From ff8514edacc470ab830db25f1b357ecfa7879b62 Mon Sep 17 00:00:00 2001
From: Nico Hinderling <NicoHinderling@users.noreply.github.com>
Date: Thu, 3 Sep 2026 14:03:07 -0700
Subject: [PATCH 1/2] ci(options): Validate sentry-options schema changes on
 PRs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the sentry-options schema-validation workflow from the onboarding
guide. It runs on PRs that touch sentry-options/schemas, catching both
malformed schemas and illegal schema evolution — changing an option's
type or default, and other backward-incompatible edits — before they
reach the automator and break deployed readers.

The test suite's init() only checks a schema is well-formed; it can't
see the previous schema, so this closes the evolution-safety gap. The
CLI version is parsed from uv.lock so validation runs the same
sentry-options version the service pins.
---
 .github/workflows/validate-sentry-options.yml | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/workflows/validate-sentry-options.yml

diff --git a/.github/workflows/validate-sentry-options.yml b/.github/workflows/validate-sentry-options.yml
new file mode 100644
index 00000000..2117705c
--- /dev/null
+++ b/.github/workflows/validate-sentry-options.yml
@@ -0,0 +1,39 @@
+name: Validate Sentry Options Schema
+
+on:
+  pull_request:
+    paths:
+      - 'sentry-options/schemas/**'
+      - 'uv.lock'
+      - '.github/workflows/validate-sentry-options.yml'
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  cli-version:
+    name: Determine sentry-options CLI version
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          sparse-checkout: uv.lock
+          sparse-checkout-cone-mode: false
+      - name: Parse sentry-options version from uv.lock
+        id: version
+        run: |
+          echo -n "version=" >> "$GITHUB_OUTPUT"
+          yq -p toml -oy '.package[] | select(.name == "sentry-options") | .version' uv.lock >> "$GITHUB_OUTPUT"
+
+  validate-schema:
+    needs: cli-version
+    name: Validate Schema Evolution
+    uses: getsentry/sentry-options/.github/workflows/validate-schema.yml@2cc89b0011942ca3593f5c20e89de2baa414ed41 # 1.2.9
+    secrets: inherit
+    with:
+      schemas-path: sentry-options/schemas
+      cli-version: ${{ needs.cli-version.outputs.version }}

From c63c9a0bfe82c56c661b1303a627a0ecf2f373fb Mon Sep 17 00:00:00 2001
From: Nico Hinderling <NicoHinderling@users.noreply.github.com>
Date: Thu, 3 Sep 2026 14:36:04 -0700
Subject: [PATCH 2/2] ci(options): Restrict GITHUB_TOKEN permissions in schema
 workflow

Add an explicit top-level `permissions: contents: read` so the workflow
does not inherit the default broad GITHUB_TOKEN scope (flagged by
CodeQL). Read access is all the checkout and the reusable validation
workflow need.
---
 .github/workflows/validate-sentry-options.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/validate-sentry-options.yml b/.github/workflows/validate-sentry-options.yml
index 2117705c..32e8e244 100644
--- a/.github/workflows/validate-sentry-options.yml
+++ b/.github/workflows/validate-sentry-options.yml
@@ -12,6 +12,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   cli-version:
     name: Determine sentry-options CLI version