From 5d7b8c82e8d50fb2b366e85b3ad039cfb04c6eaf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= <hi+github@ullrich.is>
Date: Fri, 27 Mar 2026 18:15:45 +0100
Subject: [PATCH] Fix Sentry build: disable telemetry, fix release version
 passing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Disable Sentry Vite plugin telemetry (telemetry: false)
- Pass SENTRY_RELEASE as build-arg (not secret) since it's just the git sha
- Keep only SENTRY_AUTH_TOKEN as Docker secret

The release version was showing as *** because Docker secrets get masked
by GitHub Actions. Git sha is not sensitive — safe as a build arg.

The sourcemap warning from react-router is a known upstream issue (ships
without sourcemaps) and is harmless.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/cd-apps.yml | 4 ++--
 apps/journal/Dockerfile       | 4 ++--
 apps/journal/vite.config.ts   | 1 +
 apps/planner/Dockerfile       | 4 ++--
 apps/planner/vite.config.ts   | 1 +
 5 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/cd-apps.yml b/.github/workflows/cd-apps.yml
index d102342..bbaeb6d 100644
--- a/.github/workflows/cd-apps.yml
+++ b/.github/workflows/cd-apps.yml
@@ -39,7 +39,6 @@ jobs:
           chmod +x sops-v3.9.4.linux.amd64
           SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env > /tmp/secrets.env
           grep SENTRY_AUTH_TOKEN /tmp/secrets.env | cut -d= -f2- > /tmp/sentry_token
-          echo "${{ github.sha }}" > /tmp/sentry_release
 
       - uses: docker/build-push-action@v7
         with:
@@ -49,9 +48,10 @@ jobs:
           tags: |
             ghcr.io/trails-cool/${{ matrix.app }}:latest
             ghcr.io/trails-cool/${{ matrix.app }}:${{ github.sha }}
+          build-args: |
+            SENTRY_RELEASE=${{ github.sha }}
           secrets: |
             SENTRY_AUTH_TOKEN=/tmp/sentry_token
-            SENTRY_RELEASE=/tmp/sentry_release
 
   deploy:
     name: Deploy Apps
diff --git a/apps/journal/Dockerfile b/apps/journal/Dockerfile
index 3f29357..5ca2f4b 100644
--- a/apps/journal/Dockerfile
+++ b/apps/journal/Dockerfile
@@ -14,12 +14,12 @@ COPY packages/db/package.json packages/db/
 RUN pnpm install --frozen-lockfile
 
 FROM base AS build
+ARG SENTRY_RELEASE
 COPY --from=deps /app/ ./
 COPY . .
 RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN \
-    --mount=type=secret,id=SENTRY_RELEASE \
     SENTRY_AUTH_TOKEN="$(cat /run/secrets/SENTRY_AUTH_TOKEN 2>/dev/null)" \
-    SENTRY_RELEASE="$(cat /run/secrets/SENTRY_RELEASE 2>/dev/null)" \
+    SENTRY_RELEASE="$SENTRY_RELEASE" \
     pnpm --filter @trails-cool/journal build
 
 FROM base AS runtime
diff --git a/apps/journal/vite.config.ts b/apps/journal/vite.config.ts
index e799794..b4c8cdb 100644
--- a/apps/journal/vite.config.ts
+++ b/apps/journal/vite.config.ts
@@ -17,6 +17,7 @@ export default defineConfig({
       release: { name: process.env.SENTRY_RELEASE },
       sourcemaps: { filesToDeleteAfterUpload: ["./build/**/*.map"] },
       disable: !process.env.SENTRY_AUTH_TOKEN,
+      telemetry: false,
     }),
   ],
   resolve: {
diff --git a/apps/planner/Dockerfile b/apps/planner/Dockerfile
index e080d2e..695f903 100644
--- a/apps/planner/Dockerfile
+++ b/apps/planner/Dockerfile
@@ -14,12 +14,12 @@ COPY packages/db/package.json packages/db/
 RUN pnpm install --frozen-lockfile
 
 FROM base AS build
+ARG SENTRY_RELEASE
 COPY --from=deps /app/ ./
 COPY . .
 RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN \
-    --mount=type=secret,id=SENTRY_RELEASE \
     SENTRY_AUTH_TOKEN="$(cat /run/secrets/SENTRY_AUTH_TOKEN 2>/dev/null)" \
-    SENTRY_RELEASE="$(cat /run/secrets/SENTRY_RELEASE 2>/dev/null)" \
+    SENTRY_RELEASE="$SENTRY_RELEASE" \
     pnpm --filter @trails-cool/planner build
 
 FROM base AS runtime
diff --git a/apps/planner/vite.config.ts b/apps/planner/vite.config.ts
index cb4d8a8..056d23f 100644
--- a/apps/planner/vite.config.ts
+++ b/apps/planner/vite.config.ts
@@ -19,6 +19,7 @@ export default defineConfig({
       release: { name: process.env.SENTRY_RELEASE },
       sourcemaps: { filesToDeleteAfterUpload: ["./build/**/*.map"] },
       disable: !process.env.SENTRY_AUTH_TOKEN,
+      telemetry: false,
     }),
   ],
   resolve: {