[sentry]

Problem

When an anonymous client submitted a GraphQL request referencing non-existent types or fields (e.g. mutation($input: UpdateDefaultBranchInput!) { updateDefaultBranch(input: $input) ... }), the GraphQL validation phase failed with a GraphQLError containing no original_error.

In graphql_api.views.error_formatter, unauthenticated requests with malformed queries fell through to the fallback branch, which:

1. Replaced the error message with INTERNAL SERVER ERROR (hiding the validation error from the client),
2. Logged at ERROR level, and
3. Called capture_exception(original_error) (and the Ariadne integration captured the GraphQLError as an unhandled server error in Sentry).

Solution

1. In graphql_api/views.py, detect schema validation errors (errors with no original_error whose message begins with known graphql-core validation prefixes such as Unknown type, Cannot query field, Unknown argument, etc.). Surface the formatted error with type: 'ValidationError', log a warning, increment api_gql_counts_validation_errors, and avoid reporting to Sentry.
2. In codecov/settings_base.py, add a before_send hook to sentry_sdk.init to drop GraphQLError events caused solely by schema validation, preventing Ariadne's automated exception capture from creating Sentry issues for client-side typos and invalid queries.
3. Legitimate server errors (exceptions raised by resolvers/services/internal code) remain fully captured and reported to Sentry.

Legal Boilerplate

Look, I get it. The entity doing business as "Codecov" is owned by Harness, Inc. In 2026 Harness acquired Codecov and as a result Harness is going to need some rights from me in order to utilize my contributions in this PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Harness can use, modify, copy, and redistribute my contributions, under Harness's choice of terms.

Fixes API-FAV

_{@sentry <feedback>: Autofix iterates on these changes
@sentry stop iterating: Autofix stops iterating on this run}

_{This PR was automatically generated by Sentry. You can adjust this setting at any time.}

---

Note

Low Risk
Behavior change is limited to GraphQL error formatting and Sentry filtering for known client-side validation failures; real server exceptions remain reported unchanged.

Overview
GraphQL schema validation failures are now treated as client errors instead of internal server faults, so anonymous callers get real validation messages and Sentry stops filling with bogus API issues.

In graphql_api/views.py, validation is detected via is_graphql_validation_error (no original_error, message matches known graphql-core prefixes). Those responses use type: ValidationError, log at warning, and increment api_gql_counts_validation_errors—without masking the message as INTERNAL SERVER ERROR or calling capture_exception. Resolver and service exceptions still follow the existing server-error path.

In codecov/settings_base.py, Sentry init gets a before_send hook that drops matching GraphQLError events so Ariadne’s automatic capture doesn’t reopen the same noise; prefix lists stay duplicated with a sync comment to GQL_VALIDATION_ERROR_PREFIXES.

^{Reviewed by Cursor Bugbot for commit a7446eb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sentry]

⚠️ Sentry needs additional GitHub App permissions

The Sentry GitHub App installation for this repository is missing permissions it needs to keep iterating on this pull request to get CI passing.

Review and accept the updated permissions to let Seer continue: https://github.com/organizations/codecov/settings/installations/86101127/permissions/update