fix(node,vercel-edge,bundler-plugins): INC-2566 - Ignore commit env vars set to their own name (#25244)

Some builds have `VERCEL_GIT_COMMIT_SHA` set to the literal string
`VERCEL_GIT_COMMIT_SHA` instead of a SHA. Release auto-detection took
that value as the release name, so every build of the app uploaded its
source maps into, and reported events against, one release that never
changes.

This is not theoretical: Sentry has received source map uploads and
events whose release is the literal string `VERCEL_GIT_COMMIT_SHA` from
a number of organizations deploying on Vercel. Some were large enough to
contribute to [INC-2566](https://firetower.getsentry.net/INC-2566). How
those builds end up with that value is still being investigated;
getsentry/sentry#127101 logs the placeholder name at upload time to help
with that. This guard stops the value from becoming the release either
way.

Release detection in the bundler plugins and the Node and Vercel Edge
SDKs now skips a commit env var whose value is its own name, warns, and
moves on to the next candidate. Candidates are read in order and only
until one is found, so a placeholder is only warned about when it would
otherwise have become the release. In the bundler plugins, the Vercel
commit association in `setCommits` uses the same check, so a placeholder
SHA falls back to automatic commit association instead of being sent as
the commit.

Claude-Session: https://claude.ai/code/session_01WgDm3ijhQZQUHGAFFqQzKQ

Co-authored-by: Claude <noreply@anthropic.com>

Author: mwarkentin

packages/bundler-plugins/src/core/options-mapping.ts

@@ -9,7 +9,7 @@ import type {
   ModuleMetadata,
   ModuleMetadataCallback,
 } from './types';
-import { determineReleaseName } from './utils';
+import { determineReleaseName, readCommitEnvVar } from './utils';
 
 export type NormalizedOptions = {
   org: string | undefined;
@@ -135,9 +135,10 @@ export function normalizeUserOptions(userOptions: UserOptions): NormalizedOption
   };
 
   if (options.release.setCommits === undefined) {
+    const vercelCommitSha = readCommitEnvVar('VERCEL_GIT_COMMIT_SHA');
     if (
       process.env['VERCEL'] &&
-      process.env['VERCEL_GIT_COMMIT_SHA'] &&
+      vercelCommitSha &&
       process.env['VERCEL_GIT_REPO_SLUG'] &&
       process.env['VERCEL_GIT_REPO_OWNER'] &&
       // We only want to set commits for the production env because Sentry becomes extremely noisy (eg on slack) for
@@ -147,8 +148,8 @@ export function normalizeUserOptions(userOptions: UserOptions): NormalizedOption
     ) {
       options.release.setCommits = {
         shouldNotThrowOnFailure: true,
-        commit: process.env['VERCEL_GIT_COMMIT_SHA'],
-        previousCommit: process.env['VERCEL_GIT_PREVIOUS_SHA'],
+        commit: vercelCommitSha,
+        previousCommit: readCommitEnvVar('VERCEL_GIT_PREVIOUS_SHA'),
         repo: `${process.env['VERCEL_GIT_REPO_OWNER']}/${process.env['VERCEL_GIT_REPO_SLUG']}`,
         ignoreEmpty: true,
         ignoreMissing: true,

packages/bundler-plugins/src/core/utils.ts

@@ -221,93 +221,120 @@ export function determineReleaseName(): string | undefined {
   // 1. Git providers
   // 2. CI providers with specific environment variables (has the provider name in the variable name)
   // 3. CI providers with generic environment variables (checked for last to prevent possible false positives)
+  // Each group is only read if the earlier ones found nothing, so a placeholder value is only
+  // warned about when it would otherwise have become the release.
 
-  const possibleReleaseNameOfGitProvider =
+  const possibleReleaseNameOfGitProvider = (): string | undefined =>
     // GitHub Actions - https://help.github.com/en/actions/configuring-and-managing-workflows/using-environment-variables#default-environment-variables
-    process.env['GITHUB_SHA'] ||
+    readCommitEnvVar('GITHUB_SHA') ||
     // GitLab CI - https://docs.gitlab.com/ee/ci/variables/predefined_variables.html
-    process.env['CI_MERGE_REQUEST_SOURCE_BRANCH_SHA'] ||
-    process.env['CI_BUILD_REF'] ||
-    process.env['CI_COMMIT_SHA'] ||
+    readCommitEnvVar('CI_MERGE_REQUEST_SOURCE_BRANCH_SHA') ||
+    readCommitEnvVar('CI_BUILD_REF') ||
+    readCommitEnvVar('CI_COMMIT_SHA') ||
     // Bitbucket - https://support.atlassian.com/bitbucket-cloud/docs/variables-and-secrets/
-    process.env['BITBUCKET_COMMIT'];
+    readCommitEnvVar('BITBUCKET_COMMIT');
 
-  const possibleReleaseNameOfCiProvidersWithSpecificEnvVar =
+  const possibleReleaseNameOfCiProvidersWithSpecificEnvVar = (): string | undefined =>
     // AppVeyor - https://www.appveyor.com/docs/environment-variables/
-    process.env['APPVEYOR_PULL_REQUEST_HEAD_COMMIT'] ||
-    process.env['APPVEYOR_REPO_COMMIT'] ||
+    readCommitEnvVar('APPVEYOR_PULL_REQUEST_HEAD_COMMIT') ||
+    readCommitEnvVar('APPVEYOR_REPO_COMMIT') ||
     // AWS CodeBuild - https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-env-vars.html
-    process.env['CODEBUILD_RESOLVED_SOURCE_VERSION'] ||
+    readCommitEnvVar('CODEBUILD_RESOLVED_SOURCE_VERSION') ||
     // AWS Amplify - https://docs.aws.amazon.com/amplify/latest/userguide/environment-variables.html
-    process.env['AWS_COMMIT_ID'] ||
+    readCommitEnvVar('AWS_COMMIT_ID') ||
     // Azure Pipelines - https://docs.microsoft.com/en-us/azure/devops/pipelines/build/variables?view=azure-devops&tabs=yaml
-    process.env['BUILD_SOURCEVERSION'] ||
+    readCommitEnvVar('BUILD_SOURCEVERSION') ||
     // Bitrise - https://devcenter.bitrise.io/builds/available-environment-variables/
-    process.env['GIT_CLONE_COMMIT_HASH'] ||
+    readCommitEnvVar('GIT_CLONE_COMMIT_HASH') ||
     // Buddy CI - https://buddy.works/docs/pipelines/environment-variables#default-environment-variables
-    process.env['BUDDY_EXECUTION_REVISION'] ||
+    readCommitEnvVar('BUDDY_EXECUTION_REVISION') ||
     // Builtkite - https://buildkite.com/docs/pipelines/environment-variables
-    process.env['BUILDKITE_COMMIT'] ||
+    readCommitEnvVar('BUILDKITE_COMMIT') ||
     // CircleCI - https://circleci.com/docs/variables/
-    process.env['CIRCLE_SHA1'] ||
+    readCommitEnvVar('CIRCLE_SHA1') ||
     // Cirrus CI - https://cirrus-ci.org/guide/writing-tasks/#environment-variables
-    process.env['CIRRUS_CHANGE_IN_REPO'] ||
+    readCommitEnvVar('CIRRUS_CHANGE_IN_REPO') ||
     // Codefresh - https://codefresh.io/docs/docs/codefresh-yaml/variables/
-    process.env['CF_REVISION'] ||
+    readCommitEnvVar('CF_REVISION') ||
     // Codemagic - https://docs.codemagic.io/yaml-basic-configuration/environment-variables/
-    process.env['CM_COMMIT'] ||
+    readCommitEnvVar('CM_COMMIT') ||
     // Cloudflare Pages - https://developers.cloudflare.com/pages/platform/build-configuration/#environment-variables
-    process.env['CF_PAGES_COMMIT_SHA'] ||
+    readCommitEnvVar('CF_PAGES_COMMIT_SHA') ||
     // Drone - https://docs.drone.io/pipeline/environment/reference/
-    process.env['DRONE_COMMIT_SHA'] ||
+    readCommitEnvVar('DRONE_COMMIT_SHA') ||
     // Flightcontrol - https://www.flightcontrol.dev/docs/guides/flightcontrol/environment-variables#built-in-environment-variables
-    process.env['FC_GIT_COMMIT_SHA'] ||
+    readCommitEnvVar('FC_GIT_COMMIT_SHA') ||
     // Heroku #1 https://devcenter.heroku.com/articles/heroku-ci
-    process.env['HEROKU_TEST_RUN_COMMIT_VERSION'] ||
+    readCommitEnvVar('HEROKU_TEST_RUN_COMMIT_VERSION') ||
     // Heroku #2 https://docs.sentry.io/product/integrations/deployment/heroku/#configure-releases
-    process.env['HEROKU_SLUG_COMMIT'] ||
+    readCommitEnvVar('HEROKU_SLUG_COMMIT') ||
     // Railway - https://docs.railway.app/reference/variables#git-variables
-    process.env['RAILWAY_GIT_COMMIT_SHA'] ||
+    readCommitEnvVar('RAILWAY_GIT_COMMIT_SHA') ||
     // Render - https://render.com/docs/environment-variables
-    process.env['RENDER_GIT_COMMIT'] ||
+    readCommitEnvVar('RENDER_GIT_COMMIT') ||
     // Semaphore CI - https://docs.semaphoreci.com/ci-cd-environment/environment-variables
-    process.env['SEMAPHORE_GIT_SHA'] ||
+    readCommitEnvVar('SEMAPHORE_GIT_SHA') ||
     // TravisCI - https://docs.travis-ci.com/user/environment-variables/#default-environment-variables
-    process.env['TRAVIS_PULL_REQUEST_SHA'] ||
+    readCommitEnvVar('TRAVIS_PULL_REQUEST_SHA') ||
     // Vercel - https://vercel.com/docs/v2/build-step#system-environment-variables
-    process.env['VERCEL_GIT_COMMIT_SHA'] ||
-    process.env['VERCEL_GITHUB_COMMIT_SHA'] ||
-    process.env['VERCEL_GITLAB_COMMIT_SHA'] ||
-    process.env['VERCEL_BITBUCKET_COMMIT_SHA'] ||
+    readCommitEnvVar('VERCEL_GIT_COMMIT_SHA') ||
+    readCommitEnvVar('VERCEL_GITHUB_COMMIT_SHA') ||
+    readCommitEnvVar('VERCEL_GITLAB_COMMIT_SHA') ||
+    readCommitEnvVar('VERCEL_BITBUCKET_COMMIT_SHA') ||
     // Zeit (now known as Vercel)
-    process.env['ZEIT_GITHUB_COMMIT_SHA'] ||
-    process.env['ZEIT_GITLAB_COMMIT_SHA'] ||
-    process.env['ZEIT_BITBUCKET_COMMIT_SHA'];
+    readCommitEnvVar('ZEIT_GITHUB_COMMIT_SHA') ||
+    readCommitEnvVar('ZEIT_GITLAB_COMMIT_SHA') ||
+    readCommitEnvVar('ZEIT_BITBUCKET_COMMIT_SHA');
 
-  const possibleReleaseNameOfCiProvidersWithGenericEnvVar =
+  const possibleReleaseNameOfCiProvidersWithGenericEnvVar = (): string | undefined =>
     // CloudBees CodeShip - https://docs.cloudbees.com/docs/cloudbees-codeship/latest/pro-builds-and-configuration/environment-variables
-    process.env['CI_COMMIT_ID'] ||
+    readCommitEnvVar('CI_COMMIT_ID') ||
     // Coolify - https://coolify.io/docs/knowledge-base/environment-variables
-    process.env['SOURCE_COMMIT'] ||
+    readCommitEnvVar('SOURCE_COMMIT') ||
     // Heroku #3 https://devcenter.heroku.com/changelog-items/630
-    process.env['SOURCE_VERSION'] ||
+    readCommitEnvVar('SOURCE_VERSION') ||
     // Jenkins - https://plugins.jenkins.io/git/#environment-variables
-    process.env['GIT_COMMIT'] ||
+    readCommitEnvVar('GIT_COMMIT') ||
     // Netlify - https://docs.netlify.com/configure-builds/environment-variables/#build-metadata
-    process.env['COMMIT_REF'] ||
+    readCommitEnvVar('COMMIT_REF') ||
     // TeamCity - https://www.jetbrains.com/help/teamcity/predefined-build-parameters.html
-    process.env['BUILD_VCS_NUMBER'] ||
-    // Woodpecker CI - https://woodpecker-ci.org/docs/usage/environment
-    process.env['CI_COMMIT_SHA'];
+    readCommitEnvVar('BUILD_VCS_NUMBER');
+  // Woodpecker CI (https://woodpecker-ci.org/docs/usage/environment) sets CI_COMMIT_SHA, which the
+  // GitLab check above already reads.
 
   return (
-    possibleReleaseNameOfGitProvider ||
-    possibleReleaseNameOfCiProvidersWithSpecificEnvVar ||
-    possibleReleaseNameOfCiProvidersWithGenericEnvVar ||
+    possibleReleaseNameOfGitProvider() ||
+    possibleReleaseNameOfCiProvidersWithSpecificEnvVar() ||
+    possibleReleaseNameOfCiProvidersWithGenericEnvVar() ||
     gitRevision()
   );
 }
 
+// Release detection and commit association can read the same variable in one build.
+const warnedPlaceholderEnvVars = new Set<string>();
+
+/**
+ * Reads an environment variable that should hold a commit SHA. A value that is the variable's own
+ * name, such as `VERCEL_GIT_COMMIT_SHA=VERCEL_GIT_COMMIT_SHA`, is ignored: it never changes, so as
+ * a release name it would put every build into one release.
+ */
+export function readCommitEnvVar(name: string): string | undefined {
+  const value = process.env[name];
+  if (value?.trim() === name) {
+    if (!warnedPlaceholderEnvVars.has(name)) {
+      warnedPlaceholderEnvVars.add(name);
+      // This runs before the plugin logger exists, so `silent: true` does not suppress it. That is
+      // deliberate: a warning that is easy to miss is how this misconfiguration went unnoticed.
+      // eslint-disable-next-line no-console
+      console.warn(
+        `[@sentry/bundler-plugins] Ignoring the ${name} environment variable as a release name, because its value is its own name. Set the release explicitly, or fix the variable in your build environment.`,
+      );
+    }
+    return undefined;
+  }
+  return value;
+}
+
 function stringifyForCodeInjection(value: unknown): string | undefined {
   // Bundles may be inlined in HTML, where JSON quoting does not escape script tags or HTML comments.
   return JSON.stringify(value)?.replace(/</g, '\\u003c');

packages/bundler-plugins/test/core/option-mappings.test.ts

@@ -179,6 +179,36 @@ describe('normalizeUserOptions()', () => {
       expect(normalizedOptions.release.deploy).toEqual(manualDeployConfig);
     });
 
+    test('should associate commits from Vercel env vars on production builds', () => {
+      process.env['VERCEL'] = '1';
+      process.env['VERCEL_TARGET_ENV'] = 'production';
+      process.env['VERCEL_GIT_COMMIT_SHA'] = 'abc123';
+      process.env['VERCEL_GIT_PREVIOUS_SHA'] = 'def456';
+      process.env['VERCEL_GIT_REPO_OWNER'] = 'my-owner';
+      process.env['VERCEL_GIT_REPO_SLUG'] = 'my-repo';
+
+      const normalizedOptions = normalizeUserOptions({ release: { name: 'my-release' } });
+
+      expect(normalizedOptions.release.setCommits).toEqual(
+        expect.objectContaining({ commit: 'abc123', previousCommit: 'def456', repo: 'my-owner/my-repo' }),
+      );
+    });
+
+    test('should fall back to automatic commit association when VERCEL_GIT_COMMIT_SHA is its own name', () => {
+      vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+      process.env['VERCEL'] = '1';
+      process.env['VERCEL_TARGET_ENV'] = 'production';
+      process.env['VERCEL_GIT_COMMIT_SHA'] = 'VERCEL_GIT_COMMIT_SHA';
+      process.env['VERCEL_GIT_REPO_OWNER'] = 'my-owner';
+      process.env['VERCEL_GIT_REPO_SLUG'] = 'my-repo';
+
+      const normalizedOptions = normalizeUserOptions({ release: { name: 'my-release' } });
+
+      expect(normalizedOptions.release.setCommits).toEqual(expect.objectContaining({ auto: true }));
+      expect(normalizedOptions.release.setCommits).not.toHaveProperty('commit');
+      vi.restoreAllMocks();
+    });
+
     test('should not create deploy config when Vercel env vars are missing', () => {
       const userOptions: Options = {
         org: 'my-org',

packages/bundler-plugins/test/core/utils.test.ts

@@ -345,4 +345,45 @@ describe('determineReleaseName', () => {
       execSyncSpy.mockRestore();
     }
   });
+  it('ignores a commit env var whose value is its own name', () => {
+    const originalEnv = process.env;
+    process.env = { VERCEL_GIT_COMMIT_SHA: 'VERCEL_GIT_COMMIT_SHA', COMMIT_REF: 'abc123' };
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+
+    try {
+      expect(determineReleaseName()).toBe('abc123');
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('VERCEL_GIT_COMMIT_SHA'));
+    } finally {
+      process.env = originalEnv;
+      warnSpy.mockRestore();
+    }
+  });
+  it('does not warn about a placeholder checked after the variable that supplies the release', () => {
+    const originalEnv = process.env;
+    process.env = { VERCEL_GIT_COMMIT_SHA: 'abc123', COMMIT_REF: 'COMMIT_REF' };
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+
+    try {
+      expect(determineReleaseName()).toBe('abc123');
+      expect(warnSpy).not.toHaveBeenCalled();
+    } finally {
+      process.env = originalEnv;
+      warnSpy.mockRestore();
+    }
+  });
+  it('warns once about a CI_COMMIT_SHA placeholder', () => {
+    const originalEnv = process.env;
+    process.env = { CI_COMMIT_SHA: 'CI_COMMIT_SHA' };
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const execSyncSpy = vi.spyOn(childProcess, 'execSync').mockReturnValue(Buffer.from('0'.repeat(40)));
+
+    try {
+      expect(determineReleaseName()).toBe('0'.repeat(40));
+      expect(warnSpy).toHaveBeenCalledTimes(1);
+    } finally {
+      process.env = originalEnv;
+      warnSpy.mockRestore();
+      execSyncSpy.mockRestore();
+    }
+  });
 });