[sentry-junior]

DESCRIBE YOUR PR

The Bump API Schema SHA workflow got rate-limited by the GitHub API and wrote the error body ({"message":"API rate limit exceeded for ..."}) into SENTRY_API_SCHEMA_SHA. It then admin-merged the change (#19999). That broke master for about 10 minutes, until the next run (#20000) replaced it with a real SHA.

The workflow called the commits API without authentication and never checked what came back. It now:

• Sends the GitHub App token it already creates. That token has access to sentry-api-schema, so the request gets the much higher authenticated rate limit.
• Uses curl --fail, so an HTTP error fails the job instead of returning the error body.
• Fails the job unless the response is a 40-character hex SHA, so nothing else gets written into the file or merged.

It also fixes -sSl to -sSL. Lowercase -l is curl's FTP --list-only flag; -L follows redirects, which is what was meant.

IS YOUR CHANGE URGENT?

• No deadline: Not urgent, can wait up to 1 week+

PRE-MERGE CHECKLIST

• Checked Vercel preview for correctness, including links
• PR was reviewed and approved by any necessary SMEs (subject matter experts)
• PR was reviewed and approved by a member of the Sentry docs team

via @sergical.

--

View Junior Session [Sentry]

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
develop-docs	Ready	Preview	Oct 15, 2026 6:15pm UTC
sentry-docs	Ready	Preview	Oct 15, 2026 6:15pm UTC

[cursor]

The bump job now fails when GitHub does not return a commit SHA. It does not write an error body into the schema pin. The plan checks API page errors, API page views, and client errors. An issue escalates when API page errors rise or API page views fall.

Rollout complete

Services: sentry-docs.

Plan

What changed

The bump job authenticates the GitHub request for the latest API schema commit. It fails on HTTP errors. It rejects a value that is not a 40-character hex SHA. The job no longer writes an API error body into the schema pin.

sentry-docs must receive this commit. The workflow file becomes live on the default branch. The Vercel site build does not read this workflow file. Page behavior does not change on this deploy. Deploy config maps the Vercel project to sentry-docs.

Risk

If the new rules are too strict, the bump job fails. API reference pages then stop receiving schema updates.

If the new rules are too weak, a non-SHA value can merge again. The production build then fails. API reference pages can go missing until a later good pin.

The OpenAPI fetch runs at build time. A bad pin fails the build. Browser clients do not fetch that schema. The live site can stay on the last good deploy. Client errors may not rise in that case.

Intended effect

This change has no queryable production effect. Site event data does not record GitHub Actions job results.

absent cannot be proven from site telemetry. A healthy site deploy does not mean the bump job now validates SHAs.

The executor needs the next Bump API Schema SHA run. That run must not merge a non-SHA pin. That job surface is not connected. See Not observable.

Regression watch

Watch the API reference path this pin feeds. Watch overall client errors on the same ship. A later bad pin fails the build. The live site can stay on the last good deploy. API page views falling is the miss users feel. Traces are sampled at 30%.

Signal	Baseline	Window	Rule	Source
API page error share	0.29% last 24h (2 errors / 690 views). 0.40% prior 24h (3 / 757). Counts 0-3 per calendar day in the last 2d.	2026-10-13T14:46:00Z to 2026-10-15T14:46:00Z	Hold in 0.0-0.7% and 0-5 errors per 24h while views hold. Escalate if the share rises above 0.7% or errors rise above 5.	Sentry org sentry project docs. Errors: environment:production AND (transaction:*/api/* OR url:*/api/*) with count(). Views: environment:production AND span.op:[pageload,navigation] AND http.url:"*/api/*" with count().
API page views	690 last 24h. 757 prior 24h. 7d mean 664 (4650 / 7).	Last 24h 2026-10-14T14:46:00Z to 2026-10-15T14:46:00Z. Prior 24h 2026-10-13T14:46:00Z to 2026-10-14T14:46:00Z. 7d 2026-10-08T14:46:00Z to 2026-10-15T14:46:00Z.	Hold in 660-760 pageload and navigation spans per 24h. Escalate if volume falls below 660.	Sentry org sentry project docs. environment:production AND span.op:[pageload,navigation] AND http.url:"*/api/*" with count().
Client error share	2.86% last 24h (295 errors / 10313 pageloads). 1.27% prior 24h (134 / 10534). Calendar days 12-14 Oct were 190, 162, 165 errors. 11 Oct had 11240 errors. Treat that day as a spike, not the band.	Last 24h 2026-10-14T14:46:00Z to 2026-10-15T14:46:00Z. Prior 24h 2026-10-13T14:46:00Z to 2026-10-14T14:46:00Z. 7d daily 2026-10-08T00:00:00Z to 2026-10-15T14:46:00Z.	Hold in 1.2-2.9%. Escalate if the share rises above 2.9% while pageloads hold, or if daily errors rise above 360, or if a 10k-class spike returns.	Sentry org sentry project docs. Errors: environment:production with count(). Pageloads: span.op:pageload environment:production with count().
Production pageloads	10313 last 24h. 10534 prior 24h.	Last 24h 2026-10-14T14:46:00Z to 2026-10-15T14:46:00Z. Prior 24h 2026-10-13T14:46:00Z to 2026-10-14T14:46:00Z.	Hold in 10300-10600. Escalate if volume falls below 10300. These two weekday windows may not match weekend traffic.	Sentry org sentry project docs. span.op:pageload environment:production with count().

Not observable

GitHub Actions Bump API Schema SHA success and fail-closed logs. Whether a merged schema pin is a 40-character hex SHA.

Vercel production build failure on a later bad pin. Site telemetry can stay green on the last good deploy.

Stale API reference content when the bump job stops. Freshness has no connected signal.