chore: Add Sentry DSN so crash reporting works in all builds (#1564)

* Hardcode Sentry DSN so crash reporting works in all builds

The Sentry DSN was injected at build time via ldflags from a SENTRY_DSN
secret. That value has been empty in released binaries since around v1.10,
so crash reporting has effectively been disabled, and it cannot work at all
for from-source builds such as Homebrew Core.

A Sentry DSN is a public, write-only key that is safe to ship inside client
binaries, so this hardcodes it as the default. The build-time injection is
removed from the release pipeline so every build path (releases, Homebrew
Core, and plain go build) reports to Sentry consistently.

* Skip Sentry reporting for local/dev builds

Reporting now keys off buildinfo.Version instead of the Sentry DSN.
Local builds stamp the version as "dev" (and a plain go build leaves
it empty), so ReportException returns early for those and panics
re-panic with a real stack trace. Release and Homebrew Core builds
carry a real version and continue to report.

Author: developerkunal

.github/workflows/release.yml

@@ -35,7 +35,6 @@ jobs:
           workdir: 'auth0-cli'
         env:
           GITHUB_TOKEN: ${{ github.token }}
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
 
       # Homebrew Tap Process
       - name: Checkout Homebrew Tap Repo

.goreleaser.yml

@@ -17,7 +17,6 @@ builds:
       - -X 'github.com/auth0/auth0-cli/internal/buildinfo.Revision={{.Commit}}'
       - -X 'github.com/auth0/auth0-cli/internal/buildinfo.BuildUser=goreleaser'
       - -X 'github.com/auth0/auth0-cli/internal/buildinfo.BuildDate={{.Date}}'
-      - -X 'github.com/auth0/auth0-cli/internal/instrumentation.SentryDSN={{.Env.SENTRY_DSN}}'
 archives:
   - name_template: '{{ .ProjectName }}_{{ .Version }}_{{ title .Os }}_{{ if eq .Arch "arm64" }}arm64{{ else }}x86_64{{ end }}'
     files:

internal/instrumentation/instrumentation.go

@@ -5,9 +5,17 @@ import (
 	"time"
 
 	"github.com/getsentry/sentry-go"
+
+	"github.com/auth0/auth0-cli/internal/buildinfo"
 )
 
-var SentryDSN string
+// SentryDSN is the destination for crash reports. A Sentry DSN is a public,
+// write-only key that is safe to ship inside client binaries, so we hardcode a
+// default here. This ensures crash reporting works for builds that are not
+// produced by our release pipeline (for example Homebrew Core, which builds
+// from source and cannot inject build-time values). Release builds may still
+// override this via ldflags.
+var SentryDSN = "https://370df87d33df46cb90182dd80a50fdc4@o27592.ingest.sentry.io/5694458"
 
 // ReportException is designed to be called once as the CLI exits. We're
 // purposefully initializing a client all the time given this context.
@@ -16,6 +24,15 @@ func ReportException(err error) bool {
 		return false
 	}
 
+	// Skip crash reporting for local/development builds so that dev-time panics
+	// and errors are not shipped to Sentry. Release pipelines (goreleaser and
+	// Homebrew Core) stamp a real semantic version via ldflags, whereas a local
+	// `make build`/`make install` stamps "dev" and a plain `go build` leaves it
+	// empty.
+	if buildinfo.Version == "" || buildinfo.Version == "dev" {
+		return false
+	}
+
 	if err := sentry.Init(sentry.ClientOptions{Dsn: SentryDSN}); err != nil {
 		return false
 	}

internal/instrumentation/instrumentation_test.go

@@ -0,0 +1,62 @@
+package instrumentation
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/auth0/auth0-cli/internal/buildinfo"
+)
+
+func TestReportException(t *testing.T) {
+	tests := []struct {
+		name      string
+		sentryDSN string
+		version   string
+		want      bool
+	}{
+		{
+			name:      "skips when Sentry DSN is empty",
+			sentryDSN: "",
+			version:   "1.32.0",
+			want:      false,
+		},
+		{
+			name:      "skips for a plain go build with no version",
+			sentryDSN: "https://public@o0.ingest.sentry.io/0",
+			version:   "",
+			want:      false,
+		},
+		{
+			name:      "skips for a local dev build",
+			sentryDSN: "https://public@o0.ingest.sentry.io/0",
+			version:   "dev",
+			want:      false,
+		},
+		{
+			name:      "reports for a real release build",
+			sentryDSN: "https://public@o0.ingest.sentry.io/0",
+			version:   "1.32.0",
+			want:      true,
+		},
+	}
+
+	originalDSN := SentryDSN
+	originalVersion := buildinfo.Version
+	t.Cleanup(func() {
+		SentryDSN = originalDSN
+		buildinfo.Version = originalVersion
+	})
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			SentryDSN = test.sentryDSN
+			buildinfo.Version = test.version
+
+			got := ReportException(errors.New("boom"))
+
+			assert.Equal(t, test.want, got)
+		})
+	}
+}