fix(node,vercel-edge,bundler-plugins): INC-2566 - Ignore commit env vars set to their own name

packages/bundler-plugins/src/core/options-mapping.ts

@@ -9,7 +9,7 @@ import type {
   ModuleMetadata,
   ModuleMetadataCallback,
 } from './types';
-import { determineReleaseName } from './utils';
+import { determineReleaseName, readCommitEnvVar } from './utils';
 
 export type NormalizedOptions = {
   org: string | undefined;
@@ -135,9 +135,10 @@ export function normalizeUserOptions(userOptions: UserOptions): NormalizedOption
   };
 
   if (options.release.setCommits === undefined) {
+    const vercelCommitSha = readCommitEnvVar('VERCEL_GIT_COMMIT_SHA');
     if (
       process.env['VERCEL'] &&
-      process.env['VERCEL_GIT_COMMIT_SHA'] &&
+      vercelCommitSha &&
       process.env['VERCEL_GIT_REPO_SLUG'] &&
       process.env['VERCEL_GIT_REPO_OWNER'] &&
       // We only want to set commits for the production env because Sentry becomes extremely noisy (eg on slack) for
@@ -147,8 +148,8 @@ export function normalizeUserOptions(userOptions: UserOptions): NormalizedOption
     ) {
       options.release.setCommits = {
         shouldNotThrowOnFailure: true,
-        commit: process.env['VERCEL_GIT_COMMIT_SHA'],
-        previousCommit: process.env['VERCEL_GIT_PREVIOUS_SHA'],
+        commit: vercelCommitSha,
+        previousCommit: readCommitEnvVar('VERCEL_GIT_PREVIOUS_SHA'),
         repo: `${process.env['VERCEL_GIT_REPO_OWNER']}/${process.env['VERCEL_GIT_REPO_SLUG']}`,
         ignoreEmpty: true,
         ignoreMissing: true,

packages/bundler-plugins/src/core/utils.ts

@@ -221,93 +221,120 @@ export function determineReleaseName(): string | undefined {
   // 1. Git providers
   // 2. CI providers with specific environment variables (has the provider name in the variable name)
   // 3. CI providers with generic environment variables (checked for last to prevent possible false positives)
+  // Each group is only read if the earlier ones found nothing, so a placeholder value is only
+  // warned about when it would otherwise have become the release.
 
-  const possibleReleaseNameOfGitProvider =
+  const possibleReleaseNameOfGitProvider = (): string | undefined =>
     // GitHub Actions - https://help.github.com/en/actions/configuring-and-managing-workflows/using-environment-variables#default-environment-variables
-    process.env['GITHUB_SHA'] ||
+    readCommitEnvVar('GITHUB_SHA') ||
     // GitLab CI - https://docs.gitlab.com/ee/ci/variables/predefined_variables.html
-    process.env['CI_MERGE_REQUEST_SOURCE_BRANCH_SHA'] ||
-    process.env['CI_BUILD_REF'] ||
-    process.env['CI_COMMIT_SHA'] ||
+    readCommitEnvVar('CI_MERGE_REQUEST_SOURCE_BRANCH_SHA') ||
+    readCommitEnvVar('CI_BUILD_REF') ||
+    readCommitEnvVar('CI_COMMIT_SHA') ||
     // Bitbucket - https://support.atlassian.com/bitbucket-cloud/docs/variables-and-secrets/
-    process.env['BITBUCKET_COMMIT'];
+    readCommitEnvVar('BITBUCKET_COMMIT');
 
-  const possibleReleaseNameOfCiProvidersWithSpecificEnvVar =
+  const possibleReleaseNameOfCiProvidersWithSpecificEnvVar = (): string | undefined =>
     // AppVeyor - https://www.appveyor.com/docs/environment-variables/
-    process.env['APPVEYOR_PULL_REQUEST_HEAD_COMMIT'] ||
-    process.env['APPVEYOR_REPO_COMMIT'] ||
+    readCommitEnvVar('APPVEYOR_PULL_REQUEST_HEAD_COMMIT') ||
+    readCommitEnvVar('APPVEYOR_REPO_COMMIT') ||
     // AWS CodeBuild - https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-env-vars.html
-    process.env['CODEBUILD_RESOLVED_SOURCE_VERSION'] ||
+    readCommitEnvVar('CODEBUILD_RESOLVED_SOURCE_VERSION') ||
     // AWS Amplify - https://docs.aws.amazon.com/amplify/latest/userguide/environment-variables.html
-    process.env['AWS_COMMIT_ID'] ||
+    readCommitEnvVar('AWS_COMMIT_ID') ||
     // Azure Pipelines - https://docs.microsoft.com/en-us/azure/devops/pipelines/build/variables?view=azure-devops&tabs=yaml
-    process.env['BUILD_SOURCEVERSION'] ||
+    readCommitEnvVar('BUILD_SOURCEVERSION') ||
     // Bitrise - https://devcenter.bitrise.io/builds/available-environment-variables/
-    process.env['GIT_CLONE_COMMIT_HASH'] ||
+    readCommitEnvVar('GIT_CLONE_COMMIT_HASH') ||
     // Buddy CI - https://buddy.works/docs/pipelines/environment-variables#default-environment-variables
-    process.env['BUDDY_EXECUTION_REVISION'] ||
+    readCommitEnvVar('BUDDY_EXECUTION_REVISION') ||
     // Builtkite - https://buildkite.com/docs/pipelines/environment-variables
-    process.env['BUILDKITE_COMMIT'] ||
+    readCommitEnvVar('BUILDKITE_COMMIT') ||
     // CircleCI - https://circleci.com/docs/variables/
-    process.env['CIRCLE_SHA1'] ||
+    readCommitEnvVar('CIRCLE_SHA1') ||
     // Cirrus CI - https://cirrus-ci.org/guide/writing-tasks/#environment-variables
-    process.env['CIRRUS_CHANGE_IN_REPO'] ||
+    readCommitEnvVar('CIRRUS_CHANGE_IN_REPO') ||
     // Codefresh - https://codefresh.io/docs/docs/codefresh-yaml/variables/
-    process.env['CF_REVISION'] ||
+    readCommitEnvVar('CF_REVISION') ||
     // Codemagic - https://docs.codemagic.io/yaml-basic-configuration/environment-variables/
-    process.env['CM_COMMIT'] ||
+    readCommitEnvVar('CM_COMMIT') ||
     // Cloudflare Pages - https://developers.cloudflare.com/pages/platform/build-configuration/#environment-variables
-    process.env['CF_PAGES_COMMIT_SHA'] ||
+    readCommitEnvVar('CF_PAGES_COMMIT_SHA') ||
     // Drone - https://docs.drone.io/pipeline/environment/reference/
-    process.env['DRONE_COMMIT_SHA'] ||
+    readCommitEnvVar('DRONE_COMMIT_SHA') ||
     // Flightcontrol - https://www.flightcontrol.dev/docs/guides/flightcontrol/environment-variables#built-in-environment-variables
-    process.env['FC_GIT_COMMIT_SHA'] ||
+    readCommitEnvVar('FC_GIT_COMMIT_SHA') ||
     // Heroku #1 https://devcenter.heroku.com/articles/heroku-ci
-    process.env['HEROKU_TEST_RUN_COMMIT_VERSION'] ||
+    readCommitEnvVar('HEROKU_TEST_RUN_COMMIT_VERSION') ||
     // Heroku #2 https://docs.sentry.io/product/integrations/deployment/heroku/#configure-releases
-    process.env['HEROKU_SLUG_COMMIT'] ||
+    readCommitEnvVar('HEROKU_SLUG_COMMIT') ||
     // Railway - https://docs.railway.app/reference/variables#git-variables
-    process.env['RAILWAY_GIT_COMMIT_SHA'] ||
+    readCommitEnvVar('RAILWAY_GIT_COMMIT_SHA') ||
     // Render - https://render.com/docs/environment-variables
-    process.env['RENDER_GIT_COMMIT'] ||
+    readCommitEnvVar('RENDER_GIT_COMMIT') ||
     // Semaphore CI - https://docs.semaphoreci.com/ci-cd-environment/environment-variables
-    process.env['SEMAPHORE_GIT_SHA'] ||
+    readCommitEnvVar('SEMAPHORE_GIT_SHA') ||
     // TravisCI - https://docs.travis-ci.com/user/environment-variables/#default-environment-variables
-    process.env['TRAVIS_PULL_REQUEST_SHA'] ||
+    readCommitEnvVar('TRAVIS_PULL_REQUEST_SHA') ||
     // Vercel - https://vercel.com/docs/v2/build-step#system-environment-variables
-    process.env['VERCEL_GIT_COMMIT_SHA'] ||
-    process.env['VERCEL_GITHUB_COMMIT_SHA'] ||
-    process.env['VERCEL_GITLAB_COMMIT_SHA'] ||
-    process.env['VERCEL_BITBUCKET_COMMIT_SHA'] ||
+    readCommitEnvVar('VERCEL_GIT_COMMIT_SHA') ||
+    readCommitEnvVar('VERCEL_GITHUB_COMMIT_SHA') ||
+    readCommitEnvVar('VERCEL_GITLAB_COMMIT_SHA') ||
+    readCommitEnvVar('VERCEL_BITBUCKET_COMMIT_SHA') ||
     // Zeit (now known as Vercel)
-    process.env['ZEIT_GITHUB_COMMIT_SHA'] ||
-    process.env['ZEIT_GITLAB_COMMIT_SHA'] ||
-    process.env['ZEIT_BITBUCKET_COMMIT_SHA'];
+    readCommitEnvVar('ZEIT_GITHUB_COMMIT_SHA') ||
+    readCommitEnvVar('ZEIT_GITLAB_COMMIT_SHA') ||
+    readCommitEnvVar('ZEIT_BITBUCKET_COMMIT_SHA');
 
-  const possibleReleaseNameOfCiProvidersWithGenericEnvVar =
+  const possibleReleaseNameOfCiProvidersWithGenericEnvVar = (): string | undefined =>
     // CloudBees CodeShip - https://docs.cloudbees.com/docs/cloudbees-codeship/latest/pro-builds-and-configuration/environment-variables
-    process.env['CI_COMMIT_ID'] ||
+    readCommitEnvVar('CI_COMMIT_ID') ||
     // Coolify - https://coolify.io/docs/knowledge-base/environment-variables
-    process.env['SOURCE_COMMIT'] ||
+    readCommitEnvVar('SOURCE_COMMIT') ||
     // Heroku #3 https://devcenter.heroku.com/changelog-items/630
-    process.env['SOURCE_VERSION'] ||
+    readCommitEnvVar('SOURCE_VERSION') ||
     // Jenkins - https://plugins.jenkins.io/git/#environment-variables
-    process.env['GIT_COMMIT'] ||
+    readCommitEnvVar('GIT_COMMIT') ||
     // Netlify - https://docs.netlify.com/configure-builds/environment-variables/#build-metadata
-    process.env['COMMIT_REF'] ||
+    readCommitEnvVar('COMMIT_REF') ||
     // TeamCity - https://www.jetbrains.com/help/teamcity/predefined-build-parameters.html
-    process.env['BUILD_VCS_NUMBER'] ||
-    // Woodpecker CI - https://woodpecker-ci.org/docs/usage/environment
-    process.env['CI_COMMIT_SHA'];
+    readCommitEnvVar('BUILD_VCS_NUMBER');
+  // Woodpecker CI (https://woodpecker-ci.org/docs/usage/environment) sets CI_COMMIT_SHA, which the
+  // GitLab check above already reads.
 
   return (
-    possibleReleaseNameOfGitProvider ||
-    possibleReleaseNameOfCiProvidersWithSpecificEnvVar ||
-    possibleReleaseNameOfCiProvidersWithGenericEnvVar ||
+    possibleReleaseNameOfGitProvider() ||
+    possibleReleaseNameOfCiProvidersWithSpecificEnvVar() ||
+    possibleReleaseNameOfCiProvidersWithGenericEnvVar() ||
     gitRevision()
   );
 }
 
+// Release detection and commit association can read the same variable in one build.
+const warnedPlaceholderEnvVars = new Set<string>();
+
+/**
+ * Reads an environment variable that should hold a commit SHA. A value that is the variable's own
+ * name, such as `VERCEL_GIT_COMMIT_SHA=VERCEL_GIT_COMMIT_SHA`, is ignored: it never changes, so as
+ * a release name it would put every build into one release.
+ */
+export function readCommitEnvVar(name: string): string | undefined {
+  const value = process.env[name];
+  if (value?.trim() === name) {
+    if (!warnedPlaceholderEnvVars.has(name)) {
+      warnedPlaceholderEnvVars.add(name);
+      // This runs before the plugin logger exists, so `silent: true` does not suppress it. That is
+      // deliberate: a warning that is easy to miss is how this misconfiguration went unnoticed.
+      // eslint-disable-next-line no-console
+      console.warn(
+        `[@sentry/bundler-plugins] Ignoring the ${name} environment variable as a release name, because its value is its own name. Set the release explicitly, or fix the variable in your build environment.`,
+      );
+    }
+    return undefined;
+  }
+  return value;
+}
+
 function stringifyForCodeInjection(value: unknown): string | undefined {
   // Bundles may be inlined in HTML, where JSON quoting does not escape script tags or HTML comments.
   return JSON.stringify(value)?.replace(/</g, '\\u003c');

packages/bundler-plugins/test/core/option-mappings.test.ts

@@ -179,6 +179,36 @@ describe('normalizeUserOptions()', () => {
       expect(normalizedOptions.release.deploy).toEqual(manualDeployConfig);
     });
 
+    test('should associate commits from Vercel env vars on production builds', () => {
+      process.env['VERCEL'] = '1';
+      process.env['VERCEL_TARGET_ENV'] = 'production';
+      process.env['VERCEL_GIT_COMMIT_SHA'] = 'abc123';
+      process.env['VERCEL_GIT_PREVIOUS_SHA'] = 'def456';
+      process.env['VERCEL_GIT_REPO_OWNER'] = 'my-owner';
+      process.env['VERCEL_GIT_REPO_SLUG'] = 'my-repo';
+
+      const normalizedOptions = normalizeUserOptions({ release: { name: 'my-release' } });
+
+      expect(normalizedOptions.release.setCommits).toEqual(
+        expect.objectContaining({ commit: 'abc123', previousCommit: 'def456', repo: 'my-owner/my-repo' }),
+      );
+    });
+
+    test('should fall back to automatic commit association when VERCEL_GIT_COMMIT_SHA is its own name', () => {
+      vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+      process.env['VERCEL'] = '1';
+      process.env['VERCEL_TARGET_ENV'] = 'production';
+      process.env['VERCEL_GIT_COMMIT_SHA'] = 'VERCEL_GIT_COMMIT_SHA';
+      process.env['VERCEL_GIT_REPO_OWNER'] = 'my-owner';
+      process.env['VERCEL_GIT_REPO_SLUG'] = 'my-repo';
+
+      const normalizedOptions = normalizeUserOptions({ release: { name: 'my-release' } });
+
+      expect(normalizedOptions.release.setCommits).toEqual(expect.objectContaining({ auto: true }));
+      expect(normalizedOptions.release.setCommits).not.toHaveProperty('commit');
+      vi.restoreAllMocks();
+    });
+
     test('should not create deploy config when Vercel env vars are missing', () => {
       const userOptions: Options = {
         org: 'my-org',

packages/bundler-plugins/test/core/utils.test.ts

@@ -345,4 +345,45 @@ describe('determineReleaseName', () => {
       execSyncSpy.mockRestore();
     }
   });
+  it('ignores a commit env var whose value is its own name', () => {
+    const originalEnv = process.env;
+    process.env = { VERCEL_GIT_COMMIT_SHA: 'VERCEL_GIT_COMMIT_SHA', COMMIT_REF: 'abc123' };
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+
+    try {
+      expect(determineReleaseName()).toBe('abc123');
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('VERCEL_GIT_COMMIT_SHA'));
+    } finally {
+      process.env = originalEnv;
+      warnSpy.mockRestore();
+    }
+  });
+  it('does not warn about a placeholder checked after the variable that supplies the release', () => {
+    const originalEnv = process.env;
+    process.env = { VERCEL_GIT_COMMIT_SHA: 'abc123', COMMIT_REF: 'COMMIT_REF' };
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+
+    try {
+      expect(determineReleaseName()).toBe('abc123');
+      expect(warnSpy).not.toHaveBeenCalled();
+    } finally {
+      process.env = originalEnv;
+      warnSpy.mockRestore();
+    }
+  });
+  it('warns once about a CI_COMMIT_SHA placeholder', () => {
+    const originalEnv = process.env;
+    process.env = { CI_COMMIT_SHA: 'CI_COMMIT_SHA' };
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const execSyncSpy = vi.spyOn(childProcess, 'execSync').mockReturnValue(Buffer.from('0'.repeat(40)));
+
+    try {
+      expect(determineReleaseName()).toBe('0'.repeat(40));
+      expect(warnSpy).toHaveBeenCalledTimes(1);
+    } finally {
+      process.env = originalEnv;
+      warnSpy.mockRestore();
+      execSyncSpy.mockRestore();
+    }
+  });
 });