Conversation
JPeer264
added this pull request to stack #24600
September 22, 2026 16:42
Contributor
size-limit report 📦
|
JPeer264
force-pushed
the
jp/e2e-runtime-variants-poc
branch
from
September 23, 2026 05:27
f08b065 to
9297a36
Compare
JPeer264
changed the title
JPeer264
force-pushed
the
jp/e2e-runtime-variants-poc
branch
2 times, most recently
from
September 23, 2026 09:12
d358a6c to
4dd044c
Compare
JPeer264
removed this pull request from stack #24600
September 23, 2026 09:14
JPeer264
changed the title
JPeer264
added this pull request to stack #24613
September 23, 2026 09:15
JPeer264
removed this pull request from stack #24613
September 23, 2026 09:51
JPeer264
added this pull request to stack #24633
September 23, 2026 09:51
JPeer264
force-pushed
the
jp/e2e-runtime-variants-poc
branch
2 times, most recently
from
September 23, 2026 10:02
adb5cb1 to
fb48ca5
Compare
JPeer264
force-pushed
the
jp/e2e-runtime-variants-poc
branch
2 times, most recently
from
September 23, 2026 12:21
51e4c78 to
b94af9d
Compare
JPeer264
force-pushed
the
jp/e2e-runtime-variants-poc
branch
from
September 23, 2026 12:24
b94af9d to
6e3b225
Compare
JPeer264
force-pushed
the
jp/e2e-runtime-variants-poc
branch
from
September 23, 2026 13:23
6e3b225 to
c2638e4
Compare
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
Comment on lines
+1195
to
+1199
| - name: Set up Bun | ||
| if: matrix.runtime == 'bun' | ||
| uses: oven-sh/setup-bun@v2 | ||
| with: | ||
| bun-version: '1.3.14' |
There was a problem hiding this comment.
Mutable oven-sh/setup-bun@v2 in secrets-bearing optional E2E job
The new Bun setup step uses third-party oven-sh/setup-bun@v2 (mutable tag) in a job that already has E2E and Cloudflare secrets; pin it to a full commit SHA like other third-party actions in this workflow.
Evidence
- The optional E2E job env exposes
secrets.E2E_TEST_AUTH_TOKEN,secrets.E2E_TEST_DSN,secrets.E2E_OPENROUTER_API_KEY,secrets.CLOUDFLARE_API_TOKEN, andsecrets.CLOUDFLARE_ACCOUNT_ID. - The changed step runs
uses: oven-sh/setup-bun@v2whenmatrix.runtime == 'bun', so that action executes in the same privileged job. @v2is a movable tag, not a 40-character commit SHA; a tag rewrite could run attacker-controlled code with those secrets available.- Nearby first-party/third-party setup already shows the safer pattern (
pnpm/action-setup@0977fd9...).
Identified by Warden · security-review · V7R-HVR
…amework Runs the same Playwright suite on Bun, Deno and Cloudflare (local workerd) as optional variants of the existing app, instead of one app per runtime. A variant can set a `runtime` matrix key (`bun` or `deno`), and CI then installs that runtime for the job. The Cloudflare build uses its own Vite config with `@cloudflare/vite-plugin` and `sentryCloudflareVitePlugin`, and swaps in a workerd server entry with the new `runtimeEntryPlugin` from `@sentry-internal/test-utils/vite`. Getting the variants green needed these SDK fixes: - react-router: resolve the Cloudflare entry under the `workerd` condition, so `Sentry.flush` and `Sentry.startSpan` exist in a Worker. - react-router: export `createSentryHandleError` and `lowQualityTransactionsFilterIntegration` from `/cloudflare`. - react-router: do not write trace meta tags into prerendered pages, which otherwise pinned every visitor of the static page to one build-time trace. - react-router: name an index route after its nearest ancestor path, or `/`. It has no `path` of its own, so without an Express layer (Bun, Cloudflare) the index page got no route name. - cloudflare: set the request as the transaction name, like Node does. - server-utils: write bare builtin imports of force-bundled dependencies with the `node:` prefix, which Deno before 2.9 needs. Under `bun run` Express is not instrumented, so on Bun (as on Cloudflare) the error transaction stays the request path and the meta tag names the http.server segment. The Bun variant relies on the diagnostics channel fixes of the Bun auto-instrumentation suites PR it is based on. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
JPeer264
force-pushed
the
jp/e2e-runtime-variants-poc
branch
from
September 23, 2026 13:31
c2638e4 to
90bb70c
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
POC for running one framework e2e app on several server runtimes instead of one app per runtime (Linear project P-JS-2537).
react-router-8-frameworknow runs its full Playwright suite on Bun, Deno and Cloudflare (local workerd) as optional variants, next to the Node job.A variant sets
RUNTIMEin a named script andplaywright.config.mjspicks the start command from it. Bun and Deno reuse the Node build. Cloudflare builds with its ownvite.cloudflare.config.ts(@cloudflare/vite-plugin+sentryCloudflareVitePlugin). React Router has no option to pick a server entry, so the newruntimeEntryPluginfrom@sentry-internal/test-utils/viteloadsentry.server.cloudflare.tsxin its place. A newruntimematrix key makes CI install Bun or Deno for a variant, so new variants need nobuild.ymlchange. The convention is in the e2e README. Tests branch onRUNTIMEonly where the runtimes are expected to differ:platformandsdk.nameon Cloudflare, Express's trailing-slash redirect, and on Bun and Cloudflare the effects of having no instrumented Express layer (Express is not instrumented underbun run).The Bun variant is based on the Bun auto-instrumentation PR below it, which fixes diagnostics channels being garbage collected on Bun and the missing
http.serverspan.Running the suite on the other runtimes surfaced SDK bugs, fixed here:
@sentry/react-routerresolved to the browser build (browsercomes beforeworkerin the exports map), soSentry.flushandSentry.startSpanwereundefined. It now resolves the Cloudflare entry underworkerd.sentry-tracemeta tag baked in at build time, because the prerender runs through the wrapped Worker. Every visitor of the static page then continued the same trace. Paths from the build'sprerenderlist no longer get meta tags.path, sowrapSentryHandleRequestnever named it. On Node, Express named the span first and hid this. An index route now takes its nearest ancestor's path, or/.createSentryHandleErrorandlowQualityTransactionsFilterIntegrationare runtime-agnostic but were only exported for Node.@sentry/cloudflarenever set a transaction name on the request scope, so errors thrown in a loader had notransaction.Deno is pinned to v2.9.0: Deno 2.8 loses async context in socket callbacks, which drops
ioredisspans that queue before the connection is ready. Deno 2.8 also crashed on the bareimport "events"that force-bundled dependencies leave in the SSR output; those imports now get thenode:prefix.🤖 Generated with Claude Code