Add Sentry integration for error reporting

.config/rollup.dist.config.mjs

@@ -3,9 +3,12 @@ import {
   existsSync,
   mkdirSync,
   rmSync,
-  writeFileSync
+  writeFileSync,
+  readFileSync
 } from 'node:fs'
 import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { randomUUID } from 'node:crypto'
 
 import { globSync as tinyGlobSync } from 'tinyglobby'
 
@@ -26,6 +29,7 @@ import {
   isBuiltin,
   normalizeId
 } from '../scripts/utils/packages.js'
+import { envAsBoolean } from '@socketsecurity/registry/lib/env'
 
 const {
   BABEL_RUNTIME,
@@ -52,6 +56,10 @@ const editablePkgJson = readPackageJsonSync(rootPath, { editable: true })
 
 const processEnvTapRegExp =
   /\bprocess\.env(?:\.TAP|\[['"]TAP['"]\])(\s*\?[^:]+:\s*)?/g
+const processEnvSocketIsPublishedRegExp =
+  /\bprocess\.env(?:\.SOCKET_IS_PUBLISHED|\[['"]SOCKET_IS_PUBLISHED['"]\])/g
+const processEnvSocketCliVersionRegExp =
+  /\bprocess\.env(?:\.SOCKET_CLI_VERSION|\[['"]SOCKET_CLI_VERSION['"]\])/g
 
 function createStubCode(relFilepath) {
   return `'use strict'\n\nmodule.exports = require('${relFilepath}')\n`
@@ -122,6 +130,32 @@ function updateDepStatsSync(depStats) {
     .saveSync()
 }
 
+function versionBanner(_chunk) {
+  let pkgJsonVersion = 'unknown';
+  try { pkgJsonVersion = JSON.parse(readFileSync('package.json', 'utf8'))?.version ?? 'unknown' } catch {}
+
+  let gitHash = ''
+  try {
+    const obj = spawnSync('git', ['rev-parse','--short', 'HEAD']);
+    if (obj.stdout) {
+      gitHash = obj.stdout.toString('utf8').trim()
+    }
+  } catch {}
+
+  // Make each build generate a unique version id, regardless
+  // Mostly for development: confirms the build refreshed. For prod
+  // builds the git hash should suffice to identify the build.
+  const rng = randomUUID().split('-')[0];
+
+  return `
+    var SOCKET_CLI_PKG_JSON_VERSION = "${pkgJsonVersion}"
+    var SOCKET_CLI_GIT_HASH = "${gitHash}"
+    var SOCKET_CLI_BUILD_RNG = "${rng}"
+    var SOCKET_CLI_VERSION = "${pkgJsonVersion}:${gitHash}:${rng}"
+    var SOCKET_PUB = ${envAsBoolean(process.env['SOCKET_IS_PUBLISHED'])}
+  `.trim().split('\n').map(s => s.trim()).join('\n')
+}
+
 export default () => {
   const moduleSyncConfig = baseConfig({
     input: {
@@ -132,12 +166,15 @@ export default () => {
     },
     output: [
       {
+        intro: versionBanner, // Note: "banner" would defeat "use strict"
         dir: path.relative(rootPath, distModuleSyncPath),
         entryFileNames: '[name].js',
         exports: 'auto',
         externalLiveBindings: false,
         format: 'cjs',
-        freeze: false
+        freeze: false,
+        sourcemap: true,
+        sourcemapDebugIds: true,
       }
     ],
     external(id_) {
@@ -182,12 +219,15 @@ export default () => {
     },
     output: [
       {
+        intro: versionBanner, // Note: "banner" would defeat "use strict"
         dir: path.relative(rootPath, distRequirePath),
         entryFileNames: '[name].js',
         exports: 'auto',
         externalLiveBindings: false,
         format: 'cjs',
-        freeze: false
+        freeze: false,
+        sourcemap: true,
+        sourcemapDebugIds: true,
       }
     ],
     plugins: [
@@ -197,6 +237,19 @@ export default () => {
         find: processEnvTapRegExp,
         replace: (_match, ternary) => (ternary ? '' : 'false')
       }),
+      // Replace `process.env.SOCKET_IS_PUBLISHED` with a boolean
+      socketModifyPlugin({
+        find: processEnvSocketIsPublishedRegExp,
+        // Note: these are going to be bools in JS, not strings
+        replace: () => (envAsBoolean(process.env['SOCKET_IS_PUBLISHED']) ? 'true' : 'false')
+      }),
+      // Replace `process.env.SOCKET_CLI_VERSION` with var ref that rollup
+      // adds to the top of each file.
+      socketModifyPlugin({
+        find: processEnvSocketCliVersionRegExp,
+        replace: 'SOCKET_CLI_VERSION'
+      }),
+
       {
         generateBundle(_options, bundle) {
           for (const basename of Object.keys(bundle)) {

.dep-stats.json

@@ -4,6 +4,7 @@
     "@cyclonedx/cdxgen": "^11.1.8",
     "@npmcli/promise-spawn": "^8.0.2",
     "@octokit/rest": "^21.1.1",
+    "@sentry/node": "9.1.0",
     "@socketregistry/hyrious__bun.lockb": "^1.0.12",
     "@socketregistry/indent-string": "^1.0.9",
     "@socketregistry/is-interactive": "^1.0.1",
@@ -67,6 +68,7 @@
   "external": {
     "@apideck/better-ajv-errors": "^0.3.6",
     "@npmcli/promise-spawn": "^8.0.2",
+    "@sentry/node": "9.1.0",
     "blessed": "^0.1.81",
     "blessed-contrib": "^4.11.0",
     "browserslist": "4.24.4",

.github/workflows/provenance.yml

@@ -21,7 +21,7 @@ jobs:
           scope: "@socketsecurity"
       - run: npm install -g npm@latest
       - run: npm ci
-      - run: npm run build:dist
+      - run: SOCKET_IS_PUBLISHED=1 npm run build:dist
       - run: npm publish --provenance --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}