fix(ci): address code review feedback on Sentry→GitHub workflow

- Add timeout=30 to all HTTP requests (prevents hangs)
- Use Python 3.12 native fromisoformat (handles Z natively, no fragile replace)
- Fail fast on GitHub search API errors instead of silently returning false
  (prevents duplicate issue creation on transient API failures)
- Distinguish "already_exists" 422 from other label validation errors
- Move SENTRY_PROJECT to vars.SENTRY_PROJECT (repository variable)
- Remove unused json import

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

.github/scripts/sentry_issues.py

@@ -9,7 +9,6 @@
 import os
 import sys
 import time
-import json
 from datetime import datetime, timezone, timedelta
 
 import requests
@@ -63,11 +62,16 @@ def ensure_label(name: str, color: str, description: str) -> None:
         url,
         headers=GITHUB_HEADERS,
         json={"name": name, "color": color, "description": description},
+        timeout=30,
     )
     if resp.status_code == 201:
         print(f"  Created label: {name}")
     elif resp.status_code == 422:
-        pass  # Already exists
+        data = resp.json()
+        errors = data.get("errors", [])
+        # Only swallow "already_exists" — surface other validation errors
+        if not all(e.get("code") == "already_exists" for e in errors):
+            print(f"  Warning: label creation validation error for '{name}': {resp.text}")
     else:
         print(f"  Warning: unexpected status {resp.status_code} creating label '{name}': {resp.text}")
 
@@ -81,28 +85,29 @@ def fetch_sentry_issues(cutoff: datetime) -> list[dict]:
     """Return all unresolved Sentry issues first seen after cutoff."""
     url = f"{SENTRY_API}/projects/{SENTRY_ORG}/{SENTRY_PROJECT}/issues/"
     params = {"query": "is:unresolved", "limit": 100, "sort": "date"}
-    resp = requests.get(url, headers=SENTRY_HEADERS, params=params)
+    resp = requests.get(url, headers=SENTRY_HEADERS, params=params, timeout=30)
     if resp.status_code != 200:
         print(f"ERROR: Sentry API returned {resp.status_code}: {resp.text}", file=sys.stderr)
         sys.exit(1)
 
-    issues = resp.json()
-    new_issues = []
-    for issue in issues:
-        first_seen = datetime.fromisoformat(issue["firstSeen"].replace("Z", "+00:00"))
-        if first_seen >= cutoff:
-            new_issues.append(issue)
-    return new_issues
+    # Python 3.11+ fromisoformat handles Z natively; we target 3.12 in the workflow
+    return [
+        issue for issue in resp.json()
+        if datetime.fromisoformat(issue["firstSeen"]) >= cutoff
+    ]
 
 
 def github_issue_exists(sentry_id: str) -> bool:
-    """Return True if a GitHub issue with this Sentry ID already exists."""
+    """Return True if a GitHub issue with this Sentry ID already exists.
+
+    Raises SystemExit on API errors to prevent silently creating duplicates.
+    """
     url = f"{GITHUB_API}/search/issues"
     query = f'repo:{GITHUB_REPO} label:sentry in:body "SENTRY_ID:{sentry_id}"'
-    resp = requests.get(url, headers=GITHUB_HEADERS, params={"q": query, "per_page": 1})
+    resp = requests.get(url, headers=GITHUB_HEADERS, params={"q": query, "per_page": 1}, timeout=30)
     if resp.status_code != 200:
-        print(f"  Warning: GitHub search returned {resp.status_code}: {resp.text}")
-        return False
+        print(f"ERROR: GitHub search failed ({resp.status_code}): {resp.text}", file=sys.stderr)
+        sys.exit(1)
     return resp.json().get("total_count", 0) > 0
 
 
@@ -156,6 +161,7 @@ def create_github_issue(issue: dict) -> None:
         url,
         headers=GITHUB_HEADERS,
         json={"title": title, "body": body, "labels": labels},
+        timeout=30,
     )
     if resp.status_code == 201:
         data = resp.json()

.github/workflows/sentry-to-github.yml

@@ -29,7 +29,7 @@ jobs:
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
-          SENTRY_PROJECT: gosqlx-website
+          SENTRY_PROJECT: ${{ vars.SENTRY_PROJECT }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_REPO: ${{ github.repository }}
           POLLING_MINUTES: '31'