meta(changelog): Update changelog for 11.12.0

.agents/skills/add-ai-integration/SKILL.md

@@ -10,7 +10,7 @@ argument-hint: <provider-name>
 
 Span ops and attributes are specified outside this repo. Never invent or hardcode either:
 
-- [gen_ai attributes](https://getsentry.github.io/sentry-conventions/attributes/gen_ai/) and [gen_ai ops](https://getsentry.github.io/sentry-conventions/ops/#gen_ai) — normative; import from `@sentry/conventions/attributes` and `@sentry/conventions/op`
+- [gen_ai attributes](https://conventions.sentry.dev/attributes/gen_ai/) and [gen_ai ops](https://conventions.sentry.dev/ops/#gen_ai) — normative; import from `@sentry/conventions/attributes` and `@sentry/conventions/op`
 - [RFC 0153](https://github.com/getsentry/rfcs/blob/main/text/0153-decoupling-sentrys-generative-ai-conventions-from-open-telemetry.md) — why Sentry's gen-AI conventions diverge from the [OTel gen-ai semconv](https://opentelemetry.io/docs/specs/semconv/gen-ai/)
 
 Derive the op with `getGenAiSpanOp()` from `ai/core/utils.ts` rather than picking one by hand. `ai/core/gen-ai-attributes.ts` is for gap-fillers only — keys with no `@sentry/conventions` equivalent — so check it last, not first.

.agents/skills/port-span-names/SKILL.md

@@ -6,7 +6,7 @@ argument-hint: '<span-op> [constraints]  # e.g. navigation, or "db.query --only
 
 # Port a span op to low-cardinality span names
 
-Span names must be low cardinality, per the [Sentry span name conventions](https://getsentry.github.io/sentry-conventions/names/): a raw URL, id, or query must never end up in a span name. Where the SDK has no low-cardinality value for a span, it uses a **static fallback name** for that op instead.
+Span names must be low cardinality, per the [Sentry span name conventions](https://conventions.sentry.dev/names/): a raw URL, id, or query must never end up in a span name. Where the SDK has no low-cardinality value for a span, it uses a **static fallback name** for that op instead.
 
 This only applies when span streaming is enabled. With `traceLifecycle: 'static'` every span name must stay byte-identical to before.
 
@@ -37,13 +37,13 @@ These are non-negotiable. Every one of them was arrived at by rejecting the alte
 
 ## 1. Look up the convention
 
-Read <https://getsentry.github.io/sentry-conventions/names/> and find the op. Each op lists attribute templates in priority order, ending in a static fallback — that fallback is your name. Examples: `pageload` → `Pageload`, `navigation` → `Navigation`, database ops → `Database operation`.
+Read <https://conventions.sentry.dev/names/> and find the op. Each op lists attribute templates in priority order, ending in a static fallback — that fallback is your name. Examples: `pageload` → `Pageload`, `navigation` → `Navigation`, database ops → `Database operation`.
 
 Add it next to `PAGELOAD_SPAN_NAME_FALLBACK` in `packages/core/src/tracing/spans/spanNames.ts` and export it from `shared-exports.ts`. Every package imports it from `@sentry/core` directly — no re-export from `@sentry/browser` is needed.
 
 ### Then look up the description rules
 
-The name is only half the contract. Relay re-derives a span's **description** from its attributes using the [span description rules](https://getsentry.github.io/sentry-conventions/descriptions/) — a separate, much shorter set of templates from the name rules. `function`, for example, has exactly one (`{{code.function.name}}`) and no static fallback, so a `function` span with no `code.function.name` gets no inferred description at all.
+The name is only half the contract. Relay re-derives a span's **description** from its attributes using the [span description rules](https://conventions.sentry.dev/descriptions/) — a separate, much shorter set of templates from the name rules. `function`, for example, has exactly one (`{{code.function.name}}`) and no static fallback, so a `function` span with no `code.function.name` gets no inferred description at all.
 
 Renaming a span therefore drops information unless you check what the op's description template can still produce. For each site, in this order:
 

.github/actions/install-dependencies/action.yml

@@ -22,7 +22,9 @@ runs:
       id: cache_dependencies
       with:
         path: ${{ env.CACHED_DEPENDENCY_PATHS }}
-        key: ${{ steps.compute_lockfile_hash.outputs.hash }}
+        key:
+          ${{ steps.compute_lockfile_hash.outputs.hash }}${{ runner.arch != 'X64' && format('-{0}', runner.arch) || ''
+          }}
 
     - name: Install dependencies
       if: steps.cache_dependencies.outputs.cache-hit != 'true'

.github/actions/install-playwright/action.yml

@@ -38,22 +38,95 @@ runs:
 
     # We always install all browsers, if uncached
     # `npx` runs outside the repo, so it can't pick up a `playwright` that a parallel `pnpm install` is still linking.
-    - name: Install Playwright dependencies (uncached)
+    - name: Install Playwright browsers (uncached)
       env:
         PLAYWRIGHT_VERSION: ${{ steps.playwright-version.outputs.version }}
-      run: npx -y "playwright@$PLAYWRIGHT_VERSION" install chromium webkit firefox --with-deps
+      run: npx -y "playwright@$PLAYWRIGHT_VERSION" install chromium webkit firefox
       if: steps.playwright-version.outputs.version != '' && steps.playwright-cache.outputs.cache-hit != 'true'
       shell: bash
       working-directory: ${{ runner.temp }}
 
-    - name: Install Playwright system dependencies only (cached)
-      env:
-        PLAYWRIGHT_BROWSERS: ${{ inputs.browsers || 'chromium webkit firefox' }}
-        PLAYWRIGHT_VERSION: ${{ steps.playwright-version.outputs.version }}
-      run: npx -y "playwright@$PLAYWRIGHT_VERSION" install-deps $PLAYWRIGHT_BROWSERS
-      if: steps.playwright-version.outputs.version != '' && steps.playwright-cache.outputs.cache-hit == 'true'
+    - name: Resolve headless WebKit system dependencies
+      id: webkit-dependencies
+      if: steps.playwright-version.outputs.version != '' && contains(inputs.browsers, 'webkit')
+      run: |
+        packages=(
+          gstreamer1.0-plugins-base
+          gstreamer1.0-plugins-good
+          libavif16
+          libevent-2.1-7t64
+          libflite1
+          libgles2
+          libgstreamer-gl1.0-0
+          libgstreamer-plugins-bad1.0-0
+          libgstreamer-plugins-base1.0-0
+          libharfbuzz-icu0
+          libhyphen0
+          libmanette-0.2-0
+          libopus0
+          libwayland-server0
+        )
+        # Resolve now and install after restoring the cache; share the package list across both steps.
+        printf '%s\n' "${packages[@]}" > "$RUNNER_TEMP/webkit-apt-packages"
+        # runner.temp is private, so keep installers where apt's sandbox user can access them.
+        mkdir -p /var/tmp/webkit-apt-cache
+
+        sudo apt-get update
+        # Ask apt which installers it needs, including dependencies, without downloading them.
+        # Do this before restoring cached files so the key describes the full download set.
+        plan=$(sudo apt-get \
+          -o Dir::Cache::archives=/var/tmp/webkit-apt-cache \
+          --print-uris --download-only -y --no-install-recommends \
+          install "${packages[@]}")
+        # Hash only download records, in a stable order, so package updates produce a new key.
+        hash=$(printf '%s\n' "$plan" | sed -n "/^'/p" | LC_ALL=C sort | sha256sum | cut -d ' ' -f1)
+
+        # Separate Ubuntu versions and architectures, while allowing older package sets as fallbacks.
+        . /etc/os-release
+        prefix="webkit-apt-$ID-$VERSION_ID-${{ runner.arch }}-v1-"
+        echo "prefix=$prefix" >> "$GITHUB_OUTPUT"
+        echo "key=$prefix$hash" >> "$GITHUB_OUTPUT"
       shell: bash
-      working-directory: ${{ runner.temp }}
+
+    - name: Restore cached WebKit system packages
+      id: webkit-apt-cache
+      if: steps.webkit-dependencies.outputs.key != ''
+      uses: actions/cache/restore@v6.1.0
+      with:
+        path: /var/tmp/webkit-apt-cache/*.deb
+        key: ${{ steps.webkit-dependencies.outputs.key }}
+        # If this exact package set isn't cached, reuse an older set; apt downloads only what's missing.
+        restore-keys: ${{ steps.webkit-dependencies.outputs.prefix }}
+
+    - name: Install headless WebKit system dependencies
+      if: steps.webkit-dependencies.outputs.key != ''
+      run: |
+        mapfile -t packages < "$RUNNER_TEMP/webkit-apt-packages"
+        # Install from restored .deb files where possible, retaining new downloads for the cache save.
+        sudo apt-get \
+          -o Dir::Cache::archives=/var/tmp/webkit-apt-cache \
+          -o APT::Keep-Downloaded-Packages=true \
+          install -y --no-install-recommends "${packages[@]}"
+      shell: bash
+
+    - name: Remove obsolete cached WebKit packages
+      if:
+        steps.webkit-dependencies.outputs.key != '' && steps.webkit-apt-cache.outputs.cache-hit != 'true' &&
+        github.event_name == 'push' && github.ref == 'refs/heads/develop'
+      # Fallback restores can carry obsolete installers into newer cache entries.
+      run: sudo apt-get -o Dir::Cache::archives=/var/tmp/webkit-apt-cache autoclean
+      shell: bash
+
+    # Develop populates caches shared with PRs. Save after misses or fallback restores,
+    # which may have downloaded packages absent from the restored cache.
+    - name: Store cached WebKit system packages
+      if:
+        steps.webkit-dependencies.outputs.key != '' && steps.webkit-apt-cache.outputs.cache-hit != 'true' &&
+        github.event_name == 'push' && github.ref == 'refs/heads/develop'
+      uses: actions/cache/save@v6.1.0
+      with:
+        path: /var/tmp/webkit-apt-cache/*.deb
+        key: ${{ steps.webkit-dependencies.outputs.key }}
 
     # Only store cache on develop branch
     - name: Store cached playwright binaries

.github/actions/prepare-e2e-test/action.yml

@@ -68,7 +68,7 @@ runs:
         github-token: ${{ inputs.github-token }}
 
     - name: Restore build layer artifacts
-      if: contains(inputs.test-application, 'aws-serverless')
+      if: inputs.test-application == 'aws-serverless-layer'
       uses: actions/download-artifact@v8
       with:
         name: build-layer-output

.github/actions/restore-cache/action.yml

@@ -17,7 +17,7 @@ runs:
       uses: actions/cache/restore@v6.1.0
       with:
         path: ${{ env.CACHED_DEPENDENCY_PATHS }}
-        key: ${{ inputs.dependency_cache_key }}
+        key: ${{ inputs.dependency_cache_key }}${{ runner.arch != 'X64' && format('-{0}', runner.arch) || '' }}
 
     - name: Restore build artifacts
       uses: actions/download-artifact@v7