feat: Sync fork

.env

@@ -1,19 +1,28 @@
 COMPOSE_PROJECT_NAME=sentry-self-hosted
+# Set COMPOSE_PROFILES to "feature-complete" to enable all features
+# To enable errors monitoring only, set COMPOSE_PROFILES=errors-only
+# See https://develop.sentry.dev/self-hosted/experimental/errors-only/
+COMPOSE_PROFILES=feature-complete
 SENTRY_EVENT_RETENTION_DAYS=90
 # You can either use a port number or an IP:PORT combo for SENTRY_BIND
 # See https://docs.docker.com/compose/compose-file/#ports for more
 SENTRY_BIND=9000
 # Set SENTRY_MAIL_HOST to a valid FQDN (host/domain name) to be able to send emails!
 # SENTRY_MAIL_HOST=example.com
-SENTRY_IMAGE=getsentry/sentry:nightly
-SNUBA_IMAGE=getsentry/snuba:nightly
-RELAY_IMAGE=getsentry/relay:nightly
-SYMBOLICATOR_IMAGE=getsentry/symbolicator:nightly
-VROOM_IMAGE=getsentry/vroom:nightly
-WAL2JSON_VERSION=latest
+SENTRY_IMAGE=ghcr.io/getsentry/sentry:nightly
+SNUBA_IMAGE=ghcr.io/getsentry/snuba:nightly
+RELAY_IMAGE=ghcr.io/getsentry/relay:nightly
+SYMBOLICATOR_IMAGE=ghcr.io/getsentry/symbolicator:nightly
+TASKBROKER_IMAGE=ghcr.io/getsentry/taskbroker:nightly
+VROOM_IMAGE=ghcr.io/getsentry/vroom:nightly
+UPTIME_CHECKER_IMAGE=ghcr.io/getsentry/uptime-checker:nightly
 HEALTHCHECK_INTERVAL=30s
 HEALTHCHECK_TIMEOUT=1m30s
 HEALTHCHECK_RETRIES=10
-# Caution: Raising max connections of postgres increases CPU and RAM usage
-# see https://github.com/getsentry/self-hosted/pull/2740 for more information
-POSTGRES_MAX_CONNECTIONS=100
+HEALTHCHECK_START_PERIOD=10s
+HEALTHCHECK_FILE_INTERVAL=60s
+HEALTHCHECK_FILE_TIMEOUT=10s
+HEALTHCHECK_FILE_RETRIES=3
+HEALTHCHECK_FILE_START_PERIOD=600s
+# Set SETUP_JS_SDK_ASSETS to 1 to enable the setup of JS SDK assets
+# SETUP_JS_SDK_ASSETS=1

.github/ISSUE_TEMPLATE/problem-report.yml

@@ -23,7 +23,7 @@ body:
     id: docker_version
     attributes:
       label: Docker Version
-      placeholder: 20.10.16 ← should look like this
+      placeholder: 20.10.16 ← should look like this (docker --version)
       description: |
         What version of docker are you using to run self-hosted?
         e.g: (docker --version)
@@ -39,6 +39,16 @@ body:
         e.g: (docker compose version)
     validations:
       required: true
+  - type: checkboxes
+    id: machine_specification
+    attributes:
+      label: Machine Specification
+      description: Make sure your system meets the [minimum system requirements of Sentry](https://develop.sentry.dev/self-hosted/#required-minimum-system-resources).
+      options:
+        - label: My system meets the minimum system requirements of Sentry
+          required: true
+    validations:
+      required: true
   - type: textarea
     id: repro
     attributes:
@@ -54,6 +64,8 @@ body:
     id: expected
     attributes:
       label: Expected Result
+      description: |
+        What did you expect to happen?
     validations:
       required: true
   - type: textarea
@@ -70,7 +82,7 @@ body:
         - logs output
     validations:
       required: true
-  - type: textarea
+  - type: input
     id: event_id
     attributes:
       label: Event ID
@@ -82,5 +94,7 @@ body:
       value: |-
         ## Thanks
         Check our [triage docs](https://open.sentry.io/triage/) for what to expect next.
+
+        If you're reporting a security issue, please follow our [security policy](https://github.com/getsentry/.github/blob/main/SECURITY.md) instead.
     validations:
       required: false

.github/ISSUE_TEMPLATE/release.yml

@@ -10,13 +10,12 @@ body:
         [previous YY.M.N](https://github.com/getsentry/self-hosted/issues) | ***YY.M.N*** | [next YY.M.N](https://github.com/getsentry/self-hosted/issues)
 
         - [ ] Release all components (_replace items with [publish repo issue links](https://github.com/getsentry/publish/issues)_).
-          - [ ] [`develop`](https://github.com/getsentry/develop/actions/workflows/prepare-release.yml)
           - [ ] [`relay`](https://github.com/getsentry/relay/actions/workflows/release_binary.yml)
           - [ ] [`sentry`](https://github.com/getsentry/sentry/actions/workflows/release.yml)
-          - [ ] [`sentry-docs`](https://github.com/getsentry/sentry-docs/actions/workflows/prepare-release.yml)
           - [ ] [`snuba`](https://github.com/getsentry/snuba/actions/workflows/release.yml)
           - [ ] [`symbolicator`](https://github.com/getsentry/symbolicator/actions/workflows/release.yml)
           - [ ] [`vroom`](https://github.com/getsentry/vroom/actions/workflows/release.yaml)
+          - [ ] [`taskbroker`](https://github.com/getsentry/taskbroker/actions/workflows/release.yml)
         - [ ] Release self-hosted.
           - [ ] [Prepare the `self-hosted` release](https://github.com/getsentry/self-hosted/actions/workflows/release.yml) (_replace with publish issue repo link_).
           - [ ] Check to make sure the new release branch in self-hosted includes the appropriate CalVer images.
@@ -25,7 +24,6 @@ body:
         - [ ] Follow up.
           - [ ] [Create the next release issue](https://github.com/getsentry/self-hosted/issues/new?assignees=&labels=&projects=&template=release.yml) and link it from this one.
             - _replace with link_
-          - [ ] Update the [quarterly ticket](https://github.com/getsentry/team-ospo/issues).
           - [ ] Update the [release issue template](https://github.com/getsentry/self-hosted/blob/master/.github/ISSUE_TEMPLATE/release.yml).
           - [ ] Create a PR to update relocation release tests to add the new version.
             - _replace with link_

.github/dependabot.yml

@@ -6,7 +6,7 @@ updates:
       interval: daily
     open-pull-requests-limit: 0 # only security updates
     reviewers:
-      - "@getsentry/open-source"
+      - "@getsentry/dev-infra"
       - "@getsentry/security"
 
   - package-ecosystem: "github-actions"
@@ -15,5 +15,5 @@ updates:
       # Check for updates to GitHub Actions every week
       interval: "weekly"
     reviewers:
-      - "@getsentry/open-source"
+      - "@getsentry/dev-infra"
       - "@getsentry/security"

.github/workflows/enforce-license-compliance.yml

@@ -6,8 +6,12 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   enforce-license-compliance:
+    if: github.repository_owner == 'getsentry'
     runs-on: ubuntu-latest
     steps:
       - name: 'Enforce License Compliance'

.github/workflows/fast-revert.yml

@@ -19,7 +19,7 @@ jobs:
     if: |
       github.event_name == 'workflow_dispatch' || github.event.label.name == 'Trigger: Revert'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           token: ${{ secrets.BUMP_SENTRY_TOKEN }}
       - uses: getsentry/[email protected]

.github/workflows/pre-commit.yml

@@ -5,12 +5,15 @@ on:
   push:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@v5
+    - uses: actions/setup-python@v6
       with:
         python-version: 3.x
     - uses: pre-commit/[email protected]

.github/workflows/release.yml

@@ -13,21 +13,29 @@ on:
     # We also make this an hour after all others such as Sentry,
     # Snuba, and Relay to make sure their releases finish.
     - cron: "0 18 15 * *"
+permissions:
+  contents: read
 jobs:
   release:
     if: github.repository_owner == 'getsentry'
     runs-on: ubuntu-latest
     name: "Release a new version"
     steps:
-      - uses: actions/checkout@v4
+      - name: Get auth token
+        id: token
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
         with:
-          token: ${{ secrets.GH_RELEASE_PAT }}
+          app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+      - uses: actions/checkout@v5
+        with:
+          token: ${{ steps.token.outputs.token }}
           fetch-depth: 0
       - name: Prepare release
         id: prepare-release
         uses: getsentry/action-prepare-release@v1
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_RELEASE_PAT }}
+          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
         with:
           version: ${{ github.event.inputs.version }}
           force: ${{ github.event.inputs.force }}
@@ -40,11 +48,10 @@ jobs:
     name: Create release on self-hosted dogfood instance
     needs: release
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
-          token: ${{ secrets.GH_RELEASE_PAT }}
           fetch-depth: 0
-      - uses: getsentry/action-release@v1
+      - uses: getsentry/action-release@v3
         env:
           SENTRY_ORG: self-hosted
           SENTRY_PROJECT: installer

.github/workflows/shellcheck.yml

@@ -0,0 +1,46 @@
+name: "ShellCheck"
+on:
+  push:
+    paths:
+      - "**.sh"
+    branches: [master]
+  pull_request:
+    paths:
+      - "**.sh"
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    name: ShellCheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Repository checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Run ShellCheck
+        run: |
+          git diff --name-only -z `git merge-base origin/master HEAD` -- \
+            install/_lib.sh \
+            'optional-modifications/**.sh' \
+            'scripts/**.sh' \
+            unit-test.sh \
+            'workstation/**.sh' \
+          | xargs -0 -r -- \
+            shellcheck \
+              --shell=bash \
+              --format=json1 \
+              --external-sources \
+          | jq -r '
+            .comments
+            | map(.level |= if ([.] | inside(["info", "style"])) then "notice" else . end)
+            | .[] as $note
+            | "::\($note.level) file=\($note.file),line=\($note.line),endLine=\($note.endLine),col=\($note.column),endColumn=\($note.endColumn)::[SC\($note.code)] \($note.message)"
+          ' \
+          | grep . >&2 && exit 1
+
+          exit 0