From fe2f73bcdcb1b1b599151bca3a5cc9d25da53900 Mon Sep 17 00:00:00 2001
From: Joshua Li <joshuarli98@gmail.com>
Date: Fri, 28 Aug 2026 11:34:15 -0700
Subject: [PATCH 1/7] switch to internal github app

---
 .../workflows/bump-sentry-in-getsentry.yml    | 11 +++++---
 .github/workflows/bump-version.yml            | 16 +++++++++---
 .github/workflows/fast-revert.yml             | 25 ++++++++++++++-----
 .../react-to-product-owners-yml-changes.yml   | 11 +++++++-
 4 files changed, 50 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/bump-sentry-in-getsentry.yml b/.github/workflows/bump-sentry-in-getsentry.yml
index d955d1d12cc4..0d016431fa0e 100644
--- a/.github/workflows/bump-sentry-in-getsentry.yml
+++ b/.github/workflows/bump-sentry-in-getsentry.yml
@@ -19,6 +19,13 @@ jobs:
   bump-sentry:
     runs-on: ubuntu-24.04
     steps:
+      - name: getsentry token
+        id: getsentry
+        uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
+        with:
+          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+
       - name: checkout
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
@@ -30,9 +37,7 @@ jobs:
         with:
           repository: 'getsentry/getsentry'
           path: getsentry
-          # This PAT (Personal Access Token) belongs to getsentry-bot,
-          # who can write to getsentry and is SAML+SSO ready.
-          token: ${{ secrets.BUMP_SENTRY_TOKEN }}
+          token: ${{ steps.getsentry.outputs.token }}
 
       - name: bump-sentry ${{ github.sha }}
         run: |
diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index fde061ea6f8f..456726c5cc9a 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -27,17 +27,27 @@ on:
       pr_options:
         type: string
         default: ''
+    secrets:
+      SENTRY_INTERNAL_APP_PRIVATE_KEY:
+        required: true
 
-# disable all permissions -- we use the PAT's permissions instead
+# Disable the default token permissions; the GitHub App token below supplies access.
 permissions: {}
 
 jobs:
   bump-version:
     runs-on: ubuntu-latest
     steps:
+      - name: getsentry token
+        id: getsentry
+        uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
+        with:
+          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
-          token: ${{ secrets.BUMP_SENTRY_TOKEN }}
+          token: ${{ steps.getsentry.outputs.token }}
       - uses: astral-sh/setup-uv@884ad927a57e558e7a70b92f2bccf9198a4be546 # v6
         with:
           version: '0.9.28'
@@ -68,7 +78,7 @@ jobs:
 
           gh pr create --fill ${{ inputs.pr_options }}
         env:
-          GH_TOKEN: ${{ secrets.BUMP_SENTRY_TOKEN }}
+          GH_TOKEN: ${{ steps.getsentry.outputs.token }}
           PACKAGE: ${{ inputs.package }}
           VERSION: ${{ inputs.version }}
           SENDER: ${{ github.event.sender.login }}
diff --git a/.github/workflows/fast-revert.yml b/.github/workflows/fast-revert.yml
index 32469edf2a49..0c7d12c04fc0 100644
--- a/.github/workflows/fast-revert.yml
+++ b/.github/workflows/fast-revert.yml
@@ -10,7 +10,7 @@ on:
         required: true
         description: '`name <email>` for triggering user'
 
-# disable all permissions -- we use the PAT's permissions instead
+# Disable the default token permissions; the GitHub App token below supplies access.
 permissions: {}
 
 jobs:
@@ -19,22 +19,35 @@ jobs:
     if: |
       github.event_name == 'workflow_dispatch' || github.event.label.name == 'Trigger: Revert'
     steps:
+      - name: getsentry token
+        id: getsentry
+        uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
+        with:
+          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
-          token: ${{ secrets.BUMP_SENTRY_TOKEN }}
+          token: ${{ steps.getsentry.outputs.token }}
       - uses: getsentry/action-fast-revert@35b4b6c1f8f91b5911159568b3b15e531b5b8174 # v2.0.1
         with:
           pr: ${{ github.event.number || github.event.inputs.pr }}
           co_authored_by: ${{ github.event.inputs.co_authored_by || format('{0} <{1}+{0}@users.noreply.github.com>', github.event.sender.login, github.event.sender.id) }}
           committer_name: getsentry-bot
           committer_email: bot@sentry.io
-          token: ${{ secrets.BUMP_SENTRY_TOKEN }}
+          token: ${{ steps.getsentry.outputs.token }}
       - name: comment on failure
+        env:
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_RUN_ID: ${{ github.run_id }}
+          REPOSITORY_ID: ${{ github.event.repository.id }}
+          ISSUE_NUMBER: ${{ github.event.number || github.event.inputs.pr }}
+          GITHUB_TOKEN: ${{ steps.getsentry.outputs.token }}
         run: |
           curl \
               --silent \
               -X POST \
-              -H 'Authorization: token ${{ secrets.BUMP_SENTRY_TOKEN }}' \
-              -d'{"body": "revert failed (conflict? already reverted?) -- [check the logs](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})"}' \
-              https://api.github.com/repositories/${{ github.event.repository.id }}/issues/${{ github.event.number || github.event.inputs.pr }}/comments
+              -H "Authorization: token $GITHUB_TOKEN" \
+              -d"{\"body\": \"revert failed (conflict? already reverted?) -- [check the logs](https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID)\"}" \
+              "https://api.github.com/repositories/$REPOSITORY_ID/issues/$ISSUE_NUMBER/comments"
         if: failure()
diff --git a/.github/workflows/react-to-product-owners-yml-changes.yml b/.github/workflows/react-to-product-owners-yml-changes.yml
index 750aadfb6d34..a036e61480bf 100644
--- a/.github/workflows/react-to-product-owners-yml-changes.yml
+++ b/.github/workflows/react-to-product-owners-yml-changes.yml
@@ -9,7 +9,16 @@ jobs:
     runs-on: ubuntu-latest
     name: React to product-owners.yml changes
     steps:
+      - name: getsentry token
+        id: getsentry
+        uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
+        with:
+          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          token: ${{ steps.getsentry.outputs.token }}
 
       - uses: astral-sh/setup-uv@884ad927a57e558e7a70b92f2bccf9198a4be546 # v6
         with:
@@ -25,7 +34,7 @@ jobs:
       - name: React to product-owners.yml changes
         shell: bash
         env:
-          GITHUB_TOKEN: ${{ secrets.BUMP_SENTRY_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.getsentry.outputs.token }}
           COMMITTER_NAME: getsentry-bot
           COMMITTER_EMAIL: bot@sentry.io
         run: |

From 25cded754795e7a9140463df77420d16b1ed0a3c Mon Sep 17 00:00:00 2001
From: Joshua Li <joshuarli98@gmail.com>
Date: Fri, 28 Aug 2026 12:05:11 -0700
Subject: [PATCH 2/7] address comment

---
 .github/workflows/bump-version.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index 456726c5cc9a..25310acb7a86 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -12,7 +12,7 @@ on:
       pr_options:
         type: string
         default: ''
-        description: additional options for gh pr create, such as for asking for specific reviewers
+        description: space-delimited additional options for gh pr create, such as asking for specific reviewers
 
   # for use in other (cron/scheduled) workflows to bump specific
   # company-internal dependencies on a more aggressive schedule
@@ -76,10 +76,17 @@ jobs:
 
           git push origin HEAD --quiet
 
-          gh pr create --fill ${{ inputs.pr_options }}
+          # Keep caller-provided options as arguments rather than interpolating them into shell source.
+          if [[ -n "$PR_OPTIONS" ]]; then
+            read -r -a PR_OPTION_ARGS <<< "$PR_OPTIONS"
+            gh pr create --fill "${PR_OPTION_ARGS[@]}"
+          else
+            gh pr create --fill
+          fi
         env:
           GH_TOKEN: ${{ steps.getsentry.outputs.token }}
           PACKAGE: ${{ inputs.package }}
           VERSION: ${{ inputs.version }}
+          PR_OPTIONS: ${{ inputs.pr_options }}
           SENDER: ${{ github.event.sender.login }}
           SENDER_ID: ${{ github.event.sender.id }}

From ad030e3d0ce3b64cd8fd5f43a148d75bb358eec5 Mon Sep 17 00:00:00 2001
From: Joshua Li <joshuarli98@gmail.com>
Date: Fri, 28 Aug 2026 12:12:01 -0700
Subject: [PATCH 3/7] switch to release bot app

---
 .github/workflows/backend.yml                        | 12 ++++++------
 .github/workflows/bump-sentry-in-getsentry.yml       |  4 ++--
 .github/workflows/bump-version.yml                   |  6 +++---
 .github/workflows/fast-revert.yml                    |  4 ++--
 .github/workflows/getsentry-dispatch.yml             |  4 ++--
 .github/workflows/pre-commit.yml                     |  6 +++---
 .../react-to-product-owners-yml-changes.yml          |  4 ++--
 .github/workflows/sentry-pull-request-bot.yml        |  4 ++--
 8 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml
index 70da1409204f..fe6b945690e4 100644
--- a/.github/workflows/backend.yml
+++ b/.github/workflows/backend.yml
@@ -426,8 +426,8 @@ jobs:
         id: token
         continue-on-error: true
         with:
-          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
-          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
+          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
@@ -465,8 +465,8 @@ jobs:
       - uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         id: token
         with:
-          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
-          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
+          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
@@ -602,8 +602,8 @@ jobs:
         id: token
         continue-on-error: true
         with:
-          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
-          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
+          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
       # only if `mypy` succeeds should we try and trim the blocklist
       - run: python3 -m tools.mypy_helpers.make_module_ignores
diff --git a/.github/workflows/bump-sentry-in-getsentry.yml b/.github/workflows/bump-sentry-in-getsentry.yml
index 0d016431fa0e..effeb92e08e5 100644
--- a/.github/workflows/bump-sentry-in-getsentry.yml
+++ b/.github/workflows/bump-sentry-in-getsentry.yml
@@ -23,8 +23,8 @@ jobs:
         id: getsentry
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         with:
-          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
-          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
+          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
       - name: checkout
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index 25310acb7a86..b4a9e52840ec 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -28,7 +28,7 @@ on:
         type: string
         default: ''
     secrets:
-      SENTRY_INTERNAL_APP_PRIVATE_KEY:
+      SENTRY_RELEASE_BOT_PRIVATE_KEY:
         required: true
 
 # Disable the default token permissions; the GitHub App token below supplies access.
@@ -42,8 +42,8 @@ jobs:
         id: getsentry
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         with:
-          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
-          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
+          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
diff --git a/.github/workflows/fast-revert.yml b/.github/workflows/fast-revert.yml
index 0c7d12c04fc0..85a89572744d 100644
--- a/.github/workflows/fast-revert.yml
+++ b/.github/workflows/fast-revert.yml
@@ -23,8 +23,8 @@ jobs:
         id: getsentry
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         with:
-          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
-          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
+          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
diff --git a/.github/workflows/getsentry-dispatch.yml b/.github/workflows/getsentry-dispatch.yml
index e42bc5c6b31b..2a003e0cba0a 100644
--- a/.github/workflows/getsentry-dispatch.yml
+++ b/.github/workflows/getsentry-dispatch.yml
@@ -60,8 +60,8 @@ jobs:
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         id: getsentry
         with:
-          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
-          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
+          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
       - name: Wait for PR merge commit
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index be35bfe77674..15a1cf1cb65f 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -23,7 +23,7 @@ env:
   SEGMENT_DOWNLOAD_TIMEOUT_MINS: 3
   # workaround: secrets cannot be directly referenced in `if`
   # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets
-  SECRET_ACCESS: ${{toJSON(secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY != null)}}
+  SECRET_ACCESS: ${{toJSON(secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY != null)}}
 
 jobs:
   lint:
@@ -39,8 +39,8 @@ jobs:
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         id: token
         with:
-          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
-          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
+          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Get changed files
         id: changes
diff --git a/.github/workflows/react-to-product-owners-yml-changes.yml b/.github/workflows/react-to-product-owners-yml-changes.yml
index a036e61480bf..d4ddfa985676 100644
--- a/.github/workflows/react-to-product-owners-yml-changes.yml
+++ b/.github/workflows/react-to-product-owners-yml-changes.yml
@@ -13,8 +13,8 @@ jobs:
         id: getsentry
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         with:
-          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
-          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
+          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
diff --git a/.github/workflows/sentry-pull-request-bot.yml b/.github/workflows/sentry-pull-request-bot.yml
index 8ff4d72199ff..ad2ca3bedce2 100644
--- a/.github/workflows/sentry-pull-request-bot.yml
+++ b/.github/workflows/sentry-pull-request-bot.yml
@@ -45,8 +45,8 @@ jobs:
         id: getsentry
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         with:
-          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
-          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
+          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
       - name: Wait for PR merge commit
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0

From 468b9777c53ed119b474b86b79a455c1b0c5fc6c Mon Sep 17 00:00:00 2001
From: Joshua Li <joshuarli98@gmail.com>
Date: Fri, 28 Aug 2026 12:15:15 -0700
Subject: [PATCH 4/7] restore SENTRY_INTERNAL_APP_ID and
 SENTRY_INTERNAL_APP_PRIVATE_KEY to where it was working before

---
 .github/workflows/backend.yml                        | 12 ++++++------
 .github/workflows/fast-revert.yml                    |  4 ++--
 .github/workflows/getsentry-dispatch.yml             |  4 ++--
 .github/workflows/pre-commit.yml                     |  6 +++---
 .../react-to-product-owners-yml-changes.yml          |  4 ++--
 .github/workflows/sentry-pull-request-bot.yml        |  4 ++--
 6 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml
index fe6b945690e4..70da1409204f 100644
--- a/.github/workflows/backend.yml
+++ b/.github/workflows/backend.yml
@@ -426,8 +426,8 @@ jobs:
         id: token
         continue-on-error: true
         with:
-          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
@@ -465,8 +465,8 @@ jobs:
       - uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         id: token
         with:
-          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
@@ -602,8 +602,8 @@ jobs:
         id: token
         continue-on-error: true
         with:
-          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
 
       # only if `mypy` succeeds should we try and trim the blocklist
       - run: python3 -m tools.mypy_helpers.make_module_ignores
diff --git a/.github/workflows/fast-revert.yml b/.github/workflows/fast-revert.yml
index 85a89572744d..0c7d12c04fc0 100644
--- a/.github/workflows/fast-revert.yml
+++ b/.github/workflows/fast-revert.yml
@@ -23,8 +23,8 @@ jobs:
         id: getsentry
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         with:
-          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
diff --git a/.github/workflows/getsentry-dispatch.yml b/.github/workflows/getsentry-dispatch.yml
index 2a003e0cba0a..e42bc5c6b31b 100644
--- a/.github/workflows/getsentry-dispatch.yml
+++ b/.github/workflows/getsentry-dispatch.yml
@@ -60,8 +60,8 @@ jobs:
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         id: getsentry
         with:
-          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
 
       - name: Wait for PR merge commit
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 15a1cf1cb65f..be35bfe77674 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -23,7 +23,7 @@ env:
   SEGMENT_DOWNLOAD_TIMEOUT_MINS: 3
   # workaround: secrets cannot be directly referenced in `if`
   # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets
-  SECRET_ACCESS: ${{toJSON(secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY != null)}}
+  SECRET_ACCESS: ${{toJSON(secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY != null)}}
 
 jobs:
   lint:
@@ -39,8 +39,8 @@ jobs:
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         id: token
         with:
-          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Get changed files
         id: changes
diff --git a/.github/workflows/react-to-product-owners-yml-changes.yml b/.github/workflows/react-to-product-owners-yml-changes.yml
index d4ddfa985676..a036e61480bf 100644
--- a/.github/workflows/react-to-product-owners-yml-changes.yml
+++ b/.github/workflows/react-to-product-owners-yml-changes.yml
@@ -13,8 +13,8 @@ jobs:
         id: getsentry
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         with:
-          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
diff --git a/.github/workflows/sentry-pull-request-bot.yml b/.github/workflows/sentry-pull-request-bot.yml
index ad2ca3bedce2..8ff4d72199ff 100644
--- a/.github/workflows/sentry-pull-request-bot.yml
+++ b/.github/workflows/sentry-pull-request-bot.yml
@@ -45,8 +45,8 @@ jobs:
         id: getsentry
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         with:
-          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
 
       - name: Wait for PR merge commit
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0

From ba9894239cffebd441b25439db1abf56ec6a49d5 Mon Sep 17 00:00:00 2001
From: Joshua Li <joshuarli98@gmail.com>
Date: Fri, 28 Aug 2026 12:20:23 -0700
Subject: [PATCH 5/7] fix names

---
 .github/workflows/bump-sentry-in-getsentry.yml | 2 +-
 .github/workflows/bump-version.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/bump-sentry-in-getsentry.yml b/.github/workflows/bump-sentry-in-getsentry.yml
index effeb92e08e5..04dcd9c1f577 100644
--- a/.github/workflows/bump-sentry-in-getsentry.yml
+++ b/.github/workflows/bump-sentry-in-getsentry.yml
@@ -23,7 +23,7 @@ jobs:
         id: getsentry
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         with:
-          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
+          app_id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
           private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
       - name: checkout
diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index b4a9e52840ec..10de7fa49c9c 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -42,7 +42,7 @@ jobs:
         id: getsentry
         uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
         with:
-          app_id: ${{ vars.SENTRY_RELEASE_BOT_APP_ID }}
+          app_id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
           private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

From 04b00c084858c09b4a490d756104bd5d4832b898 Mon Sep 17 00:00:00 2001
From: Joshua Li <joshuarli98@gmail.com>
Date: Fri, 28 Aug 2026 14:20:14 -0700
Subject: [PATCH 6/7] apply feedback

---
 .../workflows/bump-sentry-in-getsentry.yml    | 10 +++++++---
 .github/workflows/bump-version.yml            |  6 +++---
 .github/workflows/fast-revert.yml             | 20 +++++++++----------
 .../react-to-product-owners-yml-changes.yml   |  6 +++---
 4 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/bump-sentry-in-getsentry.yml b/.github/workflows/bump-sentry-in-getsentry.yml
index 04dcd9c1f577..e11319383752 100644
--- a/.github/workflows/bump-sentry-in-getsentry.yml
+++ b/.github/workflows/bump-sentry-in-getsentry.yml
@@ -21,10 +21,14 @@ jobs:
     steps:
       - name: getsentry token
         id: getsentry
-        uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app_id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
-          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+          client-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: |
+            sentry
+            getsentry
 
       - name: checkout
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index 10de7fa49c9c..3848bcb0f4bd 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -40,10 +40,10 @@ jobs:
     steps:
       - name: getsentry token
         id: getsentry
-        uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app_id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
-          private_key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+          client-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
diff --git a/.github/workflows/fast-revert.yml b/.github/workflows/fast-revert.yml
index 0c7d12c04fc0..d804e2b2ba61 100644
--- a/.github/workflows/fast-revert.yml
+++ b/.github/workflows/fast-revert.yml
@@ -19,30 +19,30 @@ jobs:
     if: |
       github.event_name == 'workflow_dispatch' || github.event.label.name == 'Trigger: Revert'
     steps:
-      - name: getsentry token
-        id: getsentry
-        uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
+      - name: fast-revert bot token
+        id: fast-revert-bot-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
-          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.SENTRY_FAST_REVERT_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.SENTRY_FAST_REVERT_BOT_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
-          token: ${{ steps.getsentry.outputs.token }}
+          token: ${{ steps.fast-revert-bot-token.outputs.token }}
       - uses: getsentry/action-fast-revert@35b4b6c1f8f91b5911159568b3b15e531b5b8174 # v2.0.1
         with:
           pr: ${{ github.event.number || github.event.inputs.pr }}
           co_authored_by: ${{ github.event.inputs.co_authored_by || format('{0} <{1}+{0}@users.noreply.github.com>', github.event.sender.login, github.event.sender.id) }}
-          committer_name: getsentry-bot
-          committer_email: bot@sentry.io
-          token: ${{ steps.getsentry.outputs.token }}
+          committer_name: sentry-fast-revert-bot[bot]
+          committer_email: 322273150+sentry-fast-revert-bot[bot]@users.noreply.github.com
+          token: ${{ steps.fast-revert-bot-token.outputs.token }}
       - name: comment on failure
         env:
           GITHUB_REPOSITORY: ${{ github.repository }}
           GITHUB_RUN_ID: ${{ github.run_id }}
           REPOSITORY_ID: ${{ github.event.repository.id }}
           ISSUE_NUMBER: ${{ github.event.number || github.event.inputs.pr }}
-          GITHUB_TOKEN: ${{ steps.getsentry.outputs.token }}
+          GITHUB_TOKEN: ${{ steps.fast-revert-bot-token.outputs.token }}
         run: |
           curl \
               --silent \
diff --git a/.github/workflows/react-to-product-owners-yml-changes.yml b/.github/workflows/react-to-product-owners-yml-changes.yml
index a036e61480bf..993976ef2f26 100644
--- a/.github/workflows/react-to-product-owners-yml-changes.yml
+++ b/.github/workflows/react-to-product-owners-yml-changes.yml
@@ -11,10 +11,10 @@ jobs:
     steps:
       - name: getsentry token
         id: getsentry
-        uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
-          private_key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
+          app-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
+          private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:

From 02e2b0edd8bcd2dfc5349cf78b04966f501d40bb Mon Sep 17 00:00:00 2001
From: Joshua Li <joshuarli98@gmail.com>
Date: Fri, 28 Aug 2026 14:33:19 -0700
Subject: [PATCH 7/7] env fast-revert

---
 .github/workflows/fast-revert.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/fast-revert.yml b/.github/workflows/fast-revert.yml
index d804e2b2ba61..0a316e10fb53 100644
--- a/.github/workflows/fast-revert.yml
+++ b/.github/workflows/fast-revert.yml
@@ -16,6 +16,7 @@ permissions: {}
 jobs:
   revert:
     runs-on: ubuntu-latest
+    environment: fast-revert
     if: |
       github.event_name == 'workflow_dispatch' || github.event.label.name == 'Trigger: Revert'
     steps: