fix(ci): add checkout and release URL, fix set-commits --auto API call

- Add actions/checkout with fetch-depth: 0 so set-commits --auto can
  discover the git remote and HEAD commit
- Add --url pointing to the GitHub release page
- Fix setCommitsAuto: list org repos, match against local git remote,
  send real refs with HEAD SHA instead of bogus {repository: 'auto'}
- Pass cwd through to setCommitsAuto from the command layer
- Move setCommitsAuto test to test/isolated/ (requires mock.module)

Author: BYK

.github/workflows/sentry-release.yml

@@ -27,6 +27,10 @@ jobs:
       # matching both the npm package version and Sentry release version.
       VERSION: ${{ github.event.release.tag_name || inputs.version }}
     steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
@@ -36,7 +40,9 @@ jobs:
         run: npm install -g "sentry@${VERSION}"
 
       - name: Create release
-        run: sentry release create "sentry/${VERSION}" --project cli
+        run: >-
+          sentry release create "sentry/${VERSION}" --project cli
+          --url "https://github.com/${{ github.repository }}/releases/tag/${VERSION}"
 
       - name: Set commits
         continue-on-error: true

src/commands/release/set-commits.ts

@@ -130,7 +130,7 @@ async function setCommitsDefault(
   }
 
   try {
-    const release = await setCommitsAuto(org, version);
+    const release = await setCommitsAuto(org, version, cwd);
     clearRepoIntegrationCache(org);
     return release;
   } catch (error) {
@@ -312,7 +312,7 @@ export const setCommitsCommand = buildCommand({
       );
     } else if (flags.auto) {
       // Explicit --auto: use repo integration, fail hard on error
-      release = await setCommitsAuto(resolved.org, version);
+      release = await setCommitsAuto(resolved.org, version, cwd);
     } else {
       // Default (no flag): try auto with cached fallback
       release = await setCommitsDefault(

src/lib/api/releases.ts

@@ -16,6 +16,8 @@ import {
   updateAnOrganization_sRelease,
 } from "@sentry/api";
 
+import { ApiError } from "../errors.js";
+import { getHeadCommit, getRepositoryName } from "../git.js";
 import { resolveOrgRegion } from "../region.js";
 import {
   apiRequestToRegion,
@@ -24,6 +26,7 @@ import {
   unwrapPaginatedResult,
   unwrapResult,
 } from "./infrastructure.js";
+import { listRepositories } from "./repositories.js";
 
 // We cast through `unknown` to bridge the gap between the SDK's internal
 // return types and the public response types — the shapes are compatible
@@ -269,32 +272,60 @@ export async function createReleaseDeploy(
 /**
  * Set commits on a release using auto-discovery mode.
  *
- * This uses the internal API format `refs: [{repository: "auto", commit: "auto"}]`
- * which is not part of the OpenAPI spec, so we use apiRequestToRegion directly.
+ * Lists the org's repositories from the Sentry API, matches against the
+ * local git remote URL to find the corresponding Sentry repo, then sends
+ * a refs payload with the HEAD commit SHA. This is the equivalent of the
+ * reference sentry-cli's `--auto` mode.
  *
- * Requires a GitHub/GitLab/Bitbucket integration configured in Sentry.
+ * Requires a GitHub/GitLab/Bitbucket integration configured in Sentry
+ * AND a local git repository whose origin remote matches a Sentry repo.
  *
  * @param orgSlug - Organization slug
  * @param version - Release version
+ * @param cwd - Working directory to discover git remote and HEAD from
  * @returns Updated release detail with commit count
+ * @throws {ApiError} When the org has no repository integrations (400)
  */
 export async function setCommitsAuto(
   orgSlug: string,
-  version: string
+  version: string,
+  cwd?: string
 ): Promise<OrgReleaseResponse> {
-  const regionUrl = await resolveOrgRegion(orgSlug);
-  const encodedVersion = encodeURIComponent(version);
-  const { data } = await apiRequestToRegion<OrgReleaseResponse>(
-    regionUrl,
-    `organizations/${orgSlug}/releases/${encodedVersion}/`,
-    {
-      method: "PUT",
-      body: {
-        refs: [{ repository: "auto", commit: "auto" }],
-      },
-    }
+  const repos = await listRepositories(orgSlug);
+  if (repos.length === 0) {
+    throw new ApiError(
+      "No repository integrations configured for this organization.",
+      400,
+      `organizations/${orgSlug}/releases/${encodeURIComponent(version)}/`
+    );
+  }
+
+  const localRepo = getRepositoryName(cwd);
+  if (!localRepo) {
+    throw new ApiError(
+      "Could not determine repository name from local git remote.",
+      400,
+      `organizations/${orgSlug}/releases/${encodeURIComponent(version)}/`
+    );
+  }
+
+  // Match local remote (e.g., "getsentry/cli") against Sentry repo names
+  const matchedRepo = repos.find(
+    (r) => r.name.toLowerCase() === localRepo.toLowerCase()
   );
-  return data;
+  if (!matchedRepo) {
+    throw new ApiError(
+      `No Sentry repository matching '${localRepo}'. ` +
+        `Available: ${repos.map((r) => r.name).join(", ")}`,
+      400,
+      `organizations/${orgSlug}/releases/${encodeURIComponent(version)}/`
+    );
+  }
+
+  const headCommit = getHeadCommit(cwd);
+  return setCommitsWithRefs(orgSlug, version, [
+    { repository: matchedRepo.name, commit: headCommit },
+  ]);
 }
 
 /**

test/isolated/set-commits-auto.test.ts

@@ -0,0 +1,134 @@
+/**
+ * Isolated tests for setCommitsAuto
+ *
+ * Uses mock.module() for git helpers, so must run in isolation
+ * to avoid polluting other test files' module state.
+ */
+
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import type { OrgReleaseResponse } from "@sentry/api";
+import { setAuthToken } from "../../src/lib/db/auth.js";
+import { setOrgRegion } from "../../src/lib/db/regions.js";
+import { mockFetch, useTestConfigDir } from "../helpers.js";
+
+useTestConfigDir("set-commits-auto-");
+
+mock.module("../../src/lib/git.js", () => ({
+  getRepositoryName: () => "getsentry/cli",
+  getHeadCommit: () => "abc123def456789012345678901234567890abcd",
+  isInsideGitWorkTree: () => true,
+  isShallowRepository: () => false,
+  getCommitLog: () => [],
+  getUncommittedFiles: () => [],
+  parseRemoteUrl: (url: string) => url,
+}));
+
+// Import after mock.module so the mocked git helpers are used
+const { setCommitsAuto } = await import("../../src/lib/api/releases.js");
+
+const SAMPLE_RELEASE: OrgReleaseResponse = {
+  id: 1,
+  version: "1.0.0",
+  shortVersion: "1.0.0",
+  status: "open",
+  dateCreated: "2025-01-01T00:00:00Z",
+  dateReleased: null,
+  firstEvent: null,
+  lastEvent: null,
+  ref: null,
+  url: null,
+  commitCount: 0,
+  deployCount: 0,
+  newGroups: 0,
+  authors: [],
+  projects: [
+    {
+      id: 1,
+      slug: "test-project",
+      name: "Test Project",
+      platform: "javascript",
+      platforms: ["javascript"],
+      hasHealthData: false,
+      newGroups: 0,
+    },
+  ],
+  data: {},
+  versionInfo: null,
+};
+
+const SAMPLE_REPO = {
+  id: "1",
+  name: "getsentry/cli",
+  url: "https://github.com/getsentry/cli",
+  provider: { id: "integrations:github", name: "GitHub" },
+  status: "active",
+};
+
+let originalFetch: typeof globalThis.fetch;
+
+beforeEach(async () => {
+  originalFetch = globalThis.fetch;
+  await setAuthToken("test-token");
+  setOrgRegion("test-org", "https://us.sentry.io");
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+describe("setCommitsAuto", () => {
+  test("lists repos, discovers HEAD, and sends refs to the API", async () => {
+    const withCommits = { ...SAMPLE_RELEASE, commitCount: 5 };
+    const requests: { method: string; url: string }[] = [];
+
+    globalThis.fetch = mockFetch(async (input, init) => {
+      const req = new Request(input!, init);
+      requests.push({ method: req.method, url: req.url });
+
+      // First request: list org repositories (SDK uses /repos/ endpoint)
+      if (req.url.includes("/repos/")) {
+        expect(req.method).toBe("GET");
+        return new Response(JSON.stringify([SAMPLE_REPO]), {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        });
+      }
+
+      // Second request: PUT refs on the release
+      expect(req.method).toBe("PUT");
+      expect(req.url).toContain("/releases/1.0.0/");
+      const body = (await req.json()) as {
+        refs: Array<{ repository: string; commit: string }>;
+      };
+      expect(body.refs).toEqual([
+        {
+          repository: "getsentry/cli",
+          commit: "abc123def456789012345678901234567890abcd",
+        },
+      ]);
+      return new Response(JSON.stringify(withCommits), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    });
+
+    const release = await setCommitsAuto("test-org", "1.0.0", "/tmp");
+
+    expect(release.commitCount).toBe(5);
+    expect(requests).toHaveLength(2);
+  });
+
+  test("throws when org has no repositories", async () => {
+    globalThis.fetch = mockFetch(
+      async () =>
+        new Response(JSON.stringify([]), {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        })
+    );
+
+    expect(setCommitsAuto("test-org", "1.0.0", "/tmp")).rejects.toThrow(
+      /No repository integrations/
+    );
+  });
+});

test/lib/api/releases.test.ts

@@ -15,7 +15,6 @@ import {
   getRelease,
   listReleaseDeploys,
   listReleasesPaginated,
-  setCommitsAuto,
   setCommitsLocal,
   updateRelease,
 } from "../../../src/lib/api/releases.js";
@@ -234,28 +233,8 @@ describe("createReleaseDeploy", () => {
 // setCommitsAuto
 // =============================================================================
 
-describe("setCommitsAuto", () => {
-  test("sends auto refs to the API", async () => {
-    const withCommits = { ...SAMPLE_RELEASE, commitCount: 5 };
-    globalThis.fetch = mockFetch(async (input, init) => {
-      const req = new Request(input!, init);
-      expect(req.method).toBe("PUT");
-      expect(req.url).toContain("/releases/1.0.0/");
-      const body = (await req.json()) as {
-        refs: Array<{ repository: string; commit: string }>;
-      };
-      expect(body.refs).toEqual([{ repository: "auto", commit: "auto" }]);
-      return new Response(JSON.stringify(withCommits), {
-        status: 200,
-        headers: { "Content-Type": "application/json" },
-      });
-    });
-
-    const release = await setCommitsAuto("test-org", "1.0.0");
-
-    expect(release.commitCount).toBe(5);
-  });
-});
+// setCommitsAuto tests are in test/isolated/set-commits-auto.test.ts
+// because they require mock.module() for git helpers.
 
 // =============================================================================
 // setCommitsLocal