-
-
Notifications
You must be signed in to change notification settings - Fork 236
Description
CLI Version
v3.0.0
Operating System and Architecture
- macOS (arm64)
- macOS (x86_64)
- Linux (i686)
- Linux (x86_64)
- Linux (armv7)
- Linux (aarch64)
- Windows (i686)
- Windows (x86_64)
Operating System Version
macOS/ubuntu
Link to reproduction repository
No response
CLI Command
npx -y -- @sentry/cli releases list --show-projects --project=
Exact Reproduction Steps
- Run
npx -y -- @sentry/cli login - Run
npx -y -- @sentry/cli releases list --show-projects --project=<PROJECT SLUG> - Collect the result
- Export an organization token which you can get from here https://<ORG_SLUG>.sentry.io/settings/auth-tokens/
export SENTRY_AUTH_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-
Run the command:
npx -y -- @sentry/cli releases list --show-projects --project=<PROJECT SLUG> -
Collect the result
Expected Results
Results should be the same because the project is scoped in the arguments
Actual Results
The org token with org:ci only permissions, is showing ALL projects.
Since we use this in CI to tag commits in a sentry release it breaks our workflows due to this unexpected result (different projects use different versioning schemes).
Actually, i'm seeing the same issue when curling the API directly with a project_id - it just ignores that parameter.
curl -H 'Authorization: Bearer xxxxxx' 'https://sentry.io/api/0/organizations/<ORG_SLUG>/releases/?project_id=1234567&status=open'Logs
I can't share these due to the amount of sensitive info. But a simple check against your API will show this as mentioned above.
Metadata
Metadata
Assignees
Labels
Projects
Status