feat: Add a GitHub Action and Craft releases, and remove the local proxy

[sentry-junior]

Roach is now only the shared service. This PR adds a GitHub Action, so a repository can adopt the service with one step and a roach.json file. It releases the action and the service image with Craft, and it removes the local proxy, which nothing used.

- uses: getsentry/roach@v0
  with:
    token: ${{ secrets.ROACH_TOKEN }} # without it, the run can only replay
    run: pnpm test

The action (action.yml, src/action.ts)

• Starts a run for the tenant GITHUB_REPOSITORY. It uses auto mode with the token, and replay mode without it, as for forks.
• Runs run in bash with the proxy variables of the run. Only that command uses the proxy, so later steps such as cache saves and artifact uploads still work. The command never gets the write token, and the action masks the run token in logs.
• Wraps the command in one session. When the command fails, the run drops its new recordings. A replay miss fails the step.
• When the job is canceled, it stops all processes of the command, then ends the run.
• Writes the stats and the first miss to the log and the job summary.
• Runs src/action.ts directly on node24, so it needs no build step and no dependencies.

Client changes (src/client.ts)

• The CA file also has the certificates of the job's NODE_EXTRA_CA_CERTS, so a job keeps trusting its own CAs.
• If startRemoteRun cannot write the CA file, it ends the run before it throws. Before, the run stayed open until the 6-hour timeout.

Releases (.craft.yml, .github/workflows/release.yml)

• The manual Release workflow calls the Craft release workflow, as in getsentry/warden. A release manager accepts the release in getsentry/publish.
• Craft makes the GitHub release v<version> and moves the v<major> tag for the action. Warden needs a dist/ build and -src tags; Roach does not, because the action runs from source.
• Craft copies the image ghcr.io/getsentry/roach:<sha> to :<version>. CI and the Image workflow now also run on release/** branches, so Craft can check the release and find its image.
• package.json has no version. The git tag is the version.

Removed

• The local proxy: spawnRoach, startRoach, the CLI serve and prune commands, usedFile, missDirectory, RoachConfig, RoachAddress and the ./server export. The CLI now has only service.
• The "closest recording" hint for misses. The service never passed it through, and the GCS store can't produce it.

Tests

• tests/deployed.test.ts runs the action against the production-shape service, in place of tests/ci-job.ts. It covers a run with the token that records, a run without it that replays, and a miss that fails the step.
• The recording tests now run against the service, in tests/recording.test.ts.
• pnpm check passes with 12 tests.

Before the first release

• Roach needs the SENTRY_RELEASE_BOT_CLIENT_ID variable and the SENTRY_RELEASE_BOT_PRIVATE_KEY secret.
• getsentry/publish needs push access to ghcr.io/getsentry/roach.

Not covered yet

• The action and the release workflow have not run on GitHub. Cancellation was tested only locally.
• Misses are named per job, not per test. A per-test Vitest hook is follow-up work.
• NODE_EXTRA_CA_CERTS works only for Node.
• Terraform still deploys :main. Pinning a version is follow-up work.
• The shared ROACH_TOKEN can write recordings for every tenant, so only trusted repos and workflows should get it.

via David Cramer.

--

View Junior Session [Sentry]

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 231e32c. Configure here.}