From 194032d8ef67a3f90b0b9cdce75b8a5dc39c4a53 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Mon, 27 Jul 2026 13:02:48 +0000
Subject: [PATCH] =?UTF-8?q?fix(upgrade):=20nightly=20discovery=20hits=20wr?=
 =?UTF-8?q?ong=20GHCR=20package=20(silent=20404=20=E2=86=92=20full-downloa?=
 =?UTF-8?q?d=20fallback)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR #1298 (binpatch adoption) introduced a local copy of the GHCR repo
constant, \`GITHUB_REPO_REPO_NAME = "getsentry/sentry-cli"\`. CI publishes
nightlies to \`ghcr.io/getsentry/cli\` (see src/lib/ghcr.ts GHCR_REPO and
the oras push lines in .github/workflows/ci.yml:676, 683). The wrong
package hit a 404 on every nightly discovery, and the silent error
handler fell back to a full binary download — nightly delta upgrades
have been broken since the merge.

Reported by Cursor Bugbot + sentry[bot] as HIGH severity on PR #1298.

Fix: import \`GHCR_REPO\` from ./ghcr.js (single source of truth, already
verified against the CI publish destination). Drop the duplicate local
constant; \`nightlySource()\` and the test-only \`resolveNightlyChain()\`
now both use the canonical value.
---
 src/lib/delta-upgrade.ts | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/lib/delta-upgrade.ts b/src/lib/delta-upgrade.ts
index 66cae084d..03ab137a8 100644
--- a/src/lib/delta-upgrade.ts
+++ b/src/lib/delta-upgrade.ts
@@ -41,6 +41,7 @@ import { CLI_VERSION } from "./constants.js";
 import { customFetch } from "./custom-ca.js";
 import { getConfigDir } from "./db/index.js";
 import { formatBytes } from "./formatters/numbers.js";
+import { GHCR_REPO } from "./ghcr.js";
 import { logger } from "./logger.js";
 import { makeByteProgress, type SetMessage } from "./progress.js";
 import { withTracing, withTracingSpan } from "./telemetry.js";
@@ -67,7 +68,9 @@ export type DeltaResult = {
   chainLength: number;
 };
 
-const GITHUB_REPO_REPO_NAME = "getsentry/sentry-cli";
+// GHCR publishes nightlies to ghcr.io/getsentry/cli (see src/lib/ghcr.ts
+// GHCR_REPO). Importing as a named import keeps a single source of truth and
+// avoids the silent 404 introduced when this was a string literal.
 const log = logger.withTag("delta-upgrade");
 
 const instrument: InstrumentHook = (name, fn) =>
@@ -129,7 +132,7 @@ function stableSource(): SourceStrategy {
 function nightlySource(): SourceStrategy {
   return ghcrSource({
     registry: "https://ghcr.io",
-    repo: GITHUB_REPO_REPO_NAME,
+    repo: GHCR_REPO,
     binaryName: getPlatformBinaryName(),
     targetTag: (version) => `nightly-${version}`,
     compareVersions,
@@ -274,7 +277,7 @@ export async function resolveNightlyChain(opts: {
 }): Promise<PatchChain | null> {
   const client = new OciClient({
     registry: "https://ghcr.io",
-    repo: GITHUB_REPO_REPO_NAME,
+    repo: GHCR_REPO,
     userAgent: `sentry-cli/${CLI_VERSION}`,
     fetch: customFetch,
   });