Skip to content

fix(publish): distinguish auth failures from merge conflicts in post-publish merge#788

Merged
BYK merged 5 commits intomasterfrom
fix/post-publish-merge-auth-diagnosis
Apr 1, 2026
Merged

fix(publish): distinguish auth failures from merge conflicts in post-publish merge#788
BYK merged 5 commits intomasterfrom
fix/post-publish-merge-auth-diagnosis

Conversation

@BYK
Copy link
Copy Markdown
Member

@BYK BYK commented Mar 31, 2026

Summary

  • Add isAuthError() helper that detects git authentication failures (expired tokens, credential prompting errors, HTTP 401/403) vs merge conflicts
  • Update the post-publish merge warning to provide an accurate diagnosis: "expired authentication token" for auth failures vs "merge conflict" for everything else
  • Add tests for the new helper covering both positive and negative cases

Context

The post-publish merge warning always blamed merge conflicts, even when the actual cause was an expired GitHub App token — common for publishes exceeding the 1-hour token lifetime (e.g., sentry-native's ~1h 23m publish). The misleading message made it harder to diagnose what went wrong.

The publish itself succeeds in these cases — only the housekeeping merge step fails. This change improves the diagnostic message so operators can quickly identify token expiration vs actual merge conflicts.

Note: Preventing the token expiration itself requires changes in the getsentry/publish workflow (e.g., refreshing the token after the Docker container exits). That is out of scope for this PR.

…publish merge

The post-publish merge warning always assumed merge conflicts, even when
the real cause was an expired GitHub App token (common for publishes
exceeding the 1-hour token lifetime, e.g. sentry-native).

Add an isAuthError() helper that pattern-matches git credential errors
and use it to provide an accurate diagnosis in the warning message.
@BYK BYK marked this pull request as ready for review April 1, 2026 13:03
Copy link
Copy Markdown
Contributor

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

…or/PushError

Classify errors deterministically by WHERE they occur in
handleReleaseBranch, not by pattern-matching the message:

- Merge fails (both ort + resolve strategies): throws MergeConflictError
  with the list of conflicted files from git status
- Push fails after successful merge: throws PushError

The caller uses instanceof to provide targeted diagnostics:
- MergeConflictError: lists the conflicting files
- PushError: explains the merge succeeded but push failed (likely
  expired token)
Capture git diff of conflicted files before aborting the failed merge.
The diff shows the actual conflict markers (<<<<<<< / ======= / >>>>>>>)
so operators can see exactly what conflicted without having to reproduce
the merge locally.
@BYK BYK merged commit f081abe into master Apr 1, 2026
18 checks passed
@BYK BYK deleted the fix/post-publish-merge-auth-diagnosis branch April 1, 2026 14:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant