feat: report errors to Sentry

.github/workflows/build.yml

@@ -90,6 +90,33 @@ jobs:
             - name: Add application changelog to build
               run: cp "${RUNNER_TEMP}/CHANGELOG.md" dist/backoffice/browser/CHANGELOG.md
 
+            # Upload source maps so Sentry shows the original code. Skipped
+            # until the SENTRY_* secrets are set. Debug IDs change the scripts,
+            # so the service worker hashes are updated after. Development
+            # builds have no service worker.
+            # The release name must match SENTRY_RELEASE in src/app/common/sentry.ts.
+            - name: Upload source maps to Sentry
+              env:
+                  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+                  SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
+                  SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
+              run: |
+                  if [ -z "$SENTRY_AUTH_TOKEN" ] || [ -z "$SENTRY_ORG" ] || [ -z "$SENTRY_PROJECT" ]; then
+                      echo "SENTRY_AUTH_TOKEN, SENTRY_ORG or SENTRY_PROJECT is not set. Skipping upload."
+                      exit 0
+                  fi
+                  release=$(bun -e "import { VERSION } from './src/env/version.ts'; console.log('backoffice@' + VERSION.hash)")
+                  bunx sentry-cli sourcemaps inject dist/backoffice/browser
+                  if [ -f dist/backoffice/browser/ngsw.json ]; then
+                      bun config/ngsw-rehash.js dist/backoffice/browser
+                  fi
+                  bunx sentry-cli sourcemaps upload --release="$release" dist/backoffice/browser
+
+            # Production builds make hidden source maps for Sentry only
+            - name: Remove hidden source maps
+              if: steps.build_ext.outputs.configuration != 'development'
+              run: find dist/backoffice/browser -name '*.map' -delete
+
             - name: Upload build artifact
               uses: actions/upload-artifact@v4
               with:

README.md

@@ -69,6 +69,11 @@ config/          Development proxy and build metadata scripts
 Most feature areas are lazy-loaded from `src/app/app.routes.ts`. The application
 uses hash-based routing and enables its service worker only in production.
 
+## Error reporting
+
+Backoffice sends errors to Sentry. See [`docs/sentry.md`](docs/sentry.md) to
+set the DSN for a domain and to set up source map uploads.
+
 ## Stack
 
 - Angular 22 and Angular Material

config/ngsw-rehash.js

@@ -0,0 +1,24 @@
+// Update the file hashes in a built ngsw.json after files change, for example
+// after `sentry-cli sourcemaps inject` adds debug IDs. The service worker
+// rejects files whose hash does not match.
+// Usage: bun config/ngsw-rehash.js dist/backoffice/browser
+const { createHash } = require('crypto');
+const { readFileSync, writeFileSync } = require('fs');
+const { join } = require('path');
+
+const dir = process.argv[2];
+if (!dir) throw new Error('Usage: ngsw-rehash.js <build directory>');
+const manifest_path = join(dir, 'ngsw.json');
+const manifest = JSON.parse(readFileSync(manifest_path, 'utf-8'));
+
+let changed = 0;
+for (const url of Object.keys(manifest.hashTable)) {
+    const hash = createHash('sha1')
+        .update(readFileSync(join(dir, url)))
+        .digest('hex');
+    if (manifest.hashTable[url] === hash) continue;
+    manifest.hashTable[url] = hash;
+    changed++;
+}
+writeFileSync(manifest_path, JSON.stringify(manifest, null, 2));
+console.log(`Updated ${changed} hashes in ${manifest_path}`);