feat(lighthouse-ci): bundle test apps and upload to lighthouse.sentry.gg lab

Replace the in-CI Lighthouse runs with a build-bundle-upload pipeline that
ships prebuilt test apps to the dedicated Sentry Lighthouse lab service
(https://lighthouse.sentry.gg). The lab runs Lighthouse on stable, dedicated
hardware — eliminating the measurement noise we hit on shared GitHub-hosted
runners — persists results, and ships every metric to Sentry under the
lighthouse.* namespace.

Companion to the spec at ~/Projects/sentry-lhci/docs/sentry-javascript-handoff.md.

Concretely:

- Rename dev-packages/lighthouse-tests/ to dev-packages/lighthouse-bundle/.
  The directory's job is no longer 'tests' — it's bundle preparation.

- Delete the in-CI Lighthouse infrastructure: lighthouserc.cjs (lab owns
  the LHCI config now), report.mjs (Job Summary moves into the new script),
  and lighthouse-matrix.mjs (matrix is just a hardcoded constant in the
  upload script — no GitHub Actions matrix expansion needed anymore).

- Add bundle-and-upload.mjs: zero-deps (Node 22 builtins only — fetch,
  FormData, Blob, system tar). For each (app, mode) cell, copies the app
  to a temp dir, applies the existing ci:pnpm-overrides helper, builds
  with the right SENTRY_LIGHTHOUSE_MODE / NEXT_PUBLIC_SENTRY_LIGHTHOUSE_MODE
  / REACT_APP_SENTRY_LIGHTHOUSE_MODE env vars (every prefix set at once —
  each app's bundler picks up whichever it knows), and tars the result.

  Static cells (default-browser, react-19) bundle only their build/ dir.
  SSR cell (nextjs-16) strips node_modules + pnpm-lock.yaml, copies the
  packed SDK tgzs into ./packed/ inside the bundle, and rewrites every
  workspace-absolute file: path in package.json (dependencies,
  devDependencies, pnpm.overrides) to file:./packed/... so pnpm install
  can resolve them after the lab extracts the tarball.

  All 9 bundles are POSTed as one multipart request to /api/builds; the
  script then polls /api/builds/:id every 15s for up to 25 minutes and
  appends a markdown summary table to $GITHUB_STEP_SUMMARY with per-cell
  status, median score, and Lighthouse-report links.

- Strip dependencies from dev-packages/lighthouse-bundle/package.json.
  The script only needs Node builtins.

- Rewrite .github/workflows/lighthouse.yml. Two jobs:
  * job_build — SDK build + tarball generation (unchanged).
  * job_bundle_and_upload — single non-matrix job; runs the script after
    restoring tarballs and seeding dev-packages/e2e-tests/packed/ via
    yarn test:prepare. Per-cell parallelism gained nothing once Lighthouse
    moved off the runner.

Requires two new repo secrets in getsentry/sentry-javascript:
  - LIGHTHOUSE_LAB_URL (https://lighthouse.sentry.gg)
  - LIGHTHOUSE_UPLOAD_TOKEN (mirror of the lab's Northflank UPLOAD_TOKEN)

Triggers: nightly cron at 00:00 UTC plus workflow_dispatch for ad-hoc runs.

Author: HazAT

.github/workflows/lighthouse.yml

@@ -1,18 +1,23 @@
 name: 'Nightly: Lighthouse'
 
-# Standalone workflow that runs Lighthouse audits across instrumented E2E test apps
-# on a nightly schedule (and on demand via workflow_dispatch). Intentionally NOT
-# wired to pull_request triggers — the per-PR comment was too noisy to keep on
-# every push, so the report now surfaces only as a Job Summary on each workflow
-# run page. Never blocks merges (not referenced by build.yml's required-jobs gate).
+# Builds the instrumented Sentry test apps (default-browser, react-19, nextjs-16)
+# in three Sentry feature modes (no-sentry, init-only, tracing-replay), tars each
+# of the 9 cells, and uploads them to the Sentry Lighthouse lab at
+# https://lighthouse.sentry.gg.
+#
+# The lab runs Lighthouse on dedicated hardware (no shared-runner flake), saves
+# results to its own DB + dashboard, and ships metrics to Sentry. See the wire
+# protocol in ~/Projects/sentry-lhci/docs/sentry-javascript-handoff.md.
+#
+# This workflow only builds + uploads — no Lighthouse runs on GitHub Actions.
+# Never blocks merges (not in build.yml's required-jobs gate).
 
 on:
   schedule:
     - cron: '0 0 * * *'
   workflow_dispatch:
 
-# Independent concurrency group from build.yml so nothing in this workflow can
-# cancel or queue against the main CI pipeline.
+# Independent of build.yml so nothing here can cancel or queue against main CI.
 concurrency:
   group: lighthouse-${{ github.run_id }}
   cancel-in-progress: false
@@ -29,11 +34,10 @@ env:
 
 jobs:
   job_build:
-    name: Build SDK + Generate Matrix
+    name: Build SDK + Tarballs
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     outputs:
-      matrix: ${{ steps.matrix.outputs.matrix }}
       dependency_cache_key: ${{ steps.install_dependencies.outputs.cache_key }}
     steps:
       - name: Check out current commit
@@ -64,42 +68,33 @@ jobs:
           compression-level: 6
           overwrite: true
 
-      - name: Generate matrix
-        id: matrix
-        # Script prints `matrix=<JSON>` to stdout; redirect to $GITHUB_OUTPUT so the
-        # downstream matrix job can pick it up via needs.job_build.outputs.matrix.
-        run: node dev-packages/lighthouse-tests/lighthouse-matrix.mjs >> "$GITHUB_OUTPUT"
-
-  job_lighthouse:
-    name: Lighthouse ${{ matrix.app }} (${{ matrix.mode }})
+  job_bundle_and_upload:
+    name: Bundle test apps and upload to Lighthouse lab
     needs: [job_build]
-    runs-on: ubuntu-24.04-large-js
-    timeout-minutes: 20
-    # One bad cell shouldn't tank the rest of the matrix — the Report job marks
-    # missing/empty cells in the Job Summary.
-    continue-on-error: true
-    strategy:
-      fail-fast: false
-      max-parallel: 15
-      matrix: ${{ fromJson(needs.job_build.outputs.matrix) }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
     env:
-      # Only the two prefixes the currently-matrixed apps actually consume:
-      #   - SENTRY_LIGHTHOUSE_MODE  → default-browser (plain webpack)
-      #   - NEXT_PUBLIC_*           → nextjs-16 (Next.js client-side env exposure)
-      # If more frameworks are added to the matrix later, add the corresponding
-      # prefix here. (Tracked in TODO-aeab11f0.)
+      LIGHTHOUSE_LAB_URL: ${{ secrets.LIGHTHOUSE_LAB_URL }}
+      LIGHTHOUSE_UPLOAD_TOKEN: ${{ secrets.LIGHTHOUSE_UPLOAD_TOKEN }}
+      # Synthetic DSNs — the apps only need *something* parseable at build time;
+      # nothing actually phones home (the Lighthouse run is what we care about).
       E2E_TEST_DSN: 'https://username@domain/123'
       NEXT_PUBLIC_E2E_TEST_DSN: 'https://username@domain/123'
+      PUBLIC_E2E_TEST_DSN: 'https://username@domain/123'
+      REACT_APP_E2E_TEST_DSN: 'https://username@domain/123'
     steps:
       - name: Check out current commit
         uses: actions/checkout@v6
+
       - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           version: 9.15.9
+
       - name: Set up Node
         uses: actions/setup-node@v6
         with:
-          node-version-file: 'dev-packages/e2e-tests/test-applications/${{ matrix.app }}/package.json'
+          node-version-file: 'package.json'
+
       - name: Restore caches
         uses: ./.github/actions/restore-cache
         with:
@@ -111,92 +106,17 @@ jobs:
           name: lighthouse-build-tarball-output
           path: ${{ env.TARBALL_ARTIFACT_DOWNLOAD_PATH }}
 
-      - name: Prepare E2E tests
+      - name: Prepare E2E tests (copy packed tgzs into dev-packages/e2e-tests/packed)
         run: yarn test:prepare
         working-directory: dev-packages/e2e-tests
 
       - name: Validate E2E tests setup
         run: yarn test:validate
         working-directory: dev-packages/e2e-tests
 
-      - name: Copy app to temp
-        run: yarn ci:copy-to-temp ./test-applications/${{ matrix.app }} ${{ runner.temp }}/test-application
-        working-directory: dev-packages/e2e-tests
-
-      - name: Add pnpm overrides
-        run:
-          yarn ci:pnpm-overrides ${{ runner.temp }}/test-application ${{ github.workspace
-          }}/dev-packages/e2e-tests/packed
-        working-directory: dev-packages/e2e-tests
-
-      - name: Build E2E app for Lighthouse
-        working-directory: ${{ runner.temp }}/test-application
-        timeout-minutes: 7
-        run: pnpm test:build
-        env:
-          SENTRY_E2E_WORKSPACE_ROOT: ${{ github.workspace }}
-          SENTRY_LIGHTHOUSE_MODE: ${{ matrix.mode }}
-          NEXT_PUBLIC_SENTRY_LIGHTHOUSE_MODE: ${{ matrix.mode }}
-
-      - name: Run Lighthouse CI
-        id: lighthouse
-        # Pinned to a commit SHA (rather than the floating @v12 tag) to lock down the
-        # supply chain: this third-party action also npm-installs @lhci/cli, so an
-        # upstream tag-repoint could otherwise change what runs on our runners.
-        # SHA is the current tip of v12. Bump deliberately when upgrading.
-        uses: treosh/lighthouse-ci-action@3e7e23fb74242897f95c0ba9cabad3d0227b9b18 # v12
-        with:
-          configPath: ${{ github.workspace }}/dev-packages/lighthouse-tests/lighthouserc.cjs
-          # Do NOT enable uploadArtifacts here — it would upload `.lighthouseci/` under
-          # the default name `lighthouse-reports` for every cell, causing a 409 conflict
-          # on every matrix cell after the first one. We do our own per-cell upload
-          # below with a unique name (lighthouse-<app>-<mode>).
-          temporaryPublicStorage: true
-          runs: 5
-        env:
-          # lighthouserc.cjs branches on these env vars at config-load time.
-          LIGHTHOUSE_SERVE_MODE: ${{ matrix.serve }}
-          LIGHTHOUSE_STATIC_DIR: ${{ runner.temp }}/test-application/${{ matrix.static-dir }}
-          LIGHTHOUSE_START_CMD: cd ${{ runner.temp }}/test-application && ${{ matrix.start-cmd }}
-          LIGHTHOUSE_READY_PATTERN: ${{ matrix.ready-pattern }}
-          LIGHTHOUSE_URL: 'http://localhost:3000/'
-
-      - name: Upload Lighthouse results
-        # `resultsPath` is the absolute path to the .lighthouseci/ output dir written by
-        # `lhci collect`. The dir is dot-prefixed, and actions/upload-artifact@v7 excludes
-        # hidden files / dot-prefixed dirs by default — so we must set
-        # `include-hidden-files: true` or every cell uploads zero files.
-        uses: actions/upload-artifact@v7
-        if: always() && steps.lighthouse.outputs.resultsPath != ''
-        with:
-          name: lighthouse-${{ matrix.app }}-${{ matrix.mode }}
-          path: ${{ steps.lighthouse.outputs.resultsPath }}
-          include-hidden-files: true
-          retention-days: 7
-          # Fail loudly if the dir is empty — we already gated on resultsPath being set,
-          # so an empty dir means lhci collect produced nothing, which is a real bug.
-          if-no-files-found: error
-
-  job_lighthouse_report:
-    name: Lighthouse Report
-    needs: [job_build, job_lighthouse]
-    if: always() && needs.job_build.result == 'success'
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Check out current commit
-        uses: actions/checkout@v6
-      - name: Set up Node
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: 'package.json'
-      - name: Restore caches
-        uses: ./.github/actions/restore-cache
-        with:
-          dependency_cache_key: ${{ needs.job_build.outputs.dependency_cache_key }}
-      - name: Download all Lighthouse artifacts
-        uses: actions/download-artifact@v7
-        with:
-          pattern: lighthouse-*
-          path: lighthouse-results/
-      - name: Generate report
-        run: node dev-packages/lighthouse-tests/report.mjs
+      - name: Bundle every cell and upload to the lab
+        # bundle-and-upload.mjs handles the full 3 × 3 matrix in one process:
+        # copies each app to a temp dir, applies pnpm overrides, builds with the
+        # right SENTRY_LIGHTHOUSE_MODE env var, tars, POSTs all 9 bundles to the
+        # lab, polls until terminal, writes a Job Summary.
+        run: node dev-packages/lighthouse-bundle/bundle-and-upload.mjs