Fix release and installer review findings

Co-Authored-By: OpenAI Codex <noreply@openai.com>

Author: BYK

.github/workflows/cli-build.yml

@@ -16,7 +16,7 @@ permissions:
   packages: write
 
 env:
-  SENTRY_CLIENT_ID: ${{ vars.SENTRY_CLIENT_ID || 'ci-release-dummy' }}
+  SENTRY_CLIENT_ID: ${{ vars.SENTRY_CLIENT_ID }}
   NODE_VERSION_20: "20.20.2"
   NODE_VERSION_22: "22.23.1"
   NODE_VERSION_24: "24.18.0"

apps/cli-docs/src/content/docs/migrating-from-v3.md

@@ -288,12 +288,15 @@ biggest migration gotcha is flags that silently no longer exist.
 
 | v3 flag | v4 replacement |
 |---------|----------------|
-| `--auth-token <tok>` | `SENTRY_AUTH_TOKEN` (or `sentry auth login`) |
+| `--auth-token <tok>` | `SENTRY_AUTH_TOKEN` plus `SENTRY_FORCE_ENV_TOKEN=1` to override stored OAuth credentials (or `sentry auth login`) |
 | `--url <url>` (self-hosted) | `SENTRY_URL` / `SENTRY_HOST`, or pass the URL as a command argument |
 | `--header "K: V"` | `SENTRY_CUSTOM_HEADERS` |
 
 The [compatibility shim](#drop-in-compatibility-shim) above translates
-`--auth-token`, `--url`, and `--header` into these env vars automatically.
+`--auth-token`, `--url`, and `--header` into these env vars automatically. For
+`--auth-token`, it sets both `SENTRY_AUTH_TOKEN` and
+`SENTRY_FORCE_ENV_TOKEN=1` so the explicit flag overrides stored OAuth
+credentials as it did in v3.
 
 ### Dropped
 

packages/cli/install

@@ -273,7 +273,7 @@ if [[ "$requested_version" == "nightly" ]]; then
 
   case "$blob_status" in
     200)
-      gunzip "$blob_file" > "$tmp_binary"
+      gunzip -c "$blob_file" > "$tmp_binary"
       ;;
     3??)
       redir_url=$(awk '/^[Ll][Oo][Cc][Aa][Tt][Ii][Oo][Nn]:[[:space:]]*/ { sub(/^[^:]*:[[:space:]]*/, ""); sub(/\r$/, ""); print; exit }' "$blob_headers")

packages/cli/test/lib/install-script.test.ts

@@ -15,39 +15,11 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { gzipSync } from "node:zlib";
 import { afterEach, beforeEach, describe, expect, test } from "vitest";
 
 const installScript = join(import.meta.dirname, "..", "..", "install");
-
-describe("install script", () => {
-  let testDir: string;
-  let binDir: string;
-  let installDir: string;
-  let env: NodeJS.ProcessEnv;
-
-  beforeEach(() => {
-    testDir = mkdtempSync(join(tmpdir(), "sentry-install-test-"));
-    binDir = join(testDir, "bin");
-    installDir = join(testDir, "installed bin");
-    mkdirSync(binDir, { recursive: true });
-    mkdirSync(join(testDir, "home"));
-    env = {
-      PATH: `${binDir}:/usr/bin:/bin:/usr/sbin:/sbin`,
-      HOME: join(testDir, "home"),
-      SENTRY_INSTALL_DIR: installDir,
-      SENTRY_CLI_NO_TELEMETRY: "1",
-      SENTRY_TEST_DIR: testDir,
-      SENTRY_TEST_INSTALL_SCRIPT: installScript,
-      TMPDIR: testDir,
-    };
-
-    // The artifact records each invocation and emulates setup's binary copy and
-    // POSIX cleanup. Every install location and output is inside the fixture.
-    writeFileSync(
-      join(binDir, "curl"),
-      `#!/usr/bin/env bash
-cat <<'SCRIPT'
-#!/usr/bin/env bash
+const downloadedExecutable = `#!/usr/bin/env bash
 set -euo pipefail
 record_tty() {
   for fd in 0 1 2; do
@@ -76,7 +48,35 @@ printf '%s\\n' "$@" >> "$SENTRY_TEST_DIR/post-args"
 printf '%s\\n' "$0" >> "$SENTRY_TEST_DIR/post-binary"
 record_tty 3> "$SENTRY_TEST_DIR/post-tty"
 exit "\${SENTRY_TEST_POST_EXIT:-0}"
-SCRIPT
+`;
+
+describe("install script", () => {
+  let testDir: string;
+  let binDir: string;
+  let installDir: string;
+  let env: NodeJS.ProcessEnv;
+
+  beforeEach(() => {
+    testDir = mkdtempSync(join(tmpdir(), "sentry-install-test-"));
+    binDir = join(testDir, "bin");
+    installDir = join(testDir, "installed bin");
+    mkdirSync(binDir, { recursive: true });
+    mkdirSync(join(testDir, "home"));
+    env = {
+      PATH: `${binDir}:/usr/bin:/bin:/usr/sbin:/sbin`,
+      HOME: join(testDir, "home"),
+      SENTRY_INSTALL_DIR: installDir,
+      SENTRY_CLI_NO_TELEMETRY: "1",
+      SENTRY_TEST_DIR: testDir,
+      SENTRY_TEST_INSTALL_SCRIPT: installScript,
+      TMPDIR: testDir,
+    };
+
+    writeFileSync(
+      join(binDir, "curl"),
+      `#!/usr/bin/env bash
+cat <<'SCRIPT'
+${downloadedExecutable}SCRIPT
 `
     );
     chmodSync(join(binDir, "curl"), 0o755);
@@ -95,6 +95,87 @@ SCRIPT
       : [];
   }
 
+  function configureNightlyDownload(redirect: boolean): void {
+    const platform = process.platform === "darwin" ? "darwin" : "linux";
+    const architecture = process.arch === "arm64" ? "arm64" : "x64";
+    const assetName = `sentry-${platform}-${architecture}.gz`;
+    const gzipPath = join(testDir, assetName);
+    const manifest = JSON.stringify({
+      version: "nightly-test",
+      layers: [
+        {
+          mediaType: "application/vnd.oci.image.layer.v1.tar",
+          digest: "sha256:test",
+          annotations: { "org.opencontainers.image.title": assetName },
+        },
+      ],
+    });
+
+    writeFileSync(gzipPath, gzipSync(downloadedExecutable));
+    env.SENTRY_TEST_GZIP = gzipPath;
+    env.SENTRY_TEST_NIGHTLY_REDIRECT = redirect ? "1" : "0";
+    writeFileSync(
+      join(binDir, "curl"),
+      `#!/usr/bin/env bash
+set -euo pipefail
+url="\${!#}"
+case "$url" in
+  *"/token?"*)
+    printf '{"token":"test-token"}'
+    ;;
+  *"/manifests/nightly")
+    cat <<'JSON'
+${manifest}
+JSON
+    ;;
+  "https://objects.example/nightly.gz")
+    for arg in "$@"; do
+      if [[ "$arg" == Authorization:* ]]; then
+        exit 90
+      fi
+    done
+    cat "$SENTRY_TEST_GZIP"
+    ;;
+  *"/blobs/"*)
+    headers=""
+    output=""
+    while [[ $# -gt 0 ]]; do
+      case "$1" in
+        -D) headers="$2"; shift 2 ;;
+        -o) output="$2"; shift 2 ;;
+        *) shift ;;
+      esac
+    done
+    if [[ "$SENTRY_TEST_NIGHTLY_REDIRECT" == "1" ]]; then
+      printf 'HTTP/1.1 307 Temporary Redirect\\r\\nLocation: https://objects.example/nightly.gz\\r\\n\\r\\n' > "$headers"
+      : > "$output"
+      printf '307'
+    else
+      printf 'HTTP/1.1 200 OK\\r\\n\\r\\n' > "$headers"
+      cp "$SENTRY_TEST_GZIP" "$output"
+      printf '200'
+    fi
+    ;;
+  *)
+    exit 91
+    ;;
+esac
+`
+    );
+    chmodSync(join(binDir, "curl"), 0o755);
+    writeFileSync(
+      join(binDir, "gunzip"),
+      `#!/usr/bin/env bash
+set -euo pipefail
+if [[ $# -gt 0 && "$1" != "-c" ]]; then
+  exit 64
+fi
+exec /usr/bin/gunzip "$@"
+`
+    );
+    chmodSync(join(binDir, "gunzip"), 0o755);
+  }
+
   /** Run curl-style piped installation in a real controlling terminal. */
   function runInTerminal(
     options: { redirect?: string; detached?: boolean } = {}
@@ -171,6 +252,31 @@ process.exitCode = result.status ?? 1;
     expect(existsSync(join(installDir, "sentry"))).toBe(true);
   });
 
+  test.each([
+    { response: "direct HTTP 200 response", redirect: false },
+    { response: "HTTP redirect", redirect: true },
+  ])("installs nightly from a $response", ({ redirect }) => {
+    configureNightlyDownload(redirect);
+    const result = spawnSync(
+      "bash",
+      [installScript, "--version", "nightly", "--no-modify-path"],
+      { env, encoding: "utf8", timeout: 10_000 }
+    );
+
+    expect(result.status, result.stdout + result.stderr).toBe(0);
+    expect(recorded("setup-args")).toEqual([
+      "cli",
+      "setup",
+      "--install",
+      "--method",
+      "curl",
+      "--channel",
+      "nightly",
+      "--no-modify-path",
+    ]);
+    expect(existsSync(join(installDir, "sentry"))).toBe(true);
+  });
+
   test("connects setup to the controlling terminal without launching another process", () => {
     const result = runInTerminal();
     expect(result.status, result.stdout + result.stderr).toBe(0);