ci: Run package checks from the test.yml matrix

AGENTS.md

@@ -12,6 +12,7 @@ Toolkit contains the Sentry CLI, the Sentry MCP server, and shared code. Product
 
 - **MCP tool count**: Target ≤20, hard limit 25 (AI agents have limited tool slots).
 - **Quality gate**: `pnpm run tsc && pnpm run lint && pnpm run test` must pass before committing.
+- **Package CI**: Put checks for one workspace package in its `package.json` scripts and `sentryCi`, which `test.yml` runs per project. Do not add a workflow for them. See docs/operations/github-actions.md#package-ci-checks.
 
 ## Repository Structure
 
@@ -73,7 +74,7 @@ toolkit/
 - docs/operations/stdio-auth.md — Device code flow, token caching, client ID architecture
 - docs/operations/oauth-signout-playbook.md — Remote OAuth diagnostic runbook
 - docs/operations/embedded-agents.md — LLM provider configuration for AI-powered tools
-- docs/operations/github-actions.md — MCP deployment workflows
+- docs/operations/github-actions.md — CI matrix, `package.json#sentryCi`, and MCP deployment workflows
 - docs/operations/logging.md — Logging guidance
 - docs/operations/monitoring.md — Monitoring guidance
 - docs/operations/token-cost-tracking.md — Tool definition token cost tracking

docs/contributing/quality-checks.md

@@ -12,6 +12,13 @@ Do not proceed if any check fails.
 
 `pnpm run lint` includes `oxfmt --check`. If it fails, run `pnpm run format`.
 
+## Package CI Checks
+
+CI runs each workspace package's build, lint, typecheck, test, and E2E scripts
+from `test.yml`. To add a check for one package, add a script and, if its name
+is not a default, point `package.json#sentryCi` at it. Do not add a workflow.
+See [Package CI checks](../operations/github-actions.md#package-ci-checks).
+
 ## Tool Count Limits
 
 See [adding-tools.md](adding-tools.md#tool-count-limits) for current limits and guidance on when to add vs. combine tools.
@@ -29,4 +36,5 @@ happy-path inline snapshot test. Review tool output snapshots against
 - [ ] Tool count within limits
 - [ ] New tools have tests with inline snapshots
 - [ ] Tool/skill definitions regenerated if tools changed (`pnpm run --filter @sentry/mcp-core generate-definitions`)
+- [ ] Package-specific CI checks are in `package.json#sentryCi`, not a new workflow
 - [ ] Documentation updated if patterns changed

docs/operations/github-actions.md

@@ -18,8 +18,9 @@ docs depend on `sentry`). Root-level changes and non-PR events check every
 enabled project. Each project has its own build, lint, typecheck, test, policy,
 and E2E steps when those scripts exist. The always-present `test` job checks
 discovery, installation, repository quality, and every selected project.
-Package-specific exceptions live in `package.json#sentryCi`; the standalone
-smoke-test suite remains in its own workflow.
+Package-specific checks and exceptions live in `package.json#sentryCi`; see
+[Package CI checks](#package-ci-checks). The standalone smoke-test suite remains
+in its own workflow.
 
 ### deploy.yml
 
@@ -98,6 +99,52 @@ Runs the label publisher's regression tests when its workflow or tests change.
 Covers label replacement, stale revisions, failed classifications, and concurrent
 label creation.
 
+## Package CI checks
+
+Add a check for one workspace package to that package's `package.json`, not to
+a new workflow. `scripts/ci-projects.mjs` reads each package's scripts and its
+`sentryCi` object, and `test.yml` runs the result for every pull request that
+changes the package or one of its workspace dependencies. A path-filtered
+workflow for one package duplicates that selection and is not a required check.
+
+Each step runs a package script. Without a `sentryCi` override, the first
+script that exists is used:
+
+| Field        | Default scripts                | Notes                                                                           |
+| ------------ | ------------------------------ | ------------------------------------------------------------------------------- |
+| `prepare`    | `ci:prepare`                   | Runs before the build.                                                          |
+| `build`      | `build`                        |                                                                                 |
+| `lint`       | `lint`                         |                                                                                 |
+| `typecheck`  | `typecheck`, `tsc`, `check`    |                                                                                 |
+| `test`       | `test:ci`, `test:unit`, `test` |                                                                                 |
+| `policy`     | `ci:policy`                    |                                                                                 |
+| `e2e`        | `ci:e2e`, `test:e2e`           | Runs on Node 24 after the other steps.                                          |
+| `npmRuntime` | none                           | Runs the script, packs the package, and runs its binary on Node 20, 22, and 24. |
+
+Set a field to a script name to override it, or to `false` to skip it. The
+other fields are:
+
+- `coverage`, `junit`: report paths the job verifies, or `false`.
+- `dependencies`: extra workspace packages whose changes select this one.
+- `enabled`: `false` removes the package from the matrix.
+- `roles`: names that `node scripts/ci-projects.mjs --roles NAME` resolves to
+  the package name and path, so a specialized workflow need not hard-code them.
+
+For example, `@sentry/logger` and `@sentry/mcp-server` check their packed
+tarballs from a clean consumer project:
+
+```json
+{
+  "sentryCi": { "e2e": "test:package" },
+  "scripts": { "test:package": "bash test/package/check.sh" }
+}
+```
+
+A new workflow fits only when the matrix job cannot run the check: another
+operating system, a deployment, secrets, or pull request comments and labels.
+`scripts/workflow-policy.test.mjs` fails for a workflow that runs on pull
+requests unless its list names that workflow and the reason.
+
 ## Required Secrets
 
 The `production` environment is restricted to `main` and holds:

package.json

@@ -23,7 +23,7 @@
   },
   "scripts": {
     "docs:check": "node scripts/check-doc-links.mjs",
-    "test:ci-projects": "node --test scripts/ci-projects.test.mjs scripts/cli-nightly-version.test.mjs scripts/cli-nightly-watchdog.test.mjs scripts/cloudflare-deployment.test.mjs scripts/deploy-workflow.test.mjs scripts/migrate-cloudflare-token.test.mjs scripts/oxc-config.test.mjs scripts/cli-lint-rules.test.mjs",
+    "test:ci-projects": "node --test scripts/ci-projects.test.mjs scripts/cli-nightly-version.test.mjs scripts/cli-nightly-watchdog.test.mjs scripts/cloudflare-deployment.test.mjs scripts/deploy-workflow.test.mjs scripts/migrate-cloudflare-token.test.mjs scripts/oxc-config.test.mjs scripts/cli-lint-rules.test.mjs scripts/workflow-policy.test.mjs",
     "dev": "pnpm --filter '@sentry/mcp-cloudflare...' --if-present run build && dotenv -e .env -e .env.local -- pnpm --parallel --filter @sentry/mcp-cloudflare --filter @sentry/mcp-core --filter @sentry/mcp-server-mocks --if-present run dev",
     "dev:stdio": "pnpm --filter '@sentry/mcp-server...' --if-present run build && dotenv -e .env -e .env.local -- pnpm --parallel --filter @sentry/mcp-server --filter @sentry/mcp-core --filter @sentry/mcp-server-mocks --if-present run dev",
     "build": "dotenv -e .env -e .env.local -- pnpm -r --filter '!sentry' --filter '!sentry-cli-docs' --if-present run build",

packages/mcp-server/package.json

@@ -10,6 +10,9 @@
   "publishConfig": {
     "access": "public"
   },
+  "sentryCi": {
+    "e2e": "test:package"
+  },
   "license": "FSL-1.1-ALv2",
   "author": "Sentry",
   "homepage": "https://github.com/getsentry/sentry-mcp",
@@ -47,6 +50,7 @@
     "start": "tsx src/index.ts",
     "test": "vitest run",
     "test:ci": "vitest run --reporter=default --reporter=junit --outputFile=tests.junit.xml",
+    "test:package": "bash test/package/check.sh",
     "test:watch": "vitest",
     "tsc": "tsc --noEmit"
   },

packages/mcp-server/test/package/check.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Pack @sentry/mcp-server, install the tarball into a clean consumer project,
+# and typecheck it against the stdio transport exports and declarations that
+# npm users get. Build workspace dependencies first, for example with
+# `pnpm --filter '@sentry/mcp-server^...' --if-present run build`.
+set -euo pipefail
+
+package_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+work_dir="$(mktemp -d)"
+trap 'rm -rf "$work_dir"' EXIT
+
+cd "$package_dir"
+pnpm run build
+pnpm pack --pack-destination "$work_dir"
+
+cp -R test/package/consumer "$work_dir/consumer"
+cd "$work_dir/consumer"
+export npm_config_cache="$work_dir/npm-cache"
+npm install --ignore-scripts --no-audit --no-fund --no-save \
+  "$work_dir"/sentry-mcp-server-*.tgz typescript@^5.8.3 @types/node@^22
+npx tsc -p .
+echo "Packed @sentry/mcp-server typechecks in a clean consumer."

packages/mcp-server/test/package/consumer/index.ts

@@ -0,0 +1,19 @@
+import {
+  startStdio,
+  type StdioServerContext,
+} from "@sentry/mcp-server/transports/stdio";
+
+declare const server: Parameters<typeof startStdio>[0];
+
+const telemetryContext: StdioServerContext = {
+  experimentalMode: false,
+  mcpUrl: "https://example.com/mcp",
+  sentryHost: "sentry.io",
+};
+
+void startStdio(server, telemetryContext);
+void startStdio(server, {
+  accessToken: "token",
+  constraints: {},
+  sentryHost: "sentry.io",
+});

packages/mcp-server/test/package/consumer/package.json

@@ -0,0 +1,4 @@
+{
+  "private": true,
+  "type": "module"
+}

packages/mcp-server/test/package/consumer/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "noEmit": true,
+    "strict": true,
+    "target": "ES2022"
+  },
+  "include": ["index.ts"]
+}