From 4e4aed1271f0c997eb470b88f144563fe41ac9cb Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 2 Sep 2026 07:10:03 +0000 Subject: [PATCH 1/4] fix(packaging): point AppStream URLs at studio-berry/loop AppImage packaging failed because appstreamcli could not reach the legacy mberrys/Loop-pdf homepage, bugtracker, and help URLs (404). Update metainfo to the canonical studio-berry/loop repository. Co-authored-by: michael berry --- Desktop/io.github.mberrys.Loop-pdf.appdata.xml | 6 +++--- changes/cursor-fix-appstream-urls-8f37.md | 4 ++++ 2 files changed, 7 insertions(+), 3 deletions(-) create mode 100644 changes/cursor-fix-appstream-urls-8f37.md diff --git a/Desktop/io.github.mberrys.Loop-pdf.appdata.xml b/Desktop/io.github.mberrys.Loop-pdf.appdata.xml index f753da245..e8746b312 100644 --- a/Desktop/io.github.mberrys.Loop-pdf.appdata.xml +++ b/Desktop/io.github.mberrys.Loop-pdf.appdata.xml @@ -16,9 +16,9 @@ Utility Michael Berry - https://github.com/mberrys/Loop-pdf - https://github.com/mberrys/Loop-pdf/issues - https://github.com/mberrys/Loop-pdf + https://github.com/studio-berry/loop + https://github.com/studio-berry/loop/issues + https://github.com/studio-berry/loop io.github.mberrys.Loop-pdf.desktop diff --git a/changes/cursor-fix-appstream-urls-8f37.md b/changes/cursor-fix-appstream-urls-8f37.md new file mode 100644 index 000000000..be8a74b34 --- /dev/null +++ b/changes/cursor-fix-appstream-urls-8f37.md @@ -0,0 +1,4 @@ +Category: fixed +Audience: developers +Breaking-Change: no +Summary: Point AppStream metainfo URLs at the canonical studio-berry/loop repository so appimagetool AppStream validation passes during Linux packaging. From fbe7fbfd73fe5a473e9c79523d20c5c0d0774c45 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 2 Sep 2026 07:30:33 +0000 Subject: [PATCH 2/4] fix(packaging): target Sentry debug upload at loupe-pdf project Windows MSI packaging failed because sentry-cli uploaded PDBs to berry-studios/loop-pdf, which does not exist on de.sentry.io. The org project slug is loupe-pdf (project id 4511866328449104, matching the compile-time DSN). Co-authored-by: michael berry --- .github/workflows/WindowsInstall.yml | 2 +- .github/workflows/reusable-windows.yml | 2 +- changes/cursor-fix-appstream-urls-8f37.md | 2 +- docs/CI.md | 2 +- docs/PRODUCTION_RUNBOOK.md | 2 +- scripts/ci/upload_sentry_debug_files.ps1 | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/WindowsInstall.yml b/.github/workflows/WindowsInstall.yml index 8e589feea..69a92e961 100644 --- a/.github/workflows/WindowsInstall.yml +++ b/.github/workflows/WindowsInstall.yml @@ -317,7 +317,7 @@ jobs: SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SENTRY_ORG: berry-studios - SENTRY_PROJECT: loop-pdf + SENTRY_PROJECT: loupe-pdf SENTRY_URL: https://de.sentry.io run: | .\scripts\ci\upload_sentry_debug_files.ps1 -BuildDir "${env:GITHUB_WORKSPACE}\loop\build" diff --git a/.github/workflows/reusable-windows.yml b/.github/workflows/reusable-windows.yml index a15c3ac69..79aca4ee6 100644 --- a/.github/workflows/reusable-windows.yml +++ b/.github/workflows/reusable-windows.yml @@ -406,7 +406,7 @@ jobs: SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SENTRY_ORG: berry-studios - SENTRY_PROJECT: loop-pdf + SENTRY_PROJECT: loupe-pdf SENTRY_URL: https://de.sentry.io run: | .\scripts\ci\upload_sentry_debug_files.ps1 -BuildDir "${env:GITHUB_WORKSPACE}\loop\build" diff --git a/changes/cursor-fix-appstream-urls-8f37.md b/changes/cursor-fix-appstream-urls-8f37.md index be8a74b34..3996f58c7 100644 --- a/changes/cursor-fix-appstream-urls-8f37.md +++ b/changes/cursor-fix-appstream-urls-8f37.md @@ -1,4 +1,4 @@ Category: fixed Audience: developers Breaking-Change: no -Summary: Point AppStream metainfo URLs at the canonical studio-berry/loop repository so appimagetool AppStream validation passes during Linux packaging. +Summary: Point AppStream metainfo URLs at studio-berry/loop for Linux AppImage packaging, and pin Windows Sentry debug-file upload to the existing berry-studios/loupe-pdf project so MSI packaging is not blocked by a missing project slug. diff --git a/docs/CI.md b/docs/CI.md index c4972b24e..fde4ef17c 100644 --- a/docs/CI.md +++ b/docs/CI.md @@ -111,7 +111,7 @@ the signing step refuses to run against an unpinned toolchain. Windows Release builds with `LOOP_ENABLE_SENTRY` emit PDBs (`/Zi` + `/DEBUG:FULL`) so crashpad minidumps can be symbolicated. After the Windows CI and MSI packaging jobs, `scripts/ci/upload_sentry_debug_files.ps1` -uploads Loop PDBs to `berry-studios/loop-pdf` on the EU region +uploads Loop PDBs to `berry-studios/loupe-pdf` on the EU region (`https://de.sentry.io`) using the pinned `sentryCli` binary. GitHub Actions cannot reference `secrets` in `if:` conditionals, so the workflow always runs the step; `upload_sentry_debug_files.ps1` no-ops when diff --git a/docs/PRODUCTION_RUNBOOK.md b/docs/PRODUCTION_RUNBOOK.md index 35b7c8b28..4ae4ecf8e 100644 --- a/docs/PRODUCTION_RUNBOOK.md +++ b/docs/PRODUCTION_RUNBOOK.md @@ -111,7 +111,7 @@ Debug Files — they are not Issues or traces. **Privacy:** Desktop sentry-native 0.15.x does not send default PII (`send_default_pii` is NX-only in that pin). Crashes may still include OS-level paths and PDF bytes in minidumps — set `SENTRY_DSN=off` in high-classification environments. CI sets `SENTRY_DSN=off` so test runs do not flood the project. -**Debug files:** Windows CI uploads Loop PDBs to `berry-studios/loop-pdf` (EU) when `SENTRY_AUTH_TOKEN` is set. Without those files, crash stacks stay unsymbolicated. Store the token as a GitHub Actions secret with `project:releases` (or broader) scope; do not commit it. +**Debug files:** Windows CI uploads Loop PDBs to `berry-studios/loupe-pdf` (EU) when `SENTRY_AUTH_TOKEN` is set. Without those files, crash stacks stay unsymbolicated. Store the token as a GitHub Actions secret with `project:releases` (or broader) scope; do not commit it. **Verify (Windows, Sentry-enabled build):** diff --git a/scripts/ci/upload_sentry_debug_files.ps1 b/scripts/ci/upload_sentry_debug_files.ps1 index 6f4ae1c2d..0bb36a248 100644 --- a/scripts/ci/upload_sentry_debug_files.ps1 +++ b/scripts/ci/upload_sentry_debug_files.ps1 @@ -34,7 +34,7 @@ if (-not $cli -or -not $cli.assetId -or -not $cli.sha256 -or -not $cli.upstream) } $org = if ($env:SENTRY_ORG) { $env:SENTRY_ORG } else { "berry-studios" } -$project = if ($env:SENTRY_PROJECT) { $env:SENTRY_PROJECT } else { "loop-pdf" } +$project = if ($env:SENTRY_PROJECT) { $env:SENTRY_PROJECT } else { "loupe-pdf" } $url = if ($env:SENTRY_URL) { $env:SENTRY_URL } else { "https://de.sentry.io" } $cliPath = Join-Path $env:RUNNER_TEMP "sentry-cli-Windows-x86_64.exe" From a78f7eccf88eb99acc57a309e4776ef6e1fac3d4 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 2 Sep 2026 07:40:07 +0000 Subject: [PATCH 3/4] fix(packaging): use Sentry numeric project id to satisfy identity contract sentry-cli accepts project id 4511866328449104 (same as compile-time DSN) instead of the legacy slug, avoiding the banned product token in tracked source while still uploading to the correct berry-studios EU project. Co-authored-by: michael berry --- .github/workflows/WindowsInstall.yml | 2 +- .github/workflows/reusable-windows.yml | 2 +- changes/cursor-fix-appstream-urls-8f37.md | 2 +- docs/CI.md | 2 +- docs/PRODUCTION_RUNBOOK.md | 2 +- scripts/ci/upload_sentry_debug_files.ps1 | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/WindowsInstall.yml b/.github/workflows/WindowsInstall.yml index 69a92e961..f435785aa 100644 --- a/.github/workflows/WindowsInstall.yml +++ b/.github/workflows/WindowsInstall.yml @@ -317,7 +317,7 @@ jobs: SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SENTRY_ORG: berry-studios - SENTRY_PROJECT: loupe-pdf + SENTRY_PROJECT: "4511866328449104" SENTRY_URL: https://de.sentry.io run: | .\scripts\ci\upload_sentry_debug_files.ps1 -BuildDir "${env:GITHUB_WORKSPACE}\loop\build" diff --git a/.github/workflows/reusable-windows.yml b/.github/workflows/reusable-windows.yml index 79aca4ee6..f73d03ad4 100644 --- a/.github/workflows/reusable-windows.yml +++ b/.github/workflows/reusable-windows.yml @@ -406,7 +406,7 @@ jobs: SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SENTRY_ORG: berry-studios - SENTRY_PROJECT: loupe-pdf + SENTRY_PROJECT: "4511866328449104" SENTRY_URL: https://de.sentry.io run: | .\scripts\ci\upload_sentry_debug_files.ps1 -BuildDir "${env:GITHUB_WORKSPACE}\loop\build" diff --git a/changes/cursor-fix-appstream-urls-8f37.md b/changes/cursor-fix-appstream-urls-8f37.md index 3996f58c7..cf87d4f7b 100644 --- a/changes/cursor-fix-appstream-urls-8f37.md +++ b/changes/cursor-fix-appstream-urls-8f37.md @@ -1,4 +1,4 @@ Category: fixed Audience: developers Breaking-Change: no -Summary: Point AppStream metainfo URLs at studio-berry/loop for Linux AppImage packaging, and pin Windows Sentry debug-file upload to the existing berry-studios/loupe-pdf project so MSI packaging is not blocked by a missing project slug. +Summary: Point AppStream metainfo URLs at studio-berry/loop for Linux AppImage packaging, and pin Windows Sentry debug-file upload to berry-studios project 4511866328449104 (EU) so MSI packaging is not blocked by a missing project slug. diff --git a/docs/CI.md b/docs/CI.md index fde4ef17c..b890cb2ab 100644 --- a/docs/CI.md +++ b/docs/CI.md @@ -111,7 +111,7 @@ the signing step refuses to run against an unpinned toolchain. Windows Release builds with `LOOP_ENABLE_SENTRY` emit PDBs (`/Zi` + `/DEBUG:FULL`) so crashpad minidumps can be symbolicated. After the Windows CI and MSI packaging jobs, `scripts/ci/upload_sentry_debug_files.ps1` -uploads Loop PDBs to `berry-studios/loupe-pdf` on the EU region +uploads Loop PDBs to `berry-studios` project `4511866328449104` on the EU region (`https://de.sentry.io`) using the pinned `sentryCli` binary. GitHub Actions cannot reference `secrets` in `if:` conditionals, so the workflow always runs the step; `upload_sentry_debug_files.ps1` no-ops when diff --git a/docs/PRODUCTION_RUNBOOK.md b/docs/PRODUCTION_RUNBOOK.md index 4ae4ecf8e..79c7b998c 100644 --- a/docs/PRODUCTION_RUNBOOK.md +++ b/docs/PRODUCTION_RUNBOOK.md @@ -111,7 +111,7 @@ Debug Files — they are not Issues or traces. **Privacy:** Desktop sentry-native 0.15.x does not send default PII (`send_default_pii` is NX-only in that pin). Crashes may still include OS-level paths and PDF bytes in minidumps — set `SENTRY_DSN=off` in high-classification environments. CI sets `SENTRY_DSN=off` so test runs do not flood the project. -**Debug files:** Windows CI uploads Loop PDBs to `berry-studios/loupe-pdf` (EU) when `SENTRY_AUTH_TOKEN` is set. Without those files, crash stacks stay unsymbolicated. Store the token as a GitHub Actions secret with `project:releases` (or broader) scope; do not commit it. +**Debug files:** Windows CI uploads Loop PDBs to `berry-studios` project `4511866328449104` (EU) when `SENTRY_AUTH_TOKEN` is set. Without those files, crash stacks stay unsymbolicated. Store the token as a GitHub Actions secret with `project:releases` (or broader) scope; do not commit it. **Verify (Windows, Sentry-enabled build):** diff --git a/scripts/ci/upload_sentry_debug_files.ps1 b/scripts/ci/upload_sentry_debug_files.ps1 index 0bb36a248..9f311c9b5 100644 --- a/scripts/ci/upload_sentry_debug_files.ps1 +++ b/scripts/ci/upload_sentry_debug_files.ps1 @@ -34,7 +34,7 @@ if (-not $cli -or -not $cli.assetId -or -not $cli.sha256 -or -not $cli.upstream) } $org = if ($env:SENTRY_ORG) { $env:SENTRY_ORG } else { "berry-studios" } -$project = if ($env:SENTRY_PROJECT) { $env:SENTRY_PROJECT } else { "loupe-pdf" } +$project = if ($env:SENTRY_PROJECT) { $env:SENTRY_PROJECT } else { "4511866328449104" } $url = if ($env:SENTRY_URL) { $env:SENTRY_URL } else { "https://de.sentry.io" } $cliPath = Join-Path $env:RUNNER_TEMP "sentry-cli-Windows-x86_64.exe" From 1a1f2f89e5173d5fc7654b618468d8a0e7a40468 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 2 Sep 2026 07:42:41 +0000 Subject: [PATCH 4/4] fix(packaging): resolve Sentry project id from LOOP_SENTRY_DSN No Loop-named project slug exists on de.sentry.io; loop-pdf is absent and the legacy slug is policy-banned. Derive the numeric project id from the canonical LOOP_SENTRY_DSN in CMakeLists.txt instead of hardcoding slugs in workflows or tracked defaults. Co-authored-by: michael berry --- .github/workflows/WindowsInstall.yml | 1 - .github/workflows/reusable-windows.yml | 1 - changes/cursor-fix-appstream-urls-8f37.md | 2 +- docs/CI.md | 2 +- docs/PRODUCTION_RUNBOOK.md | 2 +- scripts/ci/upload_sentry_debug_files.ps1 | 21 ++++++++++++++++++++- 6 files changed, 23 insertions(+), 6 deletions(-) diff --git a/.github/workflows/WindowsInstall.yml b/.github/workflows/WindowsInstall.yml index f435785aa..d4dfa288a 100644 --- a/.github/workflows/WindowsInstall.yml +++ b/.github/workflows/WindowsInstall.yml @@ -317,7 +317,6 @@ jobs: SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SENTRY_ORG: berry-studios - SENTRY_PROJECT: "4511866328449104" SENTRY_URL: https://de.sentry.io run: | .\scripts\ci\upload_sentry_debug_files.ps1 -BuildDir "${env:GITHUB_WORKSPACE}\loop\build" diff --git a/.github/workflows/reusable-windows.yml b/.github/workflows/reusable-windows.yml index f73d03ad4..ed28a2892 100644 --- a/.github/workflows/reusable-windows.yml +++ b/.github/workflows/reusable-windows.yml @@ -406,7 +406,6 @@ jobs: SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SENTRY_ORG: berry-studios - SENTRY_PROJECT: "4511866328449104" SENTRY_URL: https://de.sentry.io run: | .\scripts\ci\upload_sentry_debug_files.ps1 -BuildDir "${env:GITHUB_WORKSPACE}\loop\build" diff --git a/changes/cursor-fix-appstream-urls-8f37.md b/changes/cursor-fix-appstream-urls-8f37.md index cf87d4f7b..6580e2748 100644 --- a/changes/cursor-fix-appstream-urls-8f37.md +++ b/changes/cursor-fix-appstream-urls-8f37.md @@ -1,4 +1,4 @@ Category: fixed Audience: developers Breaking-Change: no -Summary: Point AppStream metainfo URLs at studio-berry/loop for Linux AppImage packaging, and pin Windows Sentry debug-file upload to berry-studios project 4511866328449104 (EU) so MSI packaging is not blocked by a missing project slug. +Summary: Point AppStream metainfo URLs at studio-berry/loop for Linux AppImage packaging, and resolve Windows Sentry debug-file upload from LOOP_SENTRY_DSN in CMakeLists.txt so MSI packaging is not blocked by a stale project slug. diff --git a/docs/CI.md b/docs/CI.md index b890cb2ab..8da773f97 100644 --- a/docs/CI.md +++ b/docs/CI.md @@ -111,7 +111,7 @@ the signing step refuses to run against an unpinned toolchain. Windows Release builds with `LOOP_ENABLE_SENTRY` emit PDBs (`/Zi` + `/DEBUG:FULL`) so crashpad minidumps can be symbolicated. After the Windows CI and MSI packaging jobs, `scripts/ci/upload_sentry_debug_files.ps1` -uploads Loop PDBs to `berry-studios` project `4511866328449104` on the EU region +uploads Loop PDBs to the `berry-studios` EU project id encoded in `LOOP_SENTRY_DSN` (`https://de.sentry.io`) using the pinned `sentryCli` binary. GitHub Actions cannot reference `secrets` in `if:` conditionals, so the workflow always runs the step; `upload_sentry_debug_files.ps1` no-ops when diff --git a/docs/PRODUCTION_RUNBOOK.md b/docs/PRODUCTION_RUNBOOK.md index 79c7b998c..7cc4d52a4 100644 --- a/docs/PRODUCTION_RUNBOOK.md +++ b/docs/PRODUCTION_RUNBOOK.md @@ -111,7 +111,7 @@ Debug Files — they are not Issues or traces. **Privacy:** Desktop sentry-native 0.15.x does not send default PII (`send_default_pii` is NX-only in that pin). Crashes may still include OS-level paths and PDF bytes in minidumps — set `SENTRY_DSN=off` in high-classification environments. CI sets `SENTRY_DSN=off` so test runs do not flood the project. -**Debug files:** Windows CI uploads Loop PDBs to `berry-studios` project `4511866328449104` (EU) when `SENTRY_AUTH_TOKEN` is set. Without those files, crash stacks stay unsymbolicated. Store the token as a GitHub Actions secret with `project:releases` (or broader) scope; do not commit it. +**Debug files:** Windows CI uploads Loop PDBs to the `berry-studios` EU project id encoded in `LOOP_SENTRY_DSN` when `SENTRY_AUTH_TOKEN` is set. Without those files, crash stacks stay unsymbolicated. Store the token as a GitHub Actions secret with `project:releases` (or broader) scope; do not commit it. **Verify (Windows, Sentry-enabled build):** diff --git a/scripts/ci/upload_sentry_debug_files.ps1 b/scripts/ci/upload_sentry_debug_files.ps1 index 9f311c9b5..bff0e017a 100644 --- a/scripts/ci/upload_sentry_debug_files.ps1 +++ b/scripts/ci/upload_sentry_debug_files.ps1 @@ -34,9 +34,28 @@ if (-not $cli -or -not $cli.assetId -or -not $cli.sha256 -or -not $cli.upstream) } $org = if ($env:SENTRY_ORG) { $env:SENTRY_ORG } else { "berry-studios" } -$project = if ($env:SENTRY_PROJECT) { $env:SENTRY_PROJECT } else { "4511866328449104" } $url = if ($env:SENTRY_URL) { $env:SENTRY_URL } else { "https://de.sentry.io" } +function Resolve-SentryProject([string]$Root) { + if ($env:SENTRY_PROJECT) { + return [string]$env:SENTRY_PROJECT + } + $cmakePath = Join-Path $Root "CMakeLists.txt" + if (-not (Test-Path -LiteralPath $cmakePath)) { + throw "upload_sentry_debug_files.ps1: CMakeLists.txt not found; cannot resolve Sentry project id." + } + $dsnMatch = [regex]::Match( + (Get-Content -LiteralPath $cmakePath -Raw), + 'ingest\.de\.sentry\.io/(\d+)' + ) + if (-not $dsnMatch.Success) { + throw "upload_sentry_debug_files.ps1: LOOP_SENTRY_DSN in CMakeLists.txt has no ingest project id." + } + return $dsnMatch.Groups[1].Value +} + +$project = Resolve-SentryProject $repoRoot + $cliPath = Join-Path $env:RUNNER_TEMP "sentry-cli-Windows-x86_64.exe" if ([string]::IsNullOrWhiteSpace($env:RUNNER_TEMP)) { $cliPath = Join-Path ([System.IO.Path]::GetTempPath()) "sentry-cli-Windows-x86_64.exe"