From 6448c709b840f37ca40b297fd64a99467f05d39b Mon Sep 17 00:00:00 2001
From: Jeffrey Hung <17494876+Jeffreyhung@users.noreply.github.com>
Date: Wed, 11 Dec 2024 04:05:57 -0800
Subject: [PATCH 1/3] Replace release bot with GH app (#3868)

---
 .github/workflows/release.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 268f62c4cc..2cd3dfb2ac 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,14 +18,20 @@ jobs:
     runs-on: ubuntu-latest
     name: "Release a new version"
     steps:
+      - name: Get auth token
+        id: token
+        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+        with:
+          app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
       - uses: actions/checkout@v4.2.2
         with:
-          token: ${{ secrets.GH_RELEASE_PAT }}
+          token: ${{ steps.token.outputs.token }}
           fetch-depth: 0
       - name: Prepare release
         uses: getsentry/action-prepare-release@v1
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_RELEASE_PAT }}
+          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
         with:
           version: ${{ github.event.inputs.version }}
           force: ${{ github.event.inputs.force }}

From 1239499b5d6274f997a890650a516f6c5538a188 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Fri, 13 Dec 2024 11:26:43 +0000
Subject: [PATCH 2/3] fix(spotlight): Make Django middleware init even more
 defensive (#3870)

I just got faced with a situation where even trying to do `settings.DEBUG` may trigger a Django exception if the settings are not loaded yet, hence widening the `capture_internal_exceptions()` scope for this.
---
 sentry_sdk/spotlight.py | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/sentry_sdk/spotlight.py b/sentry_sdk/spotlight.py
index a94c691723..1555afb829 100644
--- a/sentry_sdk/spotlight.py
+++ b/sentry_sdk/spotlight.py
@@ -210,13 +210,13 @@ def setup_spotlight(options):
     if not isinstance(url, str):
         return None
 
-    if (
-        settings is not None
-        and settings.DEBUG
-        and env_to_bool(os.environ.get("SENTRY_SPOTLIGHT_ON_ERROR", "1"))
-        and env_to_bool(os.environ.get("SENTRY_SPOTLIGHT_MIDDLEWARE", "1"))
-    ):
-        with capture_internal_exceptions():
+    with capture_internal_exceptions():
+        if (
+            settings is not None
+            and settings.DEBUG
+            and env_to_bool(os.environ.get("SENTRY_SPOTLIGHT_ON_ERROR", "1"))
+            and env_to_bool(os.environ.get("SENTRY_SPOTLIGHT_MIDDLEWARE", "1"))
+        ):
             middleware = settings.MIDDLEWARE
             if DJANGO_SPOTLIGHT_MIDDLEWARE_PATH not in middleware:
                 settings.MIDDLEWARE = type(middleware)(

From 81b806321fed9715d0c7ff227bdf22c9f1178ce9 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Sat, 14 Dec 2024 00:55:25 +0000
Subject: [PATCH 3/3] fix(spotlight): Use the spotlight_url passed into the SDK
 when loading Spotlight (#3871)

When we inject spotlight, we don't set the correct sidecar URL. This is an issue when a user defines a custom sidecar URL where we are able to load Spotlight UI from the correct URL but don't tell it the correct sidecar URL, making it non-functional.

---------

Co-authored-by: Ivana Kellyer <ivana.kellyer@sentry.io>
---
 sentry_sdk/spotlight.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sentry_sdk/spotlight.py b/sentry_sdk/spotlight.py
index 1555afb829..a783b155a1 100644
--- a/sentry_sdk/spotlight.py
+++ b/sentry_sdk/spotlight.py
@@ -66,7 +66,8 @@ def capture_envelope(self, envelope):
 
     SPOTLIGHT_JS_ENTRY_PATH = "/assets/main.js"
     SPOTLIGHT_JS_SNIPPET_PATTERN = (
-        '<script type="module" crossorigin src="{}"></script>'
+        "<script>window.__spotlight = {{ initOptions: {{ sidecarUrl: '{spotlight_url}', fullPage: false }} }};</script>\n"
+        '<script type="module" crossorigin src="{spotlight_js_url}"></script>\n'
     )
     SPOTLIGHT_ERROR_PAGE_SNIPPET = (
         '<html><base href="{spotlight_url}">\n'
@@ -113,7 +114,8 @@ def spotlight_script(self):
                     )
                     urllib.request.urlopen(req)
                     self._spotlight_script = SPOTLIGHT_JS_SNIPPET_PATTERN.format(
-                        spotlight_js_url
+                        spotlight_url=self._spotlight_url,
+                        spotlight_js_url=spotlight_js_url,
                     )
                 except urllib.error.URLError as err:
                     sentry_logger.debug(