Skip to content

ci: Replace curl-pipe-bash with action-setup-cli for Sentry CLI setup - #6567

Merged
lucas-zimerman merged 1 commit into
mainfrom
alextarasov/vuln-2348-command-injection-vulnerabilities-in-getsentrysentry-react
Aug 6, 2026
Merged

ci: Replace curl-pipe-bash with action-setup-cli for Sentry CLI setup#6567
lucas-zimerman merged 1 commit into
mainfrom
alextarasov/vuln-2348-command-injection-vulnerabilities-in-getsentrysentry-react

Conversation

@oioki

@oioki oioki commented Aug 6, 2026

Copy link
Copy Markdown
Member

Summary

  • Two "Install Sentry CLI" steps in size-analysis.yml (Android and iOS jobs) used curl -sL https://sentry.io/get-cli/ | sh, piping a remote install script directly into a shell.
  • Replaced both with getsentry/action-setup-cli, which downloads the sentry-cli release asset for the runner's OS/arch and verifies its sha256 against the digest GitHub recorded for that asset via the Releases API, before adding it to PATH. Uses gh only, no curl.
  • Preserved the existing if: env.SENTRY_AUTH_TOKEN != '' condition on both steps.

Test plan

  • Validated size-analysis.yml parses correctly
  • Verify both Android and iOS size analysis jobs still install sentry-cli correctly on this PR

Fixes VULN-2348

🤖 Generated with Claude Code

Refs VULN-2348
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@linear-code

linear-code Bot commented Aug 6, 2026

Copy link
Copy Markdown

VULN-2348

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Semver Impact of This PR

None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).


  • ci: Replace curl-pipe-bash with action-setup-cli for Sentry CLI setup by oioki in #6567

🤖 This preview updates automatically when you update the PR.

@oioki oioki added the ready-to-merge Triggers the full CI test suite label Aug 6, 2026
@sentry

sentry Bot commented Aug 6, 2026

Copy link
Copy Markdown

📲 Install Builds

Android

🔗 App Name App ID Version Configuration
Sentry RN io.sentry.reactnative.sample 8.22.0 (102) Release

⚙️ sentry-react-native Build Distribution Settings

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

iOS (legacy) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 3857.10 ms 1238.57 ms -2618.52 ms
Size 5.08 MiB 6.68 MiB 1.60 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
5fe1c6c+dirty 1220.79 ms 1217.63 ms -3.16 ms
0a147b2+dirty 3838.15 ms 1221.94 ms -2616.21 ms
41d6254+dirty 3845.71 ms 1224.51 ms -2621.20 ms
a636fa4+dirty 3852.48 ms 1236.10 ms -2616.38 ms
1a2e7e0+dirty 3842.49 ms 1220.04 ms -2622.45 ms
3d377b5+dirty 1218.48 ms 1219.51 ms 1.03 ms
4bb93c7+dirty 3845.98 ms 1218.02 ms -2627.96 ms
bbb8d67+dirty 3838.98 ms 1217.84 ms -2621.14 ms
ab203f9+dirty 3848.07 ms 1219.71 ms -2628.35 ms
7436d0f+dirty 3851.58 ms 1232.21 ms -2619.38 ms

App size

Revision Plain With Sentry Diff
5fe1c6c+dirty 3.38 MiB 4.77 MiB 1.39 MiB
0a147b2+dirty 4.98 MiB 6.51 MiB 1.53 MiB
41d6254+dirty 5.15 MiB 6.70 MiB 1.54 MiB
a636fa4+dirty 4.98 MiB 6.55 MiB 1.57 MiB
1a2e7e0+dirty 4.98 MiB 6.46 MiB 1.49 MiB
3d377b5+dirty 3.38 MiB 4.76 MiB 1.38 MiB
4bb93c7+dirty 5.08 MiB 6.68 MiB 1.60 MiB
bbb8d67+dirty 4.98 MiB 6.55 MiB 1.57 MiB
ab203f9+dirty 4.98 MiB 6.51 MiB 1.53 MiB
7436d0f+dirty 5.15 MiB 6.70 MiB 1.54 MiB

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

iOS (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 3841.93 ms 1207.84 ms -2634.09 ms
Size 5.08 MiB 6.68 MiB 1.60 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
eb93136+dirty 3846.51 ms 1226.13 ms -2620.39 ms
ad66da3+dirty 3855.02 ms 1213.43 ms -2641.59 ms
b04af96+dirty 3830.54 ms 1206.11 ms -2624.44 ms
9210ae6+dirty 3834.11 ms 1216.64 ms -2617.47 ms
ca9d079+dirty 3818.62 ms 1216.72 ms -2601.90 ms
09a902f+dirty 3847.65 ms 1221.31 ms -2626.34 ms
5a21b51+dirty 3837.87 ms 1223.47 ms -2614.40 ms
d038a14+dirty 3831.11 ms 1216.30 ms -2614.81 ms
64630e5+dirty 3845.49 ms 1215.19 ms -2630.30 ms
f3215d3+dirty 3846.08 ms 1231.85 ms -2614.23 ms

App size

Revision Plain With Sentry Diff
eb93136+dirty 5.15 MiB 6.69 MiB 1.53 MiB
ad66da3+dirty 5.15 MiB 6.67 MiB 1.51 MiB
b04af96+dirty 4.98 MiB 6.54 MiB 1.56 MiB
9210ae6+dirty 5.15 MiB 6.68 MiB 1.53 MiB
ca9d079+dirty 5.15 MiB 6.69 MiB 1.53 MiB
09a902f+dirty 4.98 MiB 6.46 MiB 1.49 MiB
5a21b51+dirty 5.15 MiB 6.67 MiB 1.51 MiB
d038a14+dirty 5.15 MiB 6.67 MiB 1.51 MiB
64630e5+dirty 4.98 MiB 6.46 MiB 1.49 MiB
f3215d3+dirty 5.15 MiB 6.67 MiB 1.52 MiB

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Android (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 429.86 ms 477.98 ms 48.12 ms
Size 49.74 MiB 55.44 MiB 5.70 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
a5d243c+dirty 499.20 ms 525.62 ms 26.42 ms
41d6254+dirty 406.20 ms 445.52 ms 39.32 ms
b0d3373+dirty 412.17 ms 452.84 ms 40.67 ms
8929511+dirty 469.49 ms 502.65 ms 33.16 ms
5a23c47+dirty 406.83 ms 451.47 ms 44.64 ms
a50b33d+dirty 353.21 ms 398.48 ms 45.27 ms
acd838e+dirty 492.90 ms 551.42 ms 58.52 ms
244f6e8+dirty 445.89 ms 463.32 ms 17.43 ms
6176a94+dirty 403.58 ms 446.73 ms 43.15 ms
57e0069+dirty 442.25 ms 486.64 ms 44.39 ms

App size

Revision Plain With Sentry Diff
a5d243c+dirty 48.30 MiB 53.54 MiB 5.23 MiB
41d6254+dirty 48.30 MiB 53.60 MiB 5.30 MiB
b0d3373+dirty 48.30 MiB 53.58 MiB 5.28 MiB
8929511+dirty 43.94 MiB 49.02 MiB 5.08 MiB
5a23c47+dirty 49.74 MiB 54.82 MiB 5.07 MiB
a50b33d+dirty 43.94 MiB 48.94 MiB 5.00 MiB
acd838e+dirty 48.30 MiB 53.60 MiB 5.30 MiB
244f6e8+dirty 49.74 MiB 55.38 MiB 5.63 MiB
6176a94+dirty 48.30 MiB 53.54 MiB 5.24 MiB
57e0069+dirty 49.74 MiB 54.85 MiB 5.11 MiB

@lucas-zimerman lucas-zimerman left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! After ci test pass

@lucas-zimerman
lucas-zimerman merged commit 693d7dc into main Aug 6, 2026
153 of 162 checks passed
@lucas-zimerman
lucas-zimerman deleted the alextarasov/vuln-2348-command-injection-vulnerabilities-in-getsentrysentry-react branch August 6, 2026 13:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready-to-merge Triggers the full CI test suite

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants