fix(ci): wire Sentry DSN + auth token into the Android release build (#209)

[thomasluizon]

What

Wire mobile Sentry into the Android release build. #241 added the @sentry/react-native SDK + the app.json config plugin, but never fed EXPO_PUBLIC_SENTRY_DSN into android-release.yml — and that workflow (expo prebuild + gradlew bundleRelease, not eas build) is the actual release path. So shipped builds carried no DSN, initSentry() no-op'd, and mobile error tracking was silently off. Same wiring class as #232 (env not reaching the real bundle step).

Changes

• .github/workflows/android-release.yml — job-level env::
  • EXPO_PUBLIC_SENTRY_DSN: ${{ vars.EXPO_PUBLIC_SENTRY_DSN }} — job-level so Metro inlines it at both prebuild and bundleRelease (the Serve REAL AdMob ads on the free plan in production (not test ads) — pre-launch #232 lesson: the bundle step's env is what ships).
  • SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} — native source-map / symbol upload at build time.
• apps/mobile/app.json — @sentry/react-native/expo plugin: added organization: thomasluizon + project: orbit-mobile so the symbol upload routes to the right project.

Non-breaking by design

• Empty vars.EXPO_PUBLIC_SENTRY_DSN → SDK no-ops (capture stays off), build unaffected.
• Empty secrets.SENTRY_AUTH_TOKEN → symbol upload is skipped, build still produces the AAB.
• Safe to merge before the values exist; nothing changes until they're configured.

Manual (to activate)

GitHub → Settings → Secrets and variables → Actions:

• Variable EXPO_PUBLIC_SENTRY_DSN = the orbit-mobile project DSN (public-by-design).
• Secret SENTRY_AUTH_TOKEN = a Sentry auth token with project:releases scope (build-only).

The next release build then captures mobile errors and uploads symbols for readable stack traces. If the Sentry project slug isn't orbit-mobile, update project in app.json to match.

Refs #209.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
orbit-ui-mobile-web	Ignored		Jun 19, 2026 10:42pm

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[claude]

Code Review: PR #244

Scope: PR #244 — fix(ci): wire Sentry DSN + auth token into the Android release build
Recommendation: APPROVE

Summary

This PR wires EXPO_PUBLIC_SENTRY_DSN and SENTRY_AUTH_TOKEN into the job-level env block of android-release.yml so Metro inlines the DSN at both prebuild and bundle time. It also adds organization and project fields to the @sentry/react-native/expo plugin config in app.json to route symbol uploads to the correct Sentry project. The fix is narrow, correct, and safe — empty env vars cause graceful no-ops in both the SDK and the upload tool.

Findings

Critical

None

High

None

Medium

[Medium] SENTRY_AUTH_TOKEN not validated in "Validate release secrets" step

• dimension: Correctness (#1)
• location: .github/workflows/android-release.yml:83-91
• issue: The REQUIRED_SECRETS allowlist gates the build early on missing blocking secrets, but SENTRY_AUTH_TOKEN is absent from it. If the token is missing, prebuild still runs and the symbol upload silently no-ops. This is intentional per the PR body, but it diverges from the validate-everything-upfront pattern.
• risk: Shipped AABs without a symbol upload produce unreadable Sentry stack traces. The silent skip is hard to notice without reading the build log.
• fix: Either add SENTRY_AUTH_TOKEN to the step's env block and REQUIRED_SECRETS array for a fast-fail experience, OR add a WHY comment on line 50 pointing to issue #209. CLAUDE.md rules 1 + 5 require a URL link for any intentional silence or workaround.
• reference: CLAUDE.md rule 1 (root cause over silent failures); CLAUDE.md rule 5 (WHY comment must link a URL)

Low / Info

[Info] EXPO_PUBLIC_SENTRY_DSN correctly classified as a CI variable, not a secret

• The DSN is public-by-design (inlined into the JS bundle and visible to anyone who decompiles the APK). Using vars. for DSN and secrets. for SENTRY_AUTH_TOKEN is the correct split. No action required.

[Info] organization + project in app.json are build-time config only

• These fields are consumed by the Sentry Expo plugin at prebuild time to write sentry.properties, which the Gradle plugin reads when invoking the Sentry CLI at bundle time. No runtime effect. No action required.

Subagents

Agent	Verdict
parity-checker	N/A — only app.json (config) and a workflow file changed; no mirrored source surface
i18n-syncer	N/A — no user-facing strings changed
contract-aligner	N/A — no packages/shared/src/types/*, endpoints.ts, or orbit-api changes
security-reviewer	N/A — no orbit-api code changed

Validation

Check	Result
Lint	N/A — YAML + JSON only
Type check	N/A — no TypeScript changed
Tests	N/A — no source code changed
Build (api)	N/A — CI/config diff only

What's good

• Correct env inheritance model. Job-level env: at line 42 flows to all steps, including the prebuild and Gradle steps that have their own additive env: blocks. No duplication needed.
• Graceful degradation by design. Absent DSN → SDK no-ops; absent auth token → symbol upload skipped, build still produces the AAB. Both verified in the PR body.
• Narrow blast radius. 5 lines across 2 files; nothing changes for existing builds until the secrets are configured.
• Consistent with web Sentry. apps/web/next.config.ts:35-36 uses SENTRY_ORG + SENTRY_PROJECT for the same symbol-upload routing; this PR brings mobile to parity.
• PR description is excellent — explains root cause, the lesson from #232, graceful-degradation contract, and manual activation steps.

Recommendation

Clean, well-scoped CI fix. The one medium finding (SENTRY_AUTH_TOKEN not guarded upfront) is low-risk and intentional — just needs a WHY comment with a URL to satisfy the comment policy, or promote it to REQUIRED_SECRETS for a fast-fail experience. Neither blocks merge. Approve.

Generated with Claude Code