From fd181e15619c840eb46226356fc285fd70baa25a Mon Sep 17 00:00:00 2001
From: Trevor Elkins <elkins.trevor@gmail.com>
Date: Fri, 16 Oct 2026 18:00:14 -0400
Subject: [PATCH 1/2] ci: Use nightly standalone Sentry CLI for dogfood uploads

---
 .github/workflows/sentry_dogfood.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/sentry_dogfood.yml b/.github/workflows/sentry_dogfood.yml
index 14dcd95c..53831181 100644
--- a/.github/workflows/sentry_dogfood.yml
+++ b/.github/workflows/sentry_dogfood.yml
@@ -20,10 +20,8 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Install Sentry CLI
-        uses: getsentry/action-setup-cli@70d7e587b84c2e78cf4d37cd33d7b74fb3729c1b # v1
-        with:
-          version: "3.4.1"
+      - name: Install Sentry CLI (nightly)
+        run: curl https://cli.sentry.dev/install -fsS | bash -s -- --version nightly
 
       - name: Unzip iOS app
         run: |
@@ -35,18 +33,20 @@ jobs:
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_SENTRY_AUTH_TOKEN }}
         run: |
-          sentry-cli --log-level=debug build upload \
+          sentry build upload \
             ./HackerNews.xcarchive \
             --org sentry \
             --project launchpad-test-ios \
-            --build-configuration Release
+            --build-configuration Release \
+            --log-level debug
 
       - name: Upload Android app to Sentry
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_SENTRY_AUTH_TOKEN }}
         run: |
-          sentry-cli --log-level=debug build upload \
+          sentry build upload \
             ./tests/_fixtures/android/hn.aab \
             --org sentry \
             --project launchpad-test-android \
-            --build-configuration Release
+            --build-configuration Release \
+            --log-level debug

From 5a25f0c167a61d1f03d02ccaf0f2202d2276a181 Mon Sep 17 00:00:00 2001
From: Trevor Elkins <elkins.trevor@gmail.com>
Date: Mon, 2 Nov 2026 17:20:58 -0500
Subject: [PATCH 2/2] ci: Pin Sentry nightly binary and verify its checksum

---
 .github/workflows/sentry_dogfood.yml | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sentry_dogfood.yml b/.github/workflows/sentry_dogfood.yml
index 53831181..c0df7a37 100644
--- a/.github/workflows/sentry_dogfood.yml
+++ b/.github/workflows/sentry_dogfood.yml
@@ -20,8 +20,24 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Install Sentry CLI (nightly)
-        run: curl https://cli.sentry.dev/install -fsS | bash -s -- --version nightly
+      - name: Install Sentry CLI (pinned nightly)
+        shell: bash
+        env:
+          SENTRY_CLI_VERSION: "0.48.0-dev.1792191634"
+          SENTRY_CLI_SHA256: "000573cae3395cd9be6b1fd08ac2c18067d5c99c129c614dececc1fc3bd29fd8"
+        run: |
+          INSTALL_DIR="${RUNNER_TEMP}/sentry-bin"
+          mkdir -p "${INSTALL_DIR}"
+          GHCR_TOKEN=$(curl -fsS "https://ghcr.io/token?scope=repository:getsentry/toolkit:pull" | jq -er '.token')
+          curl -fsSL --proto '=https' --proto-redir '=https' \
+            -H "Authorization: Bearer ${GHCR_TOKEN}" \
+            "https://ghcr.io/v2/getsentry/toolkit/blobs/sha256:${SENTRY_CLI_SHA256}" \
+            -o "${INSTALL_DIR}/sentry.gz"
+          printf '%s  %s\n' "${SENTRY_CLI_SHA256}" "${INSTALL_DIR}/sentry.gz" | shasum -a 256 -c -
+          gunzip -c "${INSTALL_DIR}/sentry.gz" > "${INSTALL_DIR}/sentry"
+          chmod +x "${INSTALL_DIR}/sentry"
+          test "$("${INSTALL_DIR}/sentry" --version)" = "${SENTRY_CLI_VERSION}"
+          echo "${INSTALL_DIR}" >> "${GITHUB_PATH}"
 
       - name: Unzip iOS app
         run: |