Keep MCP deployment unchanged during CLI import

Co-Authored-By: GPT-6 Sol <noreply@openai.com>

Author: BYK

.github/workflows/cli-build.yml

@@ -41,9 +41,9 @@ jobs:
           - target: windows-x64
             os: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ env.NODE_VERSION_22 }}
           cache: pnpm
@@ -111,14 +111,14 @@ jobs:
           test "$status" -eq 10
           printf '%s\n' "$output" | grep -qi 'not authenticated'
       - name: Upload binary artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: sentry-${{ matrix.target }}
           path: |
             packages/cli/dist-bin/sentry-*
             !packages/cli/dist-bin/*.gz
       - name: Upload compressed artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: sentry-${{ matrix.target }}-gz
           path: packages/cli/dist-bin/*.gz
@@ -128,9 +128,9 @@ jobs:
     runs-on: ubuntu-latest
     environment: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/cli/')) && 'production' || '' }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ env.NODE_VERSION_22 }}
           cache: pnpm
@@ -150,7 +150,7 @@ jobs:
         working-directory: packages/cli
         run: npm pack
       - name: Upload npm artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: npm-package
           path: packages/cli/*.tgz
@@ -164,12 +164,12 @@ jobs:
       matrix:
         node: [20, 22, 24]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node == 24 && env.NODE_VERSION_24 || matrix.node == 20 && env.NODE_VERSION_20 || env.NODE_VERSION_22 }}
       - name: Download npm artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: npm-package
           path: packages/cli
@@ -192,9 +192,9 @@ jobs:
     env:
       SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ env.NODE_VERSION_24 }}
           cache: pnpm
@@ -205,7 +205,7 @@ jobs:
       - name: Build docs
         run: pnpm --filter sentry-cli-docs run build
       - name: Download Linux binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: sentry-linux-x64
           path: dist-bin
@@ -232,7 +232,7 @@ jobs:
           printf '%s\n' '{"version":3}' > "$output_dir/.vercel/output/config.json"
           (cd "$output_dir" && zip -qr "$GITHUB_WORKSPACE/vercel.zip" .vercel)
       - name: Upload docs artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: vercel
           path: vercel.zip

.github/workflows/deploy.yml

@@ -17,7 +17,9 @@ jobs:
   deploy:
     name: Deploy to Cloudflare
     runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    # Keep the production Worker unchanged while the CLI/docs import lands.
+    # Restore deployments only through a separately reviewed workflow change.
+    if: ${{ false }}
 
     steps:
       - uses: actions/checkout@v4
@@ -36,7 +38,7 @@ jobs:
       - name: Get pnpm store directory
         shell: bash
         run: |
-          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+          echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
 
       - uses: actions/cache@v4
         name: Setup pnpm cache

.github/workflows/merge-jobs.yml

@@ -2,7 +2,7 @@ name: Post-merge tasks
 
 on:
   push:
-    branches: ["main", "release/*"]
+    branches: ["main", "release/*", "release/mcp/**"]
   workflow_dispatch:
 
 jobs:

docs/operations/github-actions.md

@@ -2,6 +2,12 @@
 
 CI/CD workflows for the Sentry MCP project.
 
+**Toolkit import landing:** The `Deploy to Cloudflare` job is disabled while
+the CLI and docs import lands. A passing `Test` run on `main` cannot change the
+production Worker. Restore deployments only through a separately reviewed
+workflow change. `pnpm build` builds the MCP workspace; `pnpm build:cli` builds
+the imported CLI and docs when `SENTRY_CLIENT_ID` is available.
+
 ## Workflows
 
 ### test.yml
@@ -10,12 +16,8 @@ Runs on all pushes to main and pull requests:
 - Code coverage reporting
 
 ### deploy.yml
-Runs after tests pass on main branch:
-- **Canary deployment**: Deploy to `sentry-mcp-canary` worker with isolated resources
-- **Smoke tests**: Test canary deployment
-- **Production deployment**: Deploy to `sentry-mcp` worker (only if canary tests pass)
-- **Production smoke tests**: Test production deployment
-- **Automatic rollback**: Rollback production if smoke tests fail
+Currently disabled. Its old canary, production, and rollback steps must not
+run until a separately reviewed workflow replaces them.
 
 ### eval.yml
 Runs evaluation tests against the MCP server.
@@ -47,18 +49,14 @@ Canary and production use separate resources for complete isolation:
 | Wrangler Config | `wrangler.jsonc` | `wrangler.canary.jsonc` |
 
 ### Deployment Flow
-1. **Build once** - Single build for both deployments
-2. **Deploy canary** - `wrangler deploy --config wrangler.canary.jsonc`
-3. **Wait 30s** - Allow propagation
-4. **Test canary** - Run smoke tests against canary worker
-5. **Deploy production** - `wrangler deploy` (only if canary tests pass)
-6. **Wait 30s** - Allow propagation  
-7. **Test production** - Run smoke tests against production worker
-8. **Rollback** - `wrangler rollback` if production tests fail
+
+No production deployment runs while the import lands. The disabled workflow's
+old rollback step must not be used to recover production.
 
 ## Manual Deployment
 
-Trigger via GitHub Actions → Deploy to Cloudflare → "Run workflow"
+The deployment job is also disabled for manual workflow dispatch. Do not use
+the old rollback path to deploy or recover the production Worker.
 
 ## Troubleshooting
 

package.json

@@ -25,7 +25,8 @@
     "docs:check": "node scripts/check-doc-links.mjs",
     "dev": "pnpm --filter '@sentry/mcp-cloudflare...' --if-present run build && dotenv -e .env -e .env.local -- pnpm --parallel --filter @sentry/mcp-cloudflare --filter @sentry/mcp-core --filter @sentry/mcp-server-mocks --if-present run dev",
     "dev:stdio": "pnpm --filter '@sentry/mcp-server...' --if-present run build && dotenv -e .env -e .env.local -- pnpm --parallel --filter @sentry/mcp-server --filter @sentry/mcp-core --filter @sentry/mcp-server-mocks --if-present run dev",
-    "build": "dotenv -e .env -e .env.local -- pnpm --filter sentry run build && pnpm -r --filter '!sentry' --filter '!sentry-cli-docs' --if-present run build && pnpm --filter sentry-cli-docs run build",
+    "build": "dotenv -e .env -e .env.local -- pnpm -r --filter '!sentry' --filter '!sentry-cli-docs' --if-present run build",
+    "build:cli": "dotenv -e .env -e .env.local -- pnpm --filter sentry run build && pnpm --filter sentry-cli-docs run build",
     "check:generated": "pnpm --filter @sentry/mcp-core generate-definitions && git diff --exit-code -- packages/mcp-core/src/toolDefinitions.json packages/mcp-core/src/skillDefinitions.json plugins/sentry-mcp/agents/sentry-mcp.md plugins/sentry-mcp-experimental/agents/sentry-mcp.md",
     "deploy": "pnpm --filter '@sentry/mcp-cloudflare...' --if-present run build && pnpm --filter @sentry/mcp-cloudflare run deploy",
     "deploy:docs": "pnpm --filter sentry run generate:schema && pnpm --filter sentry run generate:docs && pnpm --filter sentry-cli-docs run build && pnpm --filter sentry-cli-docs run deploy",