Bump API schema to f7ea21af#17310
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
| // SENTRY_API_SCHEMA_SHA is used in the sentry-docs GHA workflow in getsentry/sentry-api-schema. | ||
| // DO NOT change variable name unless you change it in the sentry-docs GHA workflow in getsentry/sentry-api-schema. | ||
| const SENTRY_API_SCHEMA_SHA = '805e71363fab2517dcbd96eed74cd956f6527ee0'; | ||
| const SENTRY_API_SCHEMA_SHA = 'f7ea21af981d786ce0059eea4e6a0d839ab6a4ab'; |
There was a problem hiding this comment.
Bug: The build process does not validate the fetched API schema. A malformed schema from the new SHA could cause a build failure due to unsafe property access in apiCategoriesUncached.
Severity: HIGH
Suggested Fix
Add validation and error handling within resolveOpenAPI() to check for HTTP errors and invalid JSON. In apiCategoriesUncached(), add defensive checks to ensure data.tags and data.paths exist before iteration. Crucially, verify that a tag exists in categoryMap before attempting to access its properties. Additionally, add the pnpm build command to the CI workflow (test.yml) to catch such build failures before merging.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: src/build/resolveOpenAPI.ts#L9
Potential issue: The build process, specifically the `apiCategoriesUncached` function,
processes an OpenAPI schema fetched using the `SENTRY_API_SCHEMA_SHA`. This function
does not validate the structure of the fetched schema. It assumes properties like
`data.tags` and `data.paths` exist and are well-formed. A critical issue exists where
the code iterates through an endpoint's tags and directly accesses `categoryMap[tag]`
without checking if the tag was defined. If the new schema contains an API endpoint with
a tag not declared in the top-level `data.tags` array, the build will crash with a
`TypeError`. This issue is not caught by CI, as the build step is not part of the test
workflow, posing a risk of deployment failure.
Did we get this right? 👍 / 👎 to inform future reviews.
No description provided.