Install CLI nightlies from Toolkit GHCR (#1403)

## Summary
- Point the shell installer at the publicly readable Toolkit GHCR
nightly manifest and blobs.
- Fail clearly on token and manifest transport errors; never fall back
to legacy GHCR for those failures.
- Cover direct and redirected blob downloads plus both failure paths in
the installer tests.

## Verification
- Live isolated stable-to-nightly upgrade: `0.46.0` →
`0.47.0-dev.1791182867` from Toolkit GHCR.
- Root `pnpm run tsc`, root and CLI lint, generated-file checks, and CLI
tests (10,257 passed, 16 skipped) passed on current `main`.
- Focused installer/upgrade tests: 362 passed; Cloudflare tests: 431
passed separately.
- Aggregate `pnpm run test` timed out after 15 minutes while Cloudflare
tests ran; other package summaries passed. Exact-head CI will verify the
aggregate gate.

Co-authored-by: GPT-6 Sol <agent@openai.com>

Author: BYK

packages/cli/install

@@ -202,18 +202,22 @@ if [[ "$requested_version" == "nightly" ]]; then
   echo -e "${MUTED}Fetching nightly build from GHCR...${NC}"
 
   # Step 1: Get anonymous pull token
-  GHCR_TOKEN=$(curl -sf \
-    "https://ghcr.io/token?scope=repository:getsentry/cli:pull" \
-    | awk -F'"' '{for(i=1;i<=NF;i++) if($i=="token"){print $(i+2);exit}}')
+  if ! GHCR_TOKEN=$(curl -sf \
+    "https://ghcr.io/token?scope=repository:getsentry/toolkit:pull" \
+    | awk -F'"' '{for(i=1;i<=NF;i++) if($i=="token"){print $(i+2);exit}}'); then
+    die "Failed to get GHCR token" "ghcr-token"
+  fi
   if [[ -z "$GHCR_TOKEN" ]]; then
     die "Failed to get GHCR token" "ghcr-token"
   fi
 
   # Step 2: Fetch the OCI manifest for the :nightly tag
-  MANIFEST=$(curl -sf \
+  if ! MANIFEST=$(curl -sf \
     -H "Authorization: Bearer $GHCR_TOKEN" \
     -H "Accept: application/vnd.oci.image.manifest.v1+json" \
-    "https://ghcr.io/v2/getsentry/cli/manifests/nightly")
+    "https://ghcr.io/v2/getsentry/toolkit/manifests/nightly"); then
+    die "Failed to fetch nightly manifest from GHCR" "ghcr-manifest"
+  fi
   if [[ -z "$MANIFEST" ]]; then
     die "Failed to fetch nightly manifest from GHCR" "ghcr-manifest"
   fi
@@ -248,7 +252,7 @@ if [[ "$requested_version" == "nightly" ]]; then
   # the redirect target.
   if ! blob_status=$(curl -sS -D "$blob_headers" -o "$blob_file" -w '%{http_code}' \
     -H "Authorization: Bearer $GHCR_TOKEN" \
-    "https://ghcr.io/v2/getsentry/cli/blobs/${digest}"); then
+    "https://ghcr.io/v2/getsentry/toolkit/blobs/${digest}"); then
     die "Failed to fetch nightly blob from GHCR" "ghcr-blob"
   fi
 

packages/cli/test/lib/install-script.test.ts

@@ -287,11 +287,18 @@ esac
       `#!/usr/bin/env bash
 set -euo pipefail
 url="\${!#}"
+printf '%s\\n' "$url" >> "$SENTRY_TEST_DIR/curl-urls"
 case "$url" in
   *"/token?"*)
+    if [[ "\${SENTRY_TEST_NIGHTLY_TOKEN_FAIL:-0}" != "0" ]]; then
+      exit 22
+    fi
     printf '{"token":"test-token"}'
     ;;
   *"/manifests/nightly")
+    if [[ "\${SENTRY_TEST_NIGHTLY_MANIFEST_FAIL:-0}" != "0" ]]; then
+      exit 22
+    fi
     cat <<'JSON'
 ${manifest}
 JSON
@@ -450,6 +457,44 @@ process.exitCode = result.status ?? 1;
     ]);
     expect(existsSync(join(installDir, "sentry"))).toBe(true);
     expect(installerTempFiles()).toEqual([]);
+    expect(recorded("curl-urls").slice(0, 3)).toEqual([
+      "https://ghcr.io/token?scope=repository:getsentry/toolkit:pull",
+      "https://ghcr.io/v2/getsentry/toolkit/manifests/nightly",
+      "https://ghcr.io/v2/getsentry/toolkit/blobs/sha256:test",
+    ]);
+  });
+
+  test.each([
+    { failure: "token", flag: "SENTRY_TEST_NIGHTLY_TOKEN_FAIL" },
+    { failure: "manifest", flag: "SENTRY_TEST_NIGHTLY_MANIFEST_FAIL" },
+  ])("does not fall back to legacy GHCR when Toolkit $failure fails", ({
+    flag,
+  }) => {
+    configureNightlyDownload(false);
+    env[flag] = "1";
+    const result = spawnSync("bash", [installScript, "--version", "nightly"], {
+      env,
+      encoding: "utf8",
+      timeout: 10_000,
+    });
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain(
+      flag === "SENTRY_TEST_NIGHTLY_TOKEN_FAIL"
+        ? "Failed to get GHCR token"
+        : "Failed to fetch nightly manifest from GHCR"
+    );
+    expect(result.stderr).not.toContain("Unexpected failure at line");
+    expect(recorded("curl-urls")).toEqual(
+      flag === "SENTRY_TEST_NIGHTLY_TOKEN_FAIL"
+        ? ["https://ghcr.io/token?scope=repository:getsentry/toolkit:pull"]
+        : [
+            "https://ghcr.io/token?scope=repository:getsentry/toolkit:pull",
+            "https://ghcr.io/v2/getsentry/toolkit/manifests/nightly",
+          ]
+    );
+    expect(recorded("setup-args")).toEqual([]);
+    expect(existsSync(join(installDir, "sentry"))).toBe(false);
   });
 
   test("uses the legacy release only after a Toolkit tag returns HTTP 404", () => {