test(cloudflare): Add E2E test that deploys a real Worker and sends to Sentry

Local wrangler cannot reproduce what the platform does around waitUntil,
isolate reuse and Durable Object hibernation. The new optional E2E app
builds with the Sentry Vite plugin, deploys one Worker per ref in CI,
verifies errors and request spans in Sentry through the CLI helpers, and
deletes PR Workers through a new workflow when the PR closes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: JPeer264

.github/workflows/build.yml

@@ -1149,6 +1149,9 @@ jobs:
       REACT_APP_E2E_TEST_DSN: ${{ secrets.E2E_TEST_DSN }}
       E2E_TEST_SENTRY_ORG_SLUG: 'sentry-javascript-sdks'
       E2E_TEST_SENTRY_PROJECT: 'sentry-javascript-e2e-tests'
+      # Used by test apps that deploy a real Cloudflare Worker, e.g. cloudflare-workers-send-to-sentry
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.job_build.outputs.e2e-matrix-optional) }}

.github/workflows/cleanup-e2e-workers.yml

@@ -0,0 +1,36 @@
+name: 'Automation: Cleanup E2E workers'
+on:
+  pull_request:
+    types:
+      - closed
+
+jobs:
+  cleanup:
+    # The optional E2E job deploys only for PRs from this repository, so forks never have a worker to delete.
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions: {}
+    timeout-minutes: 5
+    env:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+    strategy:
+      matrix:
+        # Name prefix of every E2E app that deploys a real worker, see the app's global-setup.mjs
+        worker-prefix:
+          - e2e-send-to-sentry
+    steps:
+      - name: Set up Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+
+      - name: Delete worker
+        run: |
+          WORKER="${{ matrix.worker-prefix }}-pr-${{ github.event.pull_request.number }}"
+
+          if ! output=$(npx --yes wrangler@4 delete --name "$WORKER" --force 2>&1); then
+            echo "$output"
+            # 10007 means the worker does not exist, i.e. the PR never ran the optional E2E job.
+            echo "$output" | grep -q 'code: 10007' || exit 1
+          fi

dev-packages/e2e-tests/.env.example

@@ -11,3 +11,9 @@ E2E_TEST_SENTRY_ORG_SLUG=
 
 # A Sentry project slug
 E2E_TEST_SENTRY_PROJECT=
+
+# Cloudflare credentials for E2E tests that deploy a real Worker (e.g. cloudflare-workers-send-to-sentry).
+# The API token needs "Workers Scripts: Edit" on the account; "Workers KV Storage: Read" additionally silences a
+# warning when a worker is deleted. Leave it empty to use a `wrangler login` session instead.
+CLOUDFLARE_API_TOKEN=
+CLOUDFLARE_ACCOUNT_ID=

dev-packages/e2e-tests/README.md

@@ -18,6 +18,10 @@ current state.
 - Copy `.env.example` to `.env`
 - OPTIONAL: Fill in auth information in `.env` for an example Sentry project - you only need this to run E2E tests that
   send data to Sentry.
+- OPTIONAL: Fill in the Cloudflare credentials in `.env` - you only need this to run E2E tests that deploy a real
+  Cloudflare Worker (e.g. `cloudflare-workers-send-to-sentry`). A local run deploys a throwaway worker and deletes it
+  again afterwards; set `E2E_KEEP_WORKER=1` to keep it for debugging. CI keeps one worker per branch or PR instead, and
+  PR workers are deleted by the `cleanup-e2e-workers` workflow when the PR closes.
 - Run `yarn build:tarball` in the root of the repository (needs to be rerun after every update in /packages for the
   changes to have effect on the tests).
 

dev-packages/e2e-tests/test-applications/cloudflare-workers-send-to-sentry/.gitignore

@@ -0,0 +1,5 @@
+dist
+.wrangler
+node_modules
+test-results
+pnpm-lock.yaml

dev-packages/e2e-tests/test-applications/cloudflare-workers-send-to-sentry/deployed-worker.mjs

@@ -0,0 +1,61 @@
+import { execFileSync } from 'node:child_process';
+import { dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+function wrangler(args) {
+  const output = execFileSync('pnpm', ['exec', 'wrangler', ...args], {
+    cwd: __dirname,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'inherit'],
+  });
+  console.log(output);
+  return output;
+}
+
+/** Deploys the worker under `name` and returns its workers.dev URL. */
+export function deployWorker(name, dsn) {
+  const output = wrangler(['deploy', '--name', name, '--var', `E2E_TEST_DSN:${dsn}`]);
+  const url = output.match(/https:\/\/\S+\.workers\.dev/)?.[0];
+
+  if (!url) {
+    throw new Error(`Could not find the workers.dev URL in the wrangler deploy output for ${name}.`);
+  }
+
+  return url;
+}
+
+export function deleteWorker(name) {
+  wrangler(['delete', '--name', name, '--force']);
+}
+
+/**
+ * CI keeps its Workers: one per ref, overwritten by the next run of the same ref and deleted by the
+ * cleanup workflow once a PR closes. Local runs delete theirs unless `E2E_KEEP_WORKER` is set.
+ */
+export function keepsWorker() {
+  return Boolean(process.env.GITHUB_ACTIONS || process.env.E2E_KEEP_WORKER);
+}
+
+/** A freshly created workers.dev route can take a moment to become reachable. */
+export async function waitForWorker(url) {
+  const deadline = Date.now() + 60_000;
+
+  while (Date.now() < deadline) {
+    try {
+      // The SDK does not trace HEAD requests, so the probe leaves no spans behind in Sentry.
+      const response = await fetch(url, { method: 'HEAD' });
+
+      if (response.ok) {
+        return;
+      }
+    } catch {
+      // DNS for the new subdomain may not have propagated yet.
+    }
+
+    await new Promise(resolve => setTimeout(resolve, 2_000));
+  }
+
+  throw new Error(`Worker at ${url} did not become reachable within 60s.`);
+}

dev-packages/e2e-tests/test-applications/cloudflare-workers-send-to-sentry/global-setup.mjs

@@ -0,0 +1,54 @@
+import { randomBytes } from 'node:crypto';
+import { deleteWorker, deployWorker, keepsWorker, waitForWorker } from './deployed-worker.mjs';
+
+const WORKER_PREFIX = 'e2e-send-to-sentry';
+
+/**
+ * In CI the name follows the ref, so `develop`, `master` and every PR get a stable Worker that the
+ * next run of the same ref overwrites. Pull request refs look like `123/merge` and merge queue refs
+ * like `gh-readonly-queue/<base>/pr-123-<sha>`; both map to the PR's Worker.
+ */
+export function getWorkerName() {
+  if (!process.env.GITHUB_ACTIONS) {
+    return `${WORKER_PREFIX}-local-${randomBytes(3).toString('hex')}`;
+  }
+
+  const { GITHUB_EVENT_NAME, GITHUB_REF_NAME = '' } = process.env;
+  const prNumber =
+    GITHUB_EVENT_NAME === 'pull_request' ? GITHUB_REF_NAME.split('/')[0] : /\/pr-(\d+)-/.exec(GITHUB_REF_NAME)?.[1];
+  const ref = prNumber ? `pr-${prNumber}` : GITHUB_REF_NAME;
+  // Worker names allow lowercase alphanumerics and dashes only, up to 63 characters.
+  const slug = ref.toLowerCase().replace(/[^a-z0-9]+/g, '-');
+
+  return `${WORKER_PREFIX}-${slug}`.slice(0, 63).replace(/-+$/, '');
+}
+
+export default async function globalSetup() {
+  const { CLOUDFLARE_ACCOUNT_ID, E2E_TEST_DSN } = process.env;
+
+  // Wrangler authenticates with `CLOUDFLARE_API_TOKEN` (CI) or a `wrangler login` session (local),
+  // but it cannot pick an account on its own outside of a terminal.
+  if (!CLOUDFLARE_ACCOUNT_ID) {
+    throw new Error('CLOUDFLARE_ACCOUNT_ID must be set to deploy the test worker.');
+  }
+
+  const workerName = getWorkerName();
+  const workerUrl = deployWorker(workerName, E2E_TEST_DSN);
+  process.env.E2E_TEST_WORKER_NAME = workerName;
+
+  try {
+    await waitForWorker(workerUrl);
+  } catch (error) {
+    if (!keepsWorker()) {
+      try {
+        deleteWorker(workerName);
+      } catch (deleteError) {
+        // The unreachable worker is the failure to report, not the cleanup.
+        console.error(`Failed to delete worker ${workerName}:`, deleteError);
+      }
+    }
+    throw error;
+  }
+
+  process.env.E2E_TEST_WORKER_URL = workerUrl;
+}

dev-packages/e2e-tests/test-applications/cloudflare-workers-send-to-sentry/global-teardown.mjs

@@ -0,0 +1,16 @@
+import { deleteWorker, keepsWorker } from './deployed-worker.mjs';
+
+export default function globalTeardown() {
+  const workerName = process.env.E2E_TEST_WORKER_NAME;
+
+  if (!workerName) {
+    return;
+  }
+
+  if (keepsWorker()) {
+    console.log(`Keeping worker ${workerName} at ${process.env.E2E_TEST_WORKER_URL}`);
+    return;
+  }
+
+  deleteWorker(workerName);
+}

dev-packages/e2e-tests/test-applications/cloudflare-workers-send-to-sentry/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "cloudflare-workers-send-to-sentry",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "vite build",
+    "typecheck": "tsc --noEmit",
+    "test": "playwright test",
+    "clean": "npx rimraf node_modules pnpm-lock.yaml",
+    "test:build": "pnpm install && pnpm build",
+    "test:assert": "pnpm typecheck && pnpm test"
+  },
+  "dependencies": {
+    "@sentry/cloudflare": "file:../../packed/sentry-cloudflare-packed.tgz"
+  },
+  "devDependencies": {
+    "@cloudflare/vite-plugin": "^1.47.0",
+    "@cloudflare/workers-types": "^5.20260727.1",
+    "@playwright/test": "~1.56.0",
+    "@sentry-internal/test-utils": "link:../../../test-utils",
+    "@types/node": "^26.1.2",
+    "sentry": "~0.44.1",
+    "typescript": "~6.0.3",
+    "vite": "^8.1.5",
+    "wrangler": "^4.114.0"
+  },
+  "volta": {
+    "node": "24.15.0",
+    "extends": "../../package.json"
+  },
+  "sentryTest": {
+    "optional": true
+  }
+}

dev-packages/e2e-tests/test-applications/cloudflare-workers-send-to-sentry/playwright.config.ts

@@ -0,0 +1,16 @@
+import { defineConfig } from '@playwright/test';
+
+export default defineConfig({
+  testDir: './tests',
+  // The worker is deployed once for the whole run and deleted again afterwards.
+  globalSetup: './global-setup.mjs',
+  globalTeardown: './global-teardown.mjs',
+  /* Spans take ~2min to become queryable via the trace endpoint. */
+  timeout: 210_000,
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: 0,
+  // Every test spends most of its time polling Sentry, so run them all at once.
+  workers: '100%',
+  reporter: process.env.CI ? [['list'], ['junit', { outputFile: 'results.junit.xml' }]] : 'list',
+});