `env -u SENTRY_AUTH_TOKEN pnpm build` succeeded without the upload.
- `env -u SENTRY_AUTH_TOKEN pnpm test` exits 1: 1,200 passed, three
failed, one skipped. The three `prepare-dry-run.e2e.test.ts` failures
report `Git author was not set to the Junior identity` because the
fixtures set `Test User`. Two also encounter GitHub's unresolved
`test-owner/test-repo` fixture. A snapshot becomes obsolete because the
failing test never reaches its assertion. No runtime identity guards or
fixture behavior were changed.

<!-- junior-request-attribution:start -->
via **David Cramer**.
<!-- junior-request-attribution:end -->

<!-- junior-session-footer:start -->
<!-- junior-conversation-id:slack%3AC0B595QDZLL%3A1790001522.417909 -->

--

[View Junior
Session](https://junior-prod.sentry.dev/conversations/slack%3AC0B595QDZLL%3A1790001522.417909)
[[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC0B595QDZLL%3A1790001522.417909/?project=4510944073809921)

<!-- junior-session-footer:end -->

Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
Co-authored-by: David Cramer <david@sentry.io>

Author: sentry-junior[bot]

src/targets/__tests__/npm.test.ts

@@ -518,6 +518,39 @@ describe('NpmTarget OIDC configuration', () => {
     expect(target.npmConfig.token).toBe('my-token');
   });
 
+  it.each([false, true])(
+    'shows publish stdout and stderr with oidc=%s',
+    async oidc => {
+      vi.stubEnv('NPM_TOKEN', 'my-token');
+      vi.stubEnv('USE_YARN', '');
+      const spawnProcessMock = vi
+        .spyOn(system, 'spawnProcess')
+        .mockResolvedValue(Buffer.from('+ @sentry/browser@1.0.0\n'));
+      const provider = {
+        filterArtifactsForRevision: vi
+          .fn()
+          .mockResolvedValue([{ filename: 'sentry-browser-1.0.0.tgz' }]),
+        downloadArtifact: vi
+          .fn()
+          .mockResolvedValue('/tmp/sentry-browser-1.0.0.tgz'),
+      } as unknown as BaseArtifactProvider;
+
+      try {
+        const target = new TestNpmTarget({ name: 'npm', oidc }, provider);
+        await target.publish('1.0.0', 'release-sha');
+
+        expect(spawnProcessMock).toHaveBeenCalledExactlyOnceWith(
+          NPM_BIN,
+          ['publish', '--ignore-scripts', '/tmp/sentry-browser-1.0.0.tgz'],
+          expect.any(Object),
+          { showStdout: true, showStderr: true },
+        );
+      } finally {
+        spawnProcessMock.mockRestore();
+      }
+    },
+  );
+
   it('throws when oidc: true and npm version is too old', () => {
     TestNpmTarget.mockVersion = { major: 5, minor: 6, patch: 0 };
 

src/targets/npm.ts

@@ -848,7 +848,10 @@ export class NpmTarget extends BaseTarget {
         spawnOptions.env.NPM_CONFIG_OTP = options.otp;
       }
       // Disable output buffering because npm can ask for one-time passwords
-      return spawnProcess(bin, args, spawnOptions, { showStdout: true });
+      return spawnProcess(bin, args, spawnOptions, {
+        showStdout: true,
+        showStderr: true,
+      });
     }
 
     return withTempFile(filePath => {
@@ -869,6 +872,7 @@ export class NpmTarget extends BaseTarget {
       // Disable output buffering because NPM/Yarn can ask us for one-time passwords
       return spawnProcess(bin, args, spawnOptions, {
         showStdout: true,
+        showStderr: true,
       });
     });
   }

src/utils/__tests__/system.test.ts

@@ -78,9 +78,15 @@ describe('spawnProcess', () => {
   test('does not write to output by default', async () => {
     const mockedLogInfo = logger.info as Mock;
 
-    await spawnProcess(process.execPath, ['-e', 'console.log("test-string")']);
+    await spawnProcess(process.execPath, [
+      '-e',
+      'console.log("test-string"); process.stderr.write("test-warning")',
+    ]);
 
     expect(mockedLogInfo).toHaveBeenCalledTimes(0);
+    expect(logger.trace).toHaveBeenCalledWith(
+      `${process.execPath}: test-warning`,
+    );
   });
 
   test('writes to output if told so', async () => {
@@ -97,6 +103,37 @@ describe('spawnProcess', () => {
     expect(mockedLogInfo.mock.calls[0][0]).toMatch(/test-string/);
   });
 
+  test.each([0, 1])(
+    'shows stderr without changing stdout or exit code %i',
+    async exitCode => {
+      const result = spawnProcess(
+        process.execPath,
+        [
+          '-e',
+          `process.stdout.write("result"); process.stderr.write("publish-notice"); process.exitCode = ${exitCode}`,
+        ],
+        {},
+        { showStderr: true },
+      );
+
+      if (exitCode === 0) {
+        expect((await result)?.toString()).toBe('result');
+      } else {
+        await expect(result).rejects.toMatchObject({
+          code: exitCode,
+          message: expect.stringContaining('publish-notice'),
+        });
+      }
+
+      expect(logger.info).toHaveBeenCalledWith(
+        `${process.execPath}: publish-notice`,
+      );
+      expect(logger.info).not.toHaveBeenCalledWith(
+        `${process.execPath}: result`,
+      );
+    },
+  );
+
   describe('env sanitisation (defence-in-depth)', () => {
     const savedEnv = { ...process.env };
 

src/utils/system.ts

@@ -106,6 +106,8 @@ export function replaceEnvVariable(
 export interface SpawnProcessOptions {
   /** Do not buffer standard output */
   showStdout?: boolean;
+  /** Log standard error at info level instead of trace */
+  showStderr?: boolean;
   /** Force the process to run in dry-run mode */
   enableInDryRunMode?: boolean;
   /** Data to write to stdin (process will receive 'pipe' for stdin instead of 'inherit') */
@@ -210,7 +212,11 @@ export async function spawnProcess(
       });
       child.stderr.pipe(split()).on('data', (data: any) => {
         const output = `${command}: ${data}`;
-        logger.trace(output);
+        if (spawnProcessOptions.showStderr) {
+          logger.info(output);
+        } else {
+          logger.trace(output);
+        }
         stderr += `${output}\n`;
       });
     } catch (e) {