From af1dc90a182e2cbbedce8cbd15036dbbd8363e3b Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 14:08:34 +0000
Subject: [PATCH] build(npm): Bump lockfile optional deps in bump-version.sh

Co-Authored-By: Daniel Szoke <7881302+szokeasaurusrex@users.noreply.github.com>
---
 .craft.yml                      |  1 -
 .github/workflows/ci.yml        |  2 --
 .github/workflows/test_node.yml | 35 ---------------------
 scripts/bump-version.sh         | 11 +++++++
 scripts/post-release.sh         | 54 ---------------------------------
 5 files changed, 11 insertions(+), 92 deletions(-)
 delete mode 100644 scripts/post-release.sh

diff --git a/.craft.yml b/.craft.yml
index 332a778e78..c97b3f83a9 100644
--- a/.craft.yml
+++ b/.craft.yml
@@ -1,6 +1,5 @@
 minVersion: 0.23.1
 changelogPolicy: auto
-postReleaseCommand: bash scripts/post-release.sh
 targets:
   - name: gcs
     bucket: sentry-sdk-assets
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6f090238ba..0fe4b136d5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,8 +30,6 @@ jobs:
   test_node:
     name: Test Node
     uses: ./.github/workflows/test_node.yml
-    with:
-      triggered-by-release: ${{ github.event_name == 'push' && startsWith(github.ref_name, 'release/') }}
 
   test_swift:
     name: Test Swift
diff --git a/.github/workflows/test_node.yml b/.github/workflows/test_node.yml
index 4f7617079d..9592b446b7 100644
--- a/.github/workflows/test_node.yml
+++ b/.github/workflows/test_node.yml
@@ -2,11 +2,6 @@ name: Test Node
 
 on:
   workflow_call:
-    inputs:
-      triggered-by-release:
-        type: boolean
-        description: Whether the workflow was triggered by a release
-        default: false
     outputs:
       matrix-result:
         description: 'Matrix job result'
@@ -25,16 +20,8 @@ jobs:
           node-version-file: package.json
 
       - name: Install dependencies via npm ci
-        if: ${{ !inputs.triggered-by-release }}
         run: npm ci --ignore-scripts
 
-      # For pushes to the release branch, we need to install the dependencies via `npm install`
-      # because the `package-lock.json` is not updated with the new versions of the optional
-      # dependencies yet. We also must skip the fallback download via --ignore-scripts.
-      - name: Install dependencies via npm install (for pushes to release branch)
-        if: ${{ inputs.triggered-by-release }}
-        run: npm install --omit=optional --ignore-scripts
-
       - run: npm run check:types
 
   prepare_build:
@@ -49,16 +36,8 @@ jobs:
           node-version-file: package.json
 
       - name: Install dependencies via npm ci
-        if: ${{ !inputs.triggered-by-release }}
         run: npm ci --ignore-scripts
 
-      # For pushes to the release branch, we need to install the dependencies via `npm install`
-      # because the `package-lock.json` is not updated with the new versions of the optional
-      # dependencies yet. We also must skip the fallback download via --ignore-scripts.
-      - name: Install dependencies via npm install (for pushes to release branch)
-        if: ${{ inputs.triggered-by-release }}
-        run: npm install --omit=optional --ignore-scripts
-
       - name: Build
         run: npm run build
 
@@ -86,22 +65,8 @@ jobs:
           node-version: ${{ matrix.node-version }}
 
       - name: Install dependencies via npm ci
-        if: ${{ !inputs.triggered-by-release }}
         run: npm ci --ignore-scripts
 
-      # For pushes to the release branch, we need to install the dependencies via `npm install`
-      # because the `package-lock.json` is not updated with the new versions of the optional
-      # dependencies yet. We also must skip the fallback download via --ignore-scripts.
-      - name: Install dependencies via npm install (for pushes to release branch)
-        if: ${{ inputs.triggered-by-release }}
-        run: npm install --omit=optional --ignore-scripts
-
-      # --omit=optional skips native resolver bindings required by Jest 30.
-      # napi-postinstall installs the correct platform-specific binary.
-      - name: Install native bindings (for pushes to release branch)
-        if: ${{ inputs.triggered-by-release }}
-        run: npx napi-postinstall unrs-resolver
-
       - name: Download build artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
diff --git a/scripts/bump-version.sh b/scripts/bump-version.sh
index 4d49dabb90..ab2ffda267 100755
--- a/scripts/bump-version.sh
+++ b/scripts/bump-version.sh
@@ -35,3 +35,14 @@ done
 # Update the optional deps in the main cli npm package
 # Requires jq to be installed - should be installed ootb on github runners
 jq '.optionalDependencies |= map_values("'"${TARGET}"'")' $SCRIPT_DIR/../package.json > package.json.tmp && mv package.json.tmp $SCRIPT_DIR/../package.json
+
+# Pin the optional deps in package-lock.json too, so `npm ci` accepts the lockfile as soon as
+# this commit lands. The platform packages aren't on npm yet, so we can't let npm resolve them;
+# entries with only a version are enough, and `npm ci` skips optional deps it can't fetch.
+if [ "$(jq '.lockfileVersion' $SCRIPT_DIR/../package-lock.json)" != "1" ]; then
+    echo "package-lock.json is no longer lockfileVersion 1; update this script to match." >&2
+    exit 1
+fi
+jq --arg version "${TARGET}" --slurpfile pkg $SCRIPT_DIR/../package.json \
+    'reduce ($pkg[0].optionalDependencies | keys[]) as $name (.; .dependencies[$name] = {version: $version, optional: true})' \
+    $SCRIPT_DIR/../package-lock.json > package-lock.json.tmp && mv package-lock.json.tmp $SCRIPT_DIR/../package-lock.json
diff --git a/scripts/post-release.sh b/scripts/post-release.sh
deleted file mode 100644
index 8dba274efc..0000000000
--- a/scripts/post-release.sh
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/bin/bash
-
-# This script is run by Craft after a release is created.
-# We currently use it to bump the platform-specific optional dependencies to their new versions
-# in the package-lock.json, immediately after a release is created. This is needed for CI to
-# pass after the release is created.
-
-set -eux
-OLD_VERSION="${1}"
-NEW_VERSION="${2}"
-
-git checkout master
-
-# Craft can run this script before all platform packages for the new version are visible on npm.
-# If we update the lockfile too early, npm drops their versions from it and `npm ci` fails, so
-# wait until every optional dependency is available first.
-OPTIONAL_DEPENDENCIES=$(node -p "Object.keys(require('./package.json').optionalDependencies).join(' ')")
-WAIT_TIMEOUT_SECONDS=1800
-WAIT_INTERVAL_SECONDS=30
-deadline=$((SECONDS + WAIT_TIMEOUT_SECONDS))
-
-for package in $OPTIONAL_DEPENDENCIES; do
-  until [ "$(npm view "${package}@${NEW_VERSION}" version --prefer-online 2>/dev/null)" = "${NEW_VERSION}" ]; do
-    if [ "${SECONDS}" -ge "${deadline}" ]; then
-      echo "Timed out waiting for ${package}@${NEW_VERSION} to be available on npm" >&2
-      exit 1
-    fi
-    sleep "${WAIT_INTERVAL_SECONDS}"
-  done
-done
-
-# We need to update the package-lock.json to include the new version of the optional dependencies.
-npm install --package-lock-only --ignore-scripts --prefer-online
-
-# Don't push a lockfile that `npm ci` would reject.
-NEW_VERSION="${NEW_VERSION}" node -e '
-const lock = require("./package-lock.json");
-const deps = Object.keys(require("./package.json").optionalDependencies);
-const stale = deps.filter((name) => {
-  const entry = lock.packages?.[`node_modules/${name}`] ?? lock.dependencies?.[name];
-  return entry?.version !== process.env.NEW_VERSION;
-});
-if (stale.length > 0) {
-  console.error(`package-lock.json is missing ${process.env.NEW_VERSION} for: ${stale.join(", ")}`);
-  process.exit(1);
-}
-'
-
-git add package-lock.json
-
-# Only commit if there are changes
-git diff --staged --quiet || git commit -m "build(npm): 🤖 Bump optional dependencies to ${NEW_VERSION}"
-git pull --rebase
-git push