Automate Sentry JS SDK version updates

.github/workflows/update-deps.yml

@@ -27,6 +27,14 @@ jobs:
     secrets:
       api-token: ${{ secrets.CI_DEPLOY_KEY }}
 
+  js:
+    uses: getsentry/github-workflows/.github/workflows/updater.yml@v2
+    with:
+      path: flutter/scripts/update-js.sh
+      name: JavaScript SDK
+    secrets:
+      api-token: ${{ secrets.CI_DEPLOY_KEY }}
+
   native:
     uses: getsentry/github-workflows/.github/workflows/updater.yml@v2
     with:

CHANGELOG.md

@@ -15,6 +15,10 @@
   - [changelog](https://github.com/getsentry/sentry-native/blob/master/CHANGELOG.md#091)
   - [diff](https://github.com/getsentry/sentry-native/compare/0.9.0...0.9.1)
 
+## Internal
+
+- Automate Sentry JS SDK version updates ([#3080](https://github.com/getsentry/sentry-dart/pull/3080))
+
 ## 9.4.1
 
 ### Fixes

flutter/lib/src/web/sentry_js_bundle.dart

@@ -1,24 +1,23 @@
 import 'package:meta/meta.dart';
+import 'sentry_js_sdk_version.dart';
 
-// todo: set up ci to update this and the integrity
+// The JS SDK version is automatically bumped by CI via `update-js.sh`.
 @internal
-const jsSdkVersion = '9.5.0';
+const jsSdkVersion = sentryJsSdkVersion;
 
 // The URLs from which the script should be downloaded.
 @internal
 const productionScripts = [
   {
     'url': 'https://browser.sentry-cdn.com/$jsSdkVersion/bundle.tracing.min.js',
-    'integrity':
-        'sha384-nsiByevQ25GvAyX+c3T3VctX7x10qZpYsLt3dfkBt04A71M451kWQEu+K4r1Uuk3'
+    'integrity': productionIntegrity,
   }
 ];
 
 @internal
 const debugScripts = [
   {
     'url': 'https://browser.sentry-cdn.com/$jsSdkVersion/bundle.tracing.js',
-    'integrity':
-        'sha384-Iw737zuRcOiGNbRmsWBSA17nCEbheKhfoqbG/3/9JScn1+WV/V6KdisyboGHqovH'
+    'integrity': debugIntegrity,
   },
 ];

flutter/lib/src/web/sentry_js_sdk_version.dart

@@ -0,0 +1,13 @@
+import 'package:meta/meta.dart';
+
+/// DO NOT EDIT – generated by scripts/update-js.sh
+@internal
+const sentryJsSdkVersion = '9.5.0';
+
+@internal
+const productionIntegrity =
+    'sha384-nsiByevQ25GvAyX+c3T3VctX7x10qZpYsLt3dfkBt04A71M451kWQEu+K4r1Uuk3';
+
+@internal
+const debugIntegrity =
+    'sha384-Iw737zuRcOiGNbRmsWBSA17nCEbheKhfoqbG/3/9JScn1+WV/V6KdisyboGHqovH';

flutter/scripts/update-js.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# This script bumps the Sentry JavaScript SDK used by the Flutter web integration.
+# The expected interface is identical to the other updater scripts used by the
+# monorepo so that it can be consumed by the generic getsentry/updater workflow.
+#
+# Usage: ./update-js.sh <command>
+#   get-version   – prints the currently used SDK version (read from sentry-js-sdk.yaml)
+#   get-repo      – prints the upstream Git repository URL
+#   set-version X – updates the version to X, refreshes integrity hashes and
+#                   regenerates the Dart constant file used by the web runtime
+
+VERSION_DART_FILE="$(git rev-parse --show-toplevel)/flutter/lib/src/web/sentry_js_sdk_version.dart"
+
+get_current_version() {
+  awk -F"'" '/sentryJsSdkVersion/ { print $2 }' "$VERSION_DART_FILE"
+}
+
+# Regenerates the Dart helper that exposes the SDK version as a compile-time
+# constant so that the rest of the code can simply import it.
+write_version_dart() {
+  local version="$1"
+  local integrity_prod="$2"
+  local integrity_dbg="$3"
+  cat >"$VERSION_DART_FILE" <<EOF
+import 'package:meta/meta.dart';
+
+/// DO NOT EDIT – generated by scripts/update-js.sh
+@internal
+const sentryJsSdkVersion = '$version';
+
+@internal
+const productionIntegrity =
+    'sha384-$integrity_prod';
+
+@internal
+const debugIntegrity =
+    'sha384-$integrity_dbg';
+EOF
+}
+
+case "${1:-}" in
+  get-version)
+    get_current_version
+    ;;
+
+  get-repo)
+    echo "https://github.com/getsentry/sentry-javascript.git"
+    ;;
+
+  set-version)
+    new_version="$2"
+
+    # Fetch SRI hashes for the given version.
+    min_js_url="https://browser.sentry-cdn.com/$new_version/bundle.tracing.min.js"
+    dbg_js_url="https://browser.sentry-cdn.com/$new_version/bundle.tracing.js"
+
+    # Compute the SHA-384 SRI hashes (without the sha384- prefix)
+    integrity_prod=$(curl -sSL "$min_js_url" | openssl dgst -sha384 -binary | openssl base64 -A)
+    integrity_dbg=$(curl -sSL "$dbg_js_url" | openssl dgst -sha384 -binary | openssl base64 -A)
+
+    # Persist changes
+    write_version_dart "$new_version" "$integrity_prod" "$integrity_dbg"
+    ;;
+
+  *)
+    echo "Unknown argument $1" >&2
+    exit 1
+    ;;
+esac