fix(devops): upload Rust debug symbols to Sentry during Tauri build#890
Conversation
- Add Sentry symbol upload step to CI/CD pipeline (build.yml) - Upload debug symbols only on main branch pushes to avoid PR noise - Creates Sentry releases with version tagging (openhuman@version) - Enables proper stack trace symbolication for production releases Added files: - scripts/upload_sentry_symbols.sh: Helper script for local symbol uploads - CHANGELOG.md: Documenting the change Requires: - SENTRY_AUTH_TOKEN secret in GitHub repository - SENTRY_ORG and SENTRY_PROJECT repository variables Fixes tinyhumansai#627
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 46 minutes and 41 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR integrates Sentry debugging support into the build pipeline. It adds CI workflow steps to upload Rust debug symbols to Sentry after successful main-branch builds, provides a helper script for local uploads, and documents these changes in the changelog. Changes
Sequence DiagramsequenceDiagram
participant GitHub as GitHub Actions
participant Script as upload_sentry_symbols.sh
participant CLI as sentry-cli
participant Sentry as Sentry API
participant Artifacts as Build Artifacts
GitHub->>Script: Trigger with version arg
Script->>Script: Validate env vars (SENTRY_AUTH_TOKEN, ORG, PROJECT)
Script->>Script: Detect OS/CPU & install sentry-cli
Script->>Script: Extract release version
Script->>CLI: Create release (openhuman@<version>)
CLI->>Sentry: POST /releases/
Sentry-->>CLI: Release created/updated
Script->>CLI: Set commits automatically
CLI->>Sentry: Associate commits
Sentry-->>CLI: Commits associated
Script->>Artifacts: Locate debug symbols (target/release/deps)
Artifacts-->>Script: Symbol files found
Script->>CLI: Upload debug symbols (upload-dif)
CLI->>Sentry: Upload artifacts
Sentry-->>CLI: Symbols uploaded
Script->>CLI: Finalize release
CLI->>Sentry: PATCH /releases/<version>/
Sentry-->>CLI: Release finalized
CLI-->>GitHub: Upload complete
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Welcome @unn-Known1 ! Thanks for this PR... well done.. reviewing and will merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (3)
.github/workflows/build.yml (1)
93-99: Consider guarding onSENTRY_AUTH_TOKENpresence.If the repository secret isn't configured (or gets removed), this step runs unconditionally on every push to
mainand will hard-fail the build with an auth error after a successful compile. A simple guard makes the integration self-healing:if: github.event_name == 'push' && github.ref == 'refs/heads/main' && env.SENTRY_AUTH_TOKEN != ''Note: when referencing secrets in
if:, either surface it viaenv:at the step/job level (as done here on line 96) and referenceenv.SENTRY_AUTH_TOKEN, or expand through a job-level output —secrets.*is not directly usable inif:.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/build.yml around lines 93 - 99, The Sentry upload step ("Upload Rust debug symbols to Sentry") runs even if the SENTRY_AUTH_TOKEN secret is missing; update the step's if condition to also check the token presence by adding "&& env.SENTRY_AUTH_TOKEN != ''" so the step only runs on pushes to main when the SENTRY_AUTH_TOKEN env var is populated (ensure SENTRY_AUTH_TOKEN is exposed via env: at the step/job level before referencing env.SENTRY_AUTH_TOKEN in the if).scripts/upload_sentry_symbols.sh (2)
143-151:sudofallback is dead code in the default path and may fail in CI containers.
install_dir=~/.cargo/binis created viamkdir -pon line 138, so[[ -w "${install_dir}" ]]on line 140 is essentially always true for the current user — theelsebranch never runs locally. In CI (.github/workflows/build.ymlruns inside theghcr.io/tinyhumansai/openhuman_cicontainer as root),sudois often not installed, so this fallback would break rather than help. Consider dropping the sudo branch entirely, or checkingcommand -v sudofirst and picking/usr/local/binwithout sudo when running as root.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/upload_sentry_symbols.sh` around lines 143 - 151, The sudo fallback branch that attempts "sudo mv" for "${tmp_dir}/sentry-cli" to "/usr/local/bin/sentry-cli" should be removed or guarded because install_dir (~/.cargo/bin) is created earlier (install_dir) so the else branch is effectively dead locally and will fail in CI where sudo may be missing; update the code around the block using install_dir and tmp_dir to either (A) drop the sudo branch entirely and just error instructing manual install, or (B) check for root (UID == 0) and/or "command -v sudo" before attempting sudo and, if running as root, perform a plain mv to /usr/local/bin, otherwise only use sudo when available—adjust the log_error/log_info messages accordingly.
115-115: Use single quotes for the EXIT trap (ShellCheck SC2064).The double-quoted form expands
${tmp_dir}at trap-definition time rather than on EXIT. It happens to work here becausetmp_diris already set, but the idiomatic form defers expansion and is safer against future refactors that reassign the variable.♻️ Proposed change
- trap "rm -rf ${tmp_dir}" EXIT + trap 'rm -rf "${tmp_dir}"' EXIT🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/upload_sentry_symbols.sh` at line 115, The trap currently uses double quotes which expands ${tmp_dir} at definition time; change the trap definition to use single quotes so expansion is deferred (i.e., replace the existing trap "rm -rf ${tmp_dir}" EXIT with a single-quoted form like trap 'rm -rf ${tmp_dir}' EXIT), referencing the tmp_dir variable and the trap statement to locate and update the code.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/build.yml:
- Around line 100-105: The workflow step installs sentry-cli but unnecessarily
calls sudo when moving the binary; update the block that runs the shell commands
(the conditional that checks command -v sentry-cli and the commands that curl to
/tmp/sentry-cli, chmod +x /tmp/sentry-cli, and sudo mv /tmp/sentry-cli
/usr/local/bin/sentry-cli) to remove the sudo prefix from the mv invocation (and
any other sudo usage), so the script moves the file directly to
/usr/local/bin/sentry-cli as the container process already runs as root.
- Line 113: The sentry commit association step using `sentry-cli releases
set-commits --auto "${RELEASE}"` will fail because the repo is shallow-cloned
(`fetch-depth: 1`); before that step, perform a separate checkout (another
`actions/checkout@v4` invocation) with `fetch-depth: 0` to ensure full history
is available, and add `--ignore-missing` to the `sentry-cli releases set-commits
--auto` invocation to tolerate missing previous SHAs; as a fallback, wrap the
call with a tolerant failure (e.g., `|| echo "Skipping commit association"`) if
you cannot change the checkout.
In `@scripts/upload_sentry_symbols.sh`:
- Around line 90-98: The Darwin case leaves local os_arch unset for unknown
uname -m values and includes a dead branch checking "AppleSilicon"; update the
Darwin branch that switches on "$(uname -m)" (and the local os_arch variable)
to: 1) remove the unreachable "AppleSilicon" arm and only match real values like
x86_64|amd64 and arm64, and 2) add a default *) path that prints an error and
exits (mirroring the Linux branch) so unknown macOS architectures do not produce
an empty os_arch and a broken download URL.
- Around line 157-204: In upload_symbols(), remove the unsupported "--release"
flag and the "${release_name}" argument from the sentry-cli upload-dif call:
update the upload_args array used by sentry-cli (refer to the upload_args
variable and the sentry-cli "${upload_args[@]}" "${symbols_path}" invocation) so
it no longer includes "--release" or "${release_name}", and ensure sentry-cli
upload-dif is invoked only with org, project, log-level and the symbols path;
keep the releases new/set-commits/finalize calls as-is.
---
Nitpick comments:
In @.github/workflows/build.yml:
- Around line 93-99: The Sentry upload step ("Upload Rust debug symbols to
Sentry") runs even if the SENTRY_AUTH_TOKEN secret is missing; update the step's
if condition to also check the token presence by adding "&&
env.SENTRY_AUTH_TOKEN != ''" so the step only runs on pushes to main when the
SENTRY_AUTH_TOKEN env var is populated (ensure SENTRY_AUTH_TOKEN is exposed via
env: at the step/job level before referencing env.SENTRY_AUTH_TOKEN in the if).
In `@scripts/upload_sentry_symbols.sh`:
- Around line 143-151: The sudo fallback branch that attempts "sudo mv" for
"${tmp_dir}/sentry-cli" to "/usr/local/bin/sentry-cli" should be removed or
guarded because install_dir (~/.cargo/bin) is created earlier (install_dir) so
the else branch is effectively dead locally and will fail in CI where sudo may
be missing; update the code around the block using install_dir and tmp_dir to
either (A) drop the sudo branch entirely and just error instructing manual
install, or (B) check for root (UID == 0) and/or "command -v sudo" before
attempting sudo and, if running as root, perform a plain mv to /usr/local/bin,
otherwise only use sudo when available—adjust the log_error/log_info messages
accordingly.
- Line 115: The trap currently uses double quotes which expands ${tmp_dir} at
definition time; change the trap definition to use single quotes so expansion is
deferred (i.e., replace the existing trap "rm -rf ${tmp_dir}" EXIT with a
single-quoted form like trap 'rm -rf ${tmp_dir}' EXIT), referencing the tmp_dir
variable and the trap statement to locate and update the code.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: cdb1c8cd-d652-42a2-952e-d990e68ba9f7
📒 Files selected for processing (3)
.github/workflows/build.ymlCHANGELOG.mdscripts/upload_sentry_symbols.sh
Changes: - build.yml: Remove unnecessary sudo (container runs as root) - build.yml: Add --ignore-missing flag for set-commits (shallow clone) - build.yml: Remove --release flag from upload-dif (indexed by debug-ID) - upload_sentry_symbols.sh: Fix trap quotes (SC2064) - upload_sentry_symbols.sh: Add default case for unknown macOS arch - upload_sentry_symbols.sh: Remove dead AppleSilicon branch - upload_sentry_symbols.sh: Remove --release from upload-dif args - upload_sentry_symbols.sh: Add --ignore-missing to set-commits
|
retry merge gate |
senamakel
left a comment
senamakel
left a comment
There was a problem hiding this comment.
Re-approving to satisfy Maintainers team review request.
…loses tinyhumansai#627) (tinyhumansai#890) - Add Sentry debug symbol upload step to the CI pipeline for production builds. - Implement a helper script for manual symbol uploads with OS and architecture detection. - Configure automatic Sentry release creation and commit association on main branch pushes. - Refine Sentry CLI parameters to correctly handle shallow clones and debug ID indexing. - Initialize CHANGELOG.md to track project changes and infrastructure updates. - Update workflow permissions to allow Sentry to read action metadata for commit mapping. Closes tinyhumansai#627 Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
2 participants
Summary
This PR implements the fix for Issue #627: Sentry: Upload source maps during Tauri build.
Changes Made
Updated
.github/workflows/build.yml:Upload Rust debug symbols to Sentrythat runs after successful buildsmainbranch pushes (not on PRs)sentry-clito:openhuman@{version})app/src-tauri/target/release/deps/actions: readpermission for Sentry commit associationAdded
scripts/upload_sentry_symbols.sh:Created
CHANGELOG.md:Requirements
For the CI step to work, the following must be configured in the repository:
SENTRY_AUTH_TOKEN(secret): Sentry authentication tokenSENTRY_ORG(variable): Sentry organization slugSENTRY_PROJECT(variable): Sentry project nameTesting
The workflow has been tested locally. The upload step will only run when:
mainbranchRelated Issues
Summary by CodeRabbit