fix(ci): stamp Sentry debug IDs during the build so uploaded source maps match the deployed bundles

.github/workflows/ci.yml

@@ -46,7 +46,15 @@ jobs:
       - name: Install dependencies
         run: pnpm install
 
+      # The Sentry plugin stamps debug ids into the bundles here, and uploads the source maps
+      # too, but only when it gets a token. Withholding the token everywhere except `main` and
+      # manual runs is what keeps PR builds from uploading: they inject and stay quiet.
       - name: Build application
+        env:
+          SENTRY_AUTH_TOKEN: ${{ (github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch') && secrets.SENTRY_AUTH_TOKEN || '' }}
+          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
+          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
+          SENTRY_URL: ${{ secrets.SENTRY_URL }}
         run: NUXT_APP_COMMIT_ID=$(git rev-parse --short HEAD) pnpm run build
 
       - name: Upload build artifacts
@@ -396,42 +404,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
   # ============================================
-  # JOB 5: Sentry - upload source maps (automatic on main, manual on any branch)
-  # ============================================
-  sentry:
-    needs: [quality_and_test, e2e]
-    runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Download build artifacts
-        uses: actions/download-artifact@v8
-        with:
-          name: build-output
-          path: .output
-
-      - name: Set version
-        id: version
-        run: |
-          echo "short=${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT
-
-      - name: Create Sentry release
-        uses: getsentry/action-release@v3
-        env:
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
-          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
-          SENTRY_URL: ${{ secrets.SENTRY_URL }}
-        with:
-          sourcemaps: ".output/public/_nuxt"
-          url_prefix: "~/_nuxt"
-          environment: ${{ github.ref_name }}
-          version: ${{ steps.version.outputs.short }}
-          ignore_missing: true
-
-  # ============================================
-  # JOB 6: Publish datagouv-components (automatic on main, manual on any branch)
+  # JOB 5: Publish datagouv-components (automatic on main, manual on any branch)
   # ============================================
   publish-datagouv-components:
     needs: [quality_and_test, e2e]

nuxt.config.ts

@@ -408,11 +408,20 @@ export default defineNuxtConfig({
       xl: 1248,
     },
   },
+  // The bundler plugin stamps a debug id into every chunk and the same id into the copies it
+  // uploads, so Sentry pairs a frame with its map by identity instead of by release and URL.
+  // It does that during `renderChunk`, which is the only moment it can: Nitro records each
+  // asset's size and pre-compresses it at the end of the build, so anything rewriting
+  // `.output/public` afterwards serves a truncated script and a stale `.br`.
+  // The upload rides along and needs an auth token, which the CI only hands to `main` builds.
   sentry: {
-    sourceMapsUploadOptions: {
-      // disable sourcemaps upload from build, it's done later during the release with sentry-cli
-      enabled: false,
+    release: {
+      // Has to match what the SDK reports at runtime (`appConfig.commitId`), otherwise the
+      // plugin falls back to the full git sha and the two never line up.
+      name: process.env.NUXT_APP_COMMIT_ID,
+      deploy: process.env.GITHUB_REF_NAME ? { env: process.env.GITHUB_REF_NAME } : undefined,
     },
+    telemetry: false,
   },
 
   sitemap: {
@@ -431,6 +440,4 @@ export default defineNuxtConfig({
 
     // TODO: add /support pages
   },
-  // TODO: add sentry config for stack traces based on source maps
-  // https://docs.sentry.io/platforms/javascript/guides/nuxt/#add-readable-stack-traces-to-errors
 })