fix(core): Restore tarball script permissions and missing EAS build hook by antonis · Pull Request #6049 · getsentry/sentry-react-native

antonis · 2026-04-27T08:08:13Z

📢 Type of change

Bugfix
New feature
Enhancement
Refactoring

📜 Description

8.9.1 shipped two regressions caused by switching packages/core/scripts/build-tarball.sh from npm pack to yarn pack in #6037:

Executable bit stripped on shell scripts. yarn pack stores files with mode 0644. scripts/sentry-xcode.sh, invoked directly by Xcode's build phase, fails with Permission denied ([8.9.1] ../node_modules/@sentry/react-native/scripts/sentry-xcode.sh: Permission denied #6047).
scripts/eas-build-hook.js missing from the tarball. yarn pack does not auto-include files referenced from the bin field; npm pack did. The file has never been in the .npmignore allowlist, so the three sentry-eas-build-on-{success,error,complete} bin commands silently stopped working in 8.9.1 (#6048 follow-up).

Changes:

packages/core/scripts/build-tarball.sh — after yarn pack, extract → chmod 0755 on scripts/*.sh and the two bin .js entries → re-pack.
packages/core/.npmignore — allow scripts/eas-build-hook.js.
.github/workflows/buildandtest.yml — new job_validate_tarball job that installs the produced tarball into a fresh project and asserts script modes, bin links, post-install executability of sentry-xcode.sh, and that workspace:* specs were resolved.

Note: this PR fixes only the bin-scripts follow-up of #6048. The primary bug in that issue (config plugin not applied during EAS cloud prebuild) is unrelated and stays open.

💡 Motivation and Context

8.9.1 reached npm with a broken tarball: iOS builds break with Permission denied, and the EAS build-hook bin commands no longer resolve. Both ship the same week and share the same root cause. Users currently downgrade to 8.8.0 as a workaround.

Fixes #6047. Fixes the bin-scripts portion of #6048.

💚 How did you test it?

Locally:

Built the tarball with the new build-tarball.sh and inspected with tar -tvf: all *.sh files and both bin *.js entries are 0755; eas-build-hook.js is present.
Installed the tarball into a fresh npm init -y project: all four sentry-eas-build-* / sentry-expo-upload-sourcemaps bin links resolve and are executable; scripts/sentry-xcode.sh is -rwxr-xr-x post-install; package.json no longer contains workspace: strings.
The new CI job runs the same checks against the artifact built in job_build.

📝 Checklist

I added tests to verify changes
No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled
I updated the docs if needed.
I updated the wizard if needed.
All tests passing
No breaking changes

🔮 Next steps

Changelog entry will be added once this PR has a number to reference.

🤖 Generated with Claude Code

The npm pack -> yarn pack switch in #6037 introduced two regressions: 1. yarn pack stores files with mode 0644. scripts/sentry-xcode.sh, invoked directly by Xcode's build phase, fails with "Permission denied" (#6047). Re-pack the tarball after yarn pack to restore 0755 on shell scripts and bin entrypoints. 2. yarn pack does not auto-include files referenced from the bin field. scripts/eas-build-hook.js was never in the .npmignore allowlist, so the three sentry-eas-build-* bin commands silently stopped working in the tarball (#6048 follow-up). Add it to the allowlist. Add a job_validate_tarball CI job that installs the produced tarball into a fresh project and asserts script modes, bin links, post-install executability, and that workspace:* specs were resolved. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

antonis · 2026-04-27T08:15:41Z

@sentry review

antonis · 2026-04-27T08:15:51Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit bb63082. Configure here.}

github-actions · 2026-04-27T08:26:38Z

Android (legacy) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	399.46 ms	418.80 ms	19.34 ms
Size	43.75 MiB	48.14 MiB	4.39 MiB

github-actions · 2026-04-27T08:28:07Z

iOS (legacy) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	1212.62 ms	1207.94 ms	-4.68 ms
Size	3.38 MiB	4.77 MiB	1.39 MiB

sentry · 2026-04-27T08:29:03Z

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
Sentry RN	io.sentry.reactnative.sample	8.9.1 (84)	Release

⚙️ sentry-react-native Build Distribution Settings

github-actions · 2026-04-27T08:39:17Z

Android (new) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	366.00 ms	433.76 ms	67.76 ms
Size	43.94 MiB	49.00 MiB	5.06 MiB

github-actions · 2026-04-27T08:39:57Z

iOS (new) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	1228.13 ms	1227.24 ms	-0.89 ms
Size	3.38 MiB	4.77 MiB	1.39 MiB

* fix(core): Restore tarball script permissions and missing EAS build hook (#6049) * fix(core): Restore tarball script permissions and missing EAS build hook The npm pack -> yarn pack switch in #6037 introduced two regressions: 1. yarn pack stores files with mode 0644. scripts/sentry-xcode.sh, invoked directly by Xcode's build phase, fails with "Permission denied" (#6047). Re-pack the tarball after yarn pack to restore 0755 on shell scripts and bin entrypoints. 2. yarn pack does not auto-include files referenced from the bin field. scripts/eas-build-hook.js was never in the .npmignore allowlist, so the three sentry-eas-build-* bin commands silently stopped working in the tarball (#6048 follow-up). Add it to the allowlist. Add a job_validate_tarball CI job that installs the produced tarball into a fresh project and asserts script modes, bin links, post-install executability, and that workspace:* specs were resolved. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs: Update changelog Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(ci): Install both tarballs in validate job to satisfy cross-dep (#6052) The validate job ran `npm install <core tarball>` only. The published core package.json declares `@sentry/expo-upload-sourcemaps` at the same version as core (workspace:* is resolved at pack time). On a release branch the bumped version is not on the npm registry yet, so npm tried to fetch from registry and failed with ETARGET (e.g. when releasing 8.9.2: "No matching version found for @sentry/expo-upload-sourcemaps@8.9.2"). Install both tarballs together so the sister dep is satisfied from local. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * release: 8.9.2 --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: antonis <304044+antonis@users.noreply.github.com> Co-authored-by: sentry-release-bot[bot] <180476844+sentry-release-bot[bot]@users.noreply.github.com>

antonis and others added 2 commits April 27, 2026 10:07

docs: Update changelog

bb63082

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

antonis added the ready-to-merge Triggers the full CI test suite label Apr 27, 2026

cursor Bot reviewed Apr 27, 2026

View reviewed changes

antonis marked this pull request as ready for review April 27, 2026 08:43

antonis requested review from alwx and lucas-zimerman as code owners April 27, 2026 08:43

alwx approved these changes Apr 27, 2026

View reviewed changes

antonis merged commit 3898899 into release/8.9.1 Apr 27, 2026
187 of 203 checks passed

antonis deleted the fix/8.9.2-tarball-perms-and-eas-bin branch April 27, 2026 09:16

sentry-release-bot Bot mentioned this pull request Apr 27, 2026

publish: getsentry/sentry-react-native@8.9.2 getsentry/publish#7951

Closed

3 tasks

antonis mentioned this pull request Apr 27, 2026

fix(ci): Install both tarballs in validate job to satisfy cross-dep #6052

Merged

10 tasks

sentry-release-bot Bot mentioned this pull request Apr 27, 2026

publish: getsentry/sentry-react-native@8.9.2 getsentry/publish#7952

Closed

3 tasks

antonis mentioned this pull request Apr 27, 2026

chore: Back-merge release/8.9.1 into main #6055

Merged

11 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(core): Restore tarball script permissions and missing EAS build hook#6049

fix(core): Restore tarball script permissions and missing EAS build hook#6049
antonis merged 2 commits intorelease/8.9.1from
fix/8.9.2-tarball-perms-and-eas-bin

antonis commented Apr 27, 2026 •

edited

Loading

Uh oh!

antonis commented Apr 27, 2026

Uh oh!

antonis commented Apr 27, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

sentry Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

antonis commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📢 Type of change

📜 Description

💡 Motivation and Context

💚 How did you test it?

📝 Checklist

🔮 Next steps

Uh oh!

antonis commented Apr 27, 2026

Uh oh!

antonis commented Apr 27, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 27, 2026

Android (legacy) Performance metrics 🚀

Uh oh!

github-actions Bot commented Apr 27, 2026

iOS (legacy) Performance metrics 🚀

Uh oh!

sentry Bot commented Apr 27, 2026

📲 Install Builds

Android

Uh oh!

github-actions Bot commented Apr 27, 2026

Android (new) Performance metrics 🚀

Uh oh!

github-actions Bot commented Apr 27, 2026

iOS (new) Performance metrics 🚀

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

antonis commented Apr 27, 2026 •

edited

Loading