[so0k]

A bundled CLI now loads the handlers that sit next to its own entrypoint instead of always falling back to the shipped bundle/ at the package root. The telemetry delivery e2e, which needs this, now runs in CI as its own job. Part of #48.

What changes

• requireHandlers (cdktn-cli/src/bin/cmds/helper/utilities.ts) probes __dirname/cmds/handlers.js first. In a bundle __dirname is <outdir>/bin, so this is the file the bundle lays down; the old probe, __dirname/../handlers.js, matched no bundle layout. Unbundled code still falls back to <package root>/bundle/bin/cmds/handlers.js.
• tools/validate-sentry-e2e.sh builds a scratch bundle in packages/cdktn-cli/bundle-e2e with a local-sink DSN baked in (CDKTN_BUNDLE_OUTDIR in build.ts, gitignored), starts tools/sentry-sink.mjs on a free port, and runs convert, a failing synth, two stacks and a crashing command. It polls the sink and fails naming the metric that never arrived.
• It asserts the delivered run accounting (one invoked, then one completed or error per run), the per-run stack aggregation, the crash path, and the identity on the wire (install id, cdktn-cli, production). The hostname, username, working directories, stack names, provider hosts and SENTRY_* values must appear nowhere in what the sink received, and the bundle must not reference checkpoint-api.hashicorp.com.
• .github/workflows/telemetry-e2e.yml runs it as its own job, Telemetry E2E, called from pr.yml after quality and build. It runs nx build cdktn-cli, needs no SENTRY_DSN secret, and is skipped by ci/skip-unit. The job is part of the PR - Result gate, and build-and-package is unchanged.

Not in this PR

• The e2e needs pnpm build outputs, not pnpm package: convert --language typescript never reads dist. The script checks for the build outputs first and fails with "run pnpm build first".
• The job does not run on main or in the release workflow.
• Three envelope parsers (telemetry.test.ts, sentry-sink.mjs, error-handling.integration.test.ts) remain separate; a shared test-support helper is a follow-up.

Testing

• Bundle e2e (bash tools/validate-sentry-e2e.sh): the real esbuild bundle, run as child processes against the local sink.
• Unit and child-process suites from the earlier slices still run in the existing unit jobs; no new unit test is needed for the handler probe, which the e2e exercises on every run.
• TIERS.md lists the e2e as its own test tier.

Stack: 6 of 6 — #409 → #410 → #411 → #412 → #413 → #414

[jsteinich]

Reviewed as part of the full tele/s1–tele/s6 stack. The e2e itself is the best part of this whole stack — asserting on a real envelope reaching a real sink from the real esbuild bundle is a much stronger oracle than the mocked unit tests, and the leak assertions are exactly the right set: stack names, resource ids, private-registry hosts, local provider paths, and the SENTRY_ENVIRONMENT / SENTRY_TRACE / SENTRY_BAGGAGE values a user or CI might export. Matching "sentry.environment":{"value":"production" as a key/value adjacency rather than a bare production is a nice touch.

Three things.

1. The title undersells a production code change — please rename

The PR is titled chore(gha): run the telemetry delivery e2e on every build, but it also changes how the shipped CLI resolves its handlers, in packages/cdktn-cli/src/bin/cmds/helper/utilities.ts:

- const filePath = path.join(__dirname, "..", "handlers.js");
+ const filePath = path.join(__dirname, "cmds", "handlers.js");

In the bundle, utilities.ts is inlined into bin/cdktn.js, so __dirname is bundle/bin — meaning the old first branch resolved to bundle/handlers.js, never matched, and every invocation fell through to the projectRootPath() lookup. The new path does match. That's a real behaviour change on the hot path of every command, and it's the right change, but it isn't a chore(gha).

The commit itself is labelled honestly (feat(cli): resolve bundled handlers next to the entrypoint and honour CDKTN_BUNDLE_OUTDIR) — the problem is only the PR title, and this repo allows squash-merge with PR_TITLE as the commit subject. So as it stands this lands as a chore and never appears in the changelog.

Suggest just renaming the PR to cover both, e.g. feat(cli): resolve bundled handlers next to the entrypoint and run the telemetry e2e in CI.

2. Run the e2e as its own job rather than appending to build-and-package

build-and-package is the critical-path job — every other workflow gates on it. This step adds a second full esbuild, four CLI invocations (one of which is cdktn convert, which shells out to init), and a poll loop that waits up to 10 s on a local HTTP sink. A flake or a timeout in any of that now fails the build for everyone, including PRs that touch nothing near telemetry.

A separate job depending on build-and-package would isolate the blast radius and make the failure legible when it does fire. It also fits the existing ci/skip-* label convention, which this step currently sits outside of.

3. The script has an undeclared dependency on pnpm package

cdktn convert resolves dist via pkg.version === "0.0.0" ? dist : undefined, and in-repo the version is 0.0.0 — so the convert trigger needs dist/ to exist. That holds in CI only because the step is appended after pnpm run package in the same job. Run tools/validate-sentry-e2e.sh on a clean checkout locally and it fails somewhere deep inside convert instead of saying what's missing.

Worth an explicit guard near the top:

[ -d "$ROOT/dist" ] || { echo "FAIL: run 'pnpm package' first" >&2; exit 1; }

This becomes more important, not less, if #2 moves it to a separate job where the ordering is no longer implicit.

[so0k]

@jsteinich all three points are addressed; the description is rewritten.

1. Title hid a production change. Agreed. The title is now fix(cli): resolve bundled handlers next to the entrypoint, which is the one shipped change. For the record, what it does: requireHandlers used to probe __dirname/../handlers.js, which matches no bundle layout, so it always fell through to <package root>/bundle/bin/cmds/handlers.js. It now probes __dirname/cmds/handlers.js, where the bundle actually puts the file. In the published package both resolve to the same file, so nothing changes for users. It matters for a bundle built anywhere else, which today is the e2e's scratch bundle: without it, that entrypoint loads the shipped handlers with the real DSN. Reverting the line makes the e2e fail.

2. Own job. Done in dbf40ab. The step is out of build-and-package. .github/workflows/telemetry-e2e.yml is a reusable workflow called from pr.yml as telemetry_e2e, after quality and build, under the same ci/skip-unit condition as the unit tests, and it is in the PR - Result needs list. It follows the sibling workflows' container pin, setup steps and timeouts. It passes no secrets, because it needs none. A side effect: build.yml also triggers on merge_group, so the e2e used to run twice in the merge queue and now runs once. Cost is a cold nx build cdktn-cli per PR, which I have not measured.

3. Undeclared dependency on pnpm package. I checked this and the dependency is on pnpm build, not dist: the script runs convert --language typescript, and handlers.ts only needs a project (and so dist) for other languages. So the guard checks the six build outputs the bundle resolves at runtime and fails with "run pnpm build first" (9bec5a6). A dist guard would have sent the job through the multi-language package step for nothing.

Also changed in the e2e:

• It asserts the per-run aggregation from feat(cli): report aggregated stack, provider and command usage metrics #413 with a second stack sharing two providers (hashicorp/aws 2, summed override and import counts).
• It asserts the identity on the wire exactly: user.id is the random install id, server.address is cdktn-cli, environment is production with SENTRY_ENVIRONMENT set to a sentinel.
• The leak scan now includes the hostname, the username and the working directories, across event items as well as metrics.
• It uses a scratch CDKTF_HOME; it had been writing to the developer's real one.
• The checkpoint-host scan covers the whole bundle, not just the entrypoint.
• Six assertions that could not fail are removed.

One finding to flag. The leak scan showed that opt-in crash reports carry the CLI's absolute install path in stack frames (which includes the username when installed under a home directory) and Sentry's default device, OS and locale contexts. This is not introduced by the stack: main sends the same, plus the real hostname, which #409 removed. It only applies with sendCrashReports: true; usage metrics carry none of it. The e2e currently allows the username inside the install path and nowhere else. Scrubbing frames, breadcrumbs and contexts in Sentry.init will be a follow-up PR rather than a change to #409.

[so0k]

Workflow hardening for the parts this PR adds

Lumen runs zizmor over changed workflows so a PR does not add to the existing findings. Two new ones come from this layer; both are small and worth taking. Scope is deliberately limited to what this PR adds or modifies — the pre-existing findings elsewhere in these files are backlog, not part of this change.

1. .github/workflows/pr.yml:54 — the new telemetry_e2e caller has no explicit permissions

The reusable workflow already restricts its job to contents: read, but the caller relies on the repository default as its upper bound. Set it explicitly on the new job:

  telemetry_e2e:
    name: "Telemetry E2E"
    needs: [quality, build]
    permissions:
      contents: read
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'ci/skip-unit') }}
    uses: ./.github/workflows/telemetry-e2e.yml

(zizmor: excessive-permissions)

2. .github/workflows/telemetry-e2e.yml:28 — checkout keeps credentials it does not need

Install, build, the composite action and the shell steps all run after checkout, and none of them needs Git authentication. Drop the persisted token:

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

(zizmor: artipacked)

One thing to confirm when applying it: the next step runs git config --global --add safe.directory …, which does not need credentials, so nothing later in the job should depend on the persisted token.

Out of scope here

• The other reusable-workflow callers in pr.yml (quality, build, all_unit_tests, examples, integration_test, provider_integration_test) have no permissions block either. They predate this PR; leave them for a separate hardening pass.
• The one pre-existing excessive-permissions finding this PR touches is baseline, not a blocker.

[so0k]

Both applied in 6d381bb: permissions: contents: read on the telemetry_e2e caller and persist-credentials: false on the checkout. No later step in the job uses Git authentication.

zizmor 1.30.0 on pr.yml and telemetry-e2e.yml: 26 findings before, 24 after; the excessive-permissions on the new caller and the artipacked on the new checkout are gone. The remaining ones are the other callers and self-repository hints, left for a separate pass as scoped.