fix(docker): install a CA bundle so the Sentry CLI can verify TLS (#16)

[arpitdalal]

Follow-up to #20, which is correct but does not deploy.

Merging it turned the previously unreachable Sentry API call into a reachable one, and it failed:

sentry-cli releases new 6e751d2…
[60] SSL peer certificate or SSH remote key was not OK
    (SSL certificate problem: unable to get local issuer certificate)

node:22.23.3-bookworm-slim ships no CA bundle at all:

$ docker run --rm node:22.23.3-bookworm-slim ls /etc/ssl/certs/ca-certificates.crt
ls: cannot access '/etc/ssl/certs/ca-certificates.crt': No such file or directory
$ docker run --rm node:22.23.3-bookworm-slim dpkg -l ca-certificates
un  ca-certificates  <none>  <none>

Node is unaffected because it bundles its own root store, which is why npm install worked and nothing else in the build looked wrong. The native sentry-cli that @sentry/vite-plugin shells out to is a Rust binary that reads the system store instead, so it is the only thing in this image that cannot make an HTTPS request.

Adds ca-certificates to the build stage only — the runtime image stays slim — plus a test pinning it, since the failure is invisible until a real upload is attempted and there is no local harness for a remote build.

Worth noting how this surfaced: because #20 sets errorHandler to rethrow, the deploy failed. Before that the same TLS problem would have been logged and swallowed, the maps deleted in the plugin's finally, and the build green — the original #16 symptom, one layer further down.

Verified: npm run validate clean · 20 tests in tests/sentry-release.test.ts.

Summary by CodeRabbit

• Bug Fixes
  • Improved TLS certificate availability in Docker builds, helping prevent certificate validation failures during release operations.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 46796477-2da2-4979-8df4-aaafde9e8b6e

📥 Commits

Reviewing files that changed from the base of the PR and between 6e751d2 and 4faa438.

📒 Files selected for processing (2)

• other/Dockerfile
• tests/sentry-release.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Docker build stage now installs ca-certificates and removes apt package lists. A test checks that the build stage includes the package installation command.

Changes

Docker CA certificates

Layer / File(s)	Summary
Build-stage trust store other/Dockerfile, tests/sentry-release.test.ts	The Docker build stage installs ca-certificates and removes apt package lists. The test checks that the installation command includes the package.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 4faa4

The production build installs system CA certificates before running Sentry release and source-map operations. No actionable merge-blocking risk remains.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 4faa4

This is a narrowly scoped build-time trust-store change that preserves TLS verification and does not extend runtime privileges. No security regression was demonstrated, but recovery after partially completed Sentry operations remains unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The immediate exposure is the remote build environment and authenticated release/source-map operations for the configured Sentry organization and project. The token's maximum authority and server-side permissions are not established by the inspected configuration.

Trust Boundaries and Controls

• observed — Sentry inputs come from repository secrets, are checked for nonempty values in deployment, and are mounted as required build secrets. These existing controls and commit-derived release identity remain unchanged by the CA addition.

Resilience and Maintainability Implications

• inferred — Required inputs and a throwing error handler contain missing-input and reported plugin failures locally. They do not prove atomicity or recovery of the newly enabled external release operations; no unsafe transition was demonstrated.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: installing a CA bundle in Docker so the Sentry CLI can verify TLS.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}