Environments leaking across projects

[jasondentler]

Environment

SaaS (https://sentry.io/)

Steps to Reproduce

I have 4 distinct web applications within a monorepo. Each application has a corresponding project in Sentry.
We use git hashes as release ids.
We also specify a dist because a commit can be built multiple times by our CI/CD pipeline.
Our deploy ids use semantic versioning, and each app is versioned independently. (App A can be on v1.23.5 while App B is on v9.173.2)
When creating a deployment, we specify the deployment name (app's semantic version), project, release & environment.

P.S. The documentation offers no guidance on Sentry best practices for common scenarios like a monorepo, so we're making it up as we go along.

Kobby Bawuah @ Sentry support recommended opening a bug here. You can refer to support issue #131315 for my details.

Expected Result

Despite being on a monorepo, I don't want any cross-talk between my projects. When I create a deployment for one project, I really do mean just that one project. If I deploy multiple projects, I'll create a deployment for each one.

imo, each project should have independent releases, source maps, deployments, and environments. The only thing I want at the org level are user accounts, teams, and my billing info.

If I've only ever deployed App A to Environment X, then Environment X should only appear in the project for App A.

Actual Result

However, when I look in Sentry, everything is a jumbled mess of data smeared across all my projects.

• The environment I only specified for a deployment in App A now shows in all my projects.
• The deployment email says I've deployed all the apps that share that release, when I created the deploy for 1 specific project.
• I have no way to see the deploy name (semantic version) in the Sentry UI. I don't see the deployment entity represented in the Sentry UI anywhere.
• Releases only show the timestamp and environment of the most recent deployment. How can I tell what other environments may have been affected by a bug?

Product Area

Releases

Link

No response

DSN

No response

Version

No response

[getsantry]

Assigning to @getsentry/support for routing ⏲️

[getsantry]

Routing to @getsentry/product-owners-releases for triage ⏲️

[mifu67]

Hi @jasondentler,

Did you include the package name when including releases? See https://docs.sentry.io/platforms/javascript/configuration/releases/#bind-the-version.

[jasondentler]

Hi @jasondentler,

Did you include the package name when including releases? See https://docs.sentry.io/platforms/javascript/configuration/releases/#bind-the-version.

As noted in the support ticket (support issue #131315), here is my sentry-cli command:

            #!/bin/bash
            sentry-cli deploys new \
              --org $organization \
              --env $environment \
              --project $sentryProjectName \
              --name $deploymentName \
              --release $release \
              --url $url || (sentry-cli info && exit 1)

$release is the commit SHA. The semantic version is unknown during the build when the source maps are uploaded. We only assign a semantic version once that release has been tested and approved for deployment.

[jasondentler]

Logs, anonymized.

DEBUG   2024-08-30 15:32:32.366557781 +00:00 sentry-cli version: 2.33.1, platform: "linux", architecture: "x86_64"
INFO    2024-08-30 15:32:32.367708312 +00:00 sentry-cli was invoked with the following command line: "/my-sentry-cli-path/sentry-cli" "deploys" "new" "--org" "my-org-slug" "--env" "my-environment-slug" "--project" "my-project-slug" "--name" "2.7.3" "--release" "abcdef3333fffffdd11111111111111111111111" "--url" "https://my-jenkins/job-url-goes-here" "--log-level" "debug"
DEBUG   2024-08-30 15:32:32.368434797 +00:00 request POST https://sentry.io/api/0/organizations/my-org-slug/releases/abcdef3333fffffdd11111111111111111111111/deploys/
DEBUG   2024-08-30 15:32:32.368459357 +00:00 using token authentication
DEBUG   2024-08-30 15:32:32.368484902 +00:00 json body: {"environment":"my-environment-slug","name":"2.7.3","url":"https://my-jenkins/job-url-goes-here","dateStarted":null,"dateFinished":"2024-08-30T15:32:32.368401541Z"}
DEBUG   2024-08-30 15:32:32.368505293 +00:00 retry number 0, max retries: 0
DEBUG   2024-08-30 15:32:32.451583504 +00:00 > POST /api/0/organizations/my-org-slug/releases/abcdef3333fffffdd11111111111111111111111/deploys/ HTTP/1.1
DEBUG   2024-08-30 15:32:32.451628950 +00:00 > Host: sentry.io
DEBUG   2024-08-30 15:32:32.451641700 +00:00 > Accept: */*
DEBUG   2024-08-30 15:32:32.451653504 +00:00 > Connection: TE
DEBUG   2024-08-30 15:32:32.451665286 +00:00 > TE: gzip
DEBUG   2024-08-30 15:32:32.451677476 +00:00 > User-Agent: sentry-cli/2.33.1
DEBUG   2024-08-30 15:32:32.452229374 +00:00 > Authorization: Bearer ***********
DEBUG   2024-08-30 15:32:32.452248066 +00:00 > Content-Type: application/json
DEBUG   2024-08-30 15:32:32.452260417 +00:00 > Content-Length: 187
DEBUG   2024-08-30 15:32:32.725234422 +00:00 < HTTP/1.1 201 Created
DEBUG   2024-08-30 15:32:32.725300725 +00:00 < server: nginx
DEBUG   2024-08-30 15:32:32.725317923 +00:00 < date: Fri, 30 Aug 2024 15:32:32 GMT
DEBUG   2024-08-30 15:32:32.725333544 +00:00 < content-type: application/json
DEBUG   2024-08-30 15:32:32.725350001 +00:00 < allow: GET, POST, HEAD, OPTIONS
DEBUG   2024-08-30 15:32:32.725364254 +00:00 < access-control-allow-methods: GET, POST, HEAD, OPTIONS
DEBUG   2024-08-30 15:32:32.725394814 +00:00 < access-control-allow-headers: X-Sentry-Auth, X-Requested-With, Origin, Accept, Content-Type, Authentication, Authorization, Content-Encoding, sentry-trace, baggage, X-CSRFToken
DEBUG   2024-08-30 15:32:32.725410933 +00:00 < access-control-expose-headers: X-Sentry-Error, X-Sentry-Direct-Hit, X-Hits, X-Max-Hits, Endpoint, Retry-After, Link
DEBUG   2024-08-30 15:32:32.725426981 +00:00 < access-control-allow-origin: *
DEBUG   2024-08-30 15:32:32.725441267 +00:00 < x-sentry-rate-limit-remaining: 39
DEBUG   2024-08-30 15:32:32.725454654 +00:00 < x-sentry-rate-limit-limit: 40
DEBUG   2024-08-30 15:32:32.725470047 +00:00 < x-sentry-rate-limit-reset: 1725031953
DEBUG   2024-08-30 15:32:32.725483384 +00:00 < x-sentry-rate-limit-concurrentremaining: 24
DEBUG   2024-08-30 15:32:32.725496602 +00:00 < x-sentry-rate-limit-concurrentlimit: 25
DEBUG   2024-08-30 15:32:32.725510642 +00:00 < vary: Accept-Language, Cookie
DEBUG   2024-08-30 15:32:32.725525752 +00:00 < content-language: en
DEBUG   2024-08-30 15:32:32.725538612 +00:00 < x-frame-options: deny
DEBUG   2024-08-30 15:32:32.725553108 +00:00 < x-content-type-options: nosniff
DEBUG   2024-08-30 15:32:32.725568096 +00:00 < x-xss-protection: 1; mode=block
DEBUG   2024-08-30 15:32:32.725601859 +00:00 < content-security-policy: xxx
DEBUG   2024-08-30 15:32:32.725672561 +00:00 < x-envoy-attempt-count: 1
DEBUG   2024-08-30 15:32:32.725690029 +00:00 < x-envoy-upstream-service-time: 254
DEBUG   2024-08-30 15:32:32.725706519 +00:00 < x-served-by: getsentry-web-rpc-production-57bb796b5d-frfd5
DEBUG   2024-08-30 15:32:32.725722293 +00:00 < x-sentry-proxy-url: http://10.2.0.67:8999/api/0/organizations/my-org-slug/releases/abcdef3333fffffdd11111111111111111111111/deploys/
DEBUG   2024-08-30 15:32:32.725774384 +00:00 < x-served-by: getsentry-control-web-default-common-production-7894b45c7bm4wk4
DEBUG   2024-08-30 15:32:32.725791356 +00:00 < x-served-by: frontend-default-production-canary-7754869dd-7sh2b
DEBUG   2024-08-30 15:32:32.725805048 +00:00 < strict-transport-security: max-age=31536000; includeSubDomains; preload
DEBUG   2024-08-30 15:32:32.725822675 +00:00 < via: 1.1 google
DEBUG   2024-08-30 15:32:32.725836917 +00:00 < Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DEBUG   2024-08-30 15:32:32.725852592 +00:00 < Transfer-Encoding: chunked
DEBUG   2024-08-30 15:32:32.726005527 +00:00 response status: 201
DEBUG   2024-08-30 15:32:32.726030935 +00:00 body: {"id":"58222646","environment":"my-environment-slug","dateStarted":null,"dateFinished":"2024-08-30T15:32:32.368401Z","name":"2.7.3","url":"https://my-jenkins/job-url-goes-here"}
10:32:32  Created new deploy 2.7.3 for 'my-environment-slug'

[ceorourke]

I looked into this and believe it's a sentry cli bug. I'll be transferring this issue to that repository.

I first confirmed (via writing a test) that the deploy create endpoint respects passing in a single project and will only create a single ReleaseProjectEnvironment row in that case, but if not passed it creates one for all projects on the release.

I then looked up your ReleaseProjectEnvironment rows for the given release and confirmed that one was created for each of your projects despite you passing in a single project slug.

This led me to pull up the sentry-cli code for creating a deploy which doesn't consider the passed project param at all, even though the help text for it indicates that it would:

sentry-cli deploys --help
Manage deployments for Sentry releases.

Usage: sentry-cli deploys [OPTIONS] <COMMAND>

Commands:
  list  List all deployments of a release.
  new   Creates a new release deployment.
  help  Print this message or the help of the given subcommand(s)

Options:
  -o, --org <ORG>                The organization ID or slug.
      --header <KEY:VALUE>       Custom headers that should be attached to all requests
                                 in key:value format.
  -p, --project <PROJECT>        The project ID or slug.
      --auth-token <AUTH_TOKEN>  Use the given Sentry auth token.
  -r, --release <RELEASE>        The release slug.
      --log-level <LOG_LEVEL>    Set the log output verbosity. [possible values: trace, debug, info,
                                 warn, error]
      --quiet                    Do not print any output while preserving correct exit code. This
                                 flag is currently implemented only for selected subcommands.
                                 [aliases: silent]
  -h, --help                     Print help