fix(remix): Pass the project when creating a release (#25079)

The release API rejects a release without a project, and the project
given to the `sentry` SDK does not reach `release.create`. Since the
move to that SDK (#23398), `sentry-upload-sourcemaps` failed with `400
Bad Request` on every run. The unit test mocked the SDK, so it did not
catch it. Reproduced against a real org.

Both upload scripts take the project from `--project`, then
`SENTRY_PROJECT`, and fail with a clear message when neither is set.
`@sentry/bundler-plugins` already did this. The React Router Vite plugin
has the same bug, fixed separately.

Fixes #24989

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Author: chargome

packages/remix/scripts/createRelease.js

@@ -25,7 +25,14 @@ async function createRelease(argv, URL_PREFIX, BUILD_PATH) {
     release = argv.release;
   }
 
-  await sentry.release.create({ orgVersion: release });
+  // The release API requires a project, and the one given to the SDK does not reach this call.
+  const project = argv.project ?? process.env.SENTRY_PROJECT;
+  if (!project) {
+    throw new Error(
+      '[sentry] A project is required to create a release. Pass `--project` or set `SENTRY_PROJECT` as environment variable.',
+    );
+  }
+  await sentry.release.create({ orgVersion: release, project });
 
   try {
     await sentry.sourcemap.upload({

packages/remix/scripts/sentry-remix-v3-upload-sourcemaps.mjs

@@ -21,6 +21,11 @@ let keepOutput = false;
 try {
   const values = parseOptions();
   keepOutput = Boolean(values['keep-output'] || values['out-dir']);
+  const org = values.org ?? process.env.SENTRY_ORG;
+  const project = values.project ?? process.env.SENTRY_PROJECT;
+  if (!values['dry-run'] && !project) {
+    fail('a project is required for the upload. Pass `--project` or set `SENTRY_PROJECT` as environment variable.');
+  }
 
   const { emitAssets } = await import('@sentry/remix/v3');
 
@@ -63,11 +68,11 @@ try {
     console.log('[sentry] --dry-run, skipping upload');
   } else {
     const { createSentrySDK } = await import('sentry');
-    const sentry = createSentrySDK({ url: values.url, org: values.org, project: values.project });
+    const sentry = createSentrySDK({ url: values.url, org, project });
     const release = values.release ?? (await sentry.release['propose-version']()).version;
     try {
       // The project has to be named here; the SDK default does not reach release creation.
-      await sentry.release.create({ orgVersion: release, project: values.project });
+      await sentry.release.create({ orgVersion: release, project });
       // Modules keep their served names (`.ts`, `.tsx`), which the upload skips by default. Only module
       // extensions go here: the upload pairs each module with the `.map` sibling `emitAssets` wrote.
       const ext = [...new Set(emitted.map(asset => path.extname(asset.file)))].join(',');

packages/remix/test/scripts/upload-sourcemaps.test.ts

@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 const createMock = vi.fn();
 const uploadSourceMapsMock = vi.fn();
@@ -48,12 +48,16 @@ beforeEach(() => {
   proposeVersionMock.mockClear();
 });
 
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
 describe('createRelease', () => {
   it('should use release param when given', async () => {
-    await createRelease({ release: '0.1.2.3' }, '~/build/', 'public/build');
+    await createRelease({ release: '0.1.2.3', project: 'my-project' }, '~/build/', 'public/build');
 
     expect(proposeVersionMock).not.toHaveBeenCalled();
-    expect(createMock).toHaveBeenCalledWith({ orgVersion: '0.1.2.3' });
+    expect(createMock).toHaveBeenCalledWith({ orgVersion: '0.1.2.3', project: 'my-project' });
     expect(uploadSourceMapsMock).toHaveBeenCalledWith({
       directory: 'public/build',
       release: '0.1.2.3',
@@ -64,10 +68,10 @@ describe('createRelease', () => {
   });
 
   it('should call `proposeVersion` when release param is not given.', async () => {
-    await createRelease({}, '~/build/', 'public/build');
+    await createRelease({ project: 'my-project' }, '~/build/', 'public/build');
 
     expect(proposeVersionMock).toHaveBeenCalled();
-    expect(createMock).toHaveBeenCalledWith({ orgVersion: '0.1.2.3.4' });
+    expect(createMock).toHaveBeenCalledWith({ orgVersion: '0.1.2.3.4', project: 'my-project' });
     expect(uploadSourceMapsMock).toHaveBeenCalledWith({
       directory: 'public/build',
       release: '0.1.2.3.4',
@@ -80,6 +84,7 @@ describe('createRelease', () => {
   it('should use given buildPath and urlPrefix over the defaults when given.', async () => {
     await createRelease(
       {
+        project: 'my-project',
         urlPrefix: '~/build/',
         buildPath: 'public/build',
       },
@@ -88,7 +93,7 @@ describe('createRelease', () => {
     );
 
     expect(proposeVersionMock).toHaveBeenCalled();
-    expect(createMock).toHaveBeenCalledWith({ orgVersion: '0.1.2.3.4' });
+    expect(createMock).toHaveBeenCalledWith({ orgVersion: '0.1.2.3.4', project: 'my-project' });
     expect(uploadSourceMapsMock).toHaveBeenCalledWith({
       directory: 'public/build',
       release: '0.1.2.3.4',
@@ -101,7 +106,7 @@ describe('createRelease', () => {
   it('logs an error when uploadSourceMaps fails', async () => {
     uploadSourceMapsMock.mockRejectedValue(new Error('Failed to upload sourcemaps'));
 
-    await createRelease({}, '~/build/', 'public/build');
+    await createRelease({ project: 'my-project' }, '~/build/', 'public/build');
 
     expect(uploadSourceMapsMock).toHaveBeenCalledWith({
       directory: 'public/build',
@@ -118,10 +123,26 @@ describe('createRelease', () => {
   it('logs an error when finalize fails', async () => {
     finalizeMock.mockRejectedValue(new Error('Failed to finalize release'));
 
-    await createRelease({}, '~/build/', 'public/build');
+    await createRelease({ project: 'my-project' }, '~/build/', 'public/build');
 
     expect(consoleWarnSpy).toHaveBeenCalledWith('[sentry] Failed to finalize release.');
   });
+
+  it('falls back to SENTRY_PROJECT for the release project', async () => {
+    vi.stubEnv('SENTRY_PROJECT', 'env-project');
+
+    await createRelease({ release: '0.1.2.3' }, '~/build/', 'public/build');
+
+    expect(createMock).toHaveBeenCalledWith({ orgVersion: '0.1.2.3', project: 'env-project' });
+  });
+
+  it('fails before creating a release when no project is known', async () => {
+    vi.stubEnv('SENTRY_PROJECT', '');
+
+    await expect(createRelease({ release: '0.1.2.3' }, '~/build/', 'public/build')).rejects.toThrow('--project');
+
+    expect(createMock).not.toHaveBeenCalled();
+  });
 });
 
 // To avoid `--isolatedModules` flag as we're not importing