[v-abhishekbhaskar]

What are you trying to accomplish?

#16801 adds an error-context field to unknown-error reports, plus Dependabot::ErrorReportContext.attach/build so code can attach debugging context to an exception. This PR fills that field from the error sources in common that every ecosystem uses. The most frequent unknown errors then arrive with enough detail to debug them without reproducing the job.

The context is diagnostic only. It is never part of the fingerprint, so error grouping is unchanged.

Context now added:

Source	Keys
Excon::Error::HTTPStatus	http-method, host, http-status (from an Excon::Response or a raw response hash)
Excon::Error::Socket	socket-error-class (e.g. EOFError)
Dependabot::RegistryClient get/head timeouts and socket errors	http-method, host
Errors including Dependabot::HasSentryContext	Allowlisted sentry_context[:extra] keys: helper-function, helper-exit-status, helper-termsig, helper-time-taken, package-manager-name, updated-files, dependency-files, dependency-names
SharedHelpers::HelperSubprocessFailed	helper-error-class
Any error with a cause	cause-class

Example payload for a registry timeout during an npm update:

"error-context": {
  "dependency-name": "lodash",
  "dependency-version": "4.17.21",
  "dependency-requirement-files": ["package.json"],
  "http-method": "GET",
  "host": "registry.npmjs.org"
}

Anything you want to highlight for special attention from reviewers?

• Stacked on Pass error-context from core to api for forwarding to sentry #16801. This PR will be rebased onto main once Pass error-context from core to api for forwarding to sentry #16801 merges.
• Allowlist, not passthrough. sentry_context[:extra] is only forwarded through SENTRY_EXTRA_KEYS. Helper args, command and stderr_output are always dropped because they can contain credentials or private registry URLs. dependencies is reduced to names only, and the pid is stripped from process_exit_value.
• Host only. RegistryClient uses ErrorReportContext.host_for(url), so paths, query strings and userinfo are never sent.
• Cached registry errors. RegistryClient replays a cached error for later requests to the same host. A replayed error keeps the context of the request that originally failed, so a cached GET timeout isn't relabelled as a HEAD request.
• Precedence. Context is gathered from the error and up to 5 causes. Values on the outer error win.

Adding context from a package manager (follow-up PRs):

• At the raise or rescue site, call Dependabot::ErrorReportContext.attach(error, { host: ErrorReportContext.host_for(url), manifest_file: "Cargo.toml" }) and re-raise. This works on any exception and needs no change to common.
• For error classes that already implement sentry_context, add the safe key to SENTRY_EXTRA_KEYS in common/lib/dependabot/error_report_context.rb.

How will you know you've accomplished your goal?

New specs cover:

• Excon HTTP status errors raised by a real request and built from a raw response hash.
• Excon socket errors in a cause chain.
• The HelperSubprocessFailed allowlist (secrets dropped, pid stripped).
• NoChangeError-style sentry_context.
• RegistryClient attaching method and host, and keeping the original context on a replayed cached error.

Validation (host Ruby):

• cd common && bundle exec rspec spec/dependabot/error_report_context_spec.rb spec/dependabot/registry_client_spec.rb: 74 examples, 0 failures
• cd updater && bundle exec rspec spec/dependabot/updater/error_handler_spec.rb spec/dependabot/service_spec.rb: 66 examples, 0 failures
• bundle exec rubocop on the changed files: no offenses
• bundle exec srb tc: no errors

Once deployed, unknown errors in Sentry such as Excon read timeouts and EOFError should show the registry host and HTTP method in error-context.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

🟡 Changes recommended

Unresolved merge-conflict markers make the updater spec invalid Ruby and prevent it from loading; the resolution must retain the randomized dependency matcher and add the helper-error-class expectation to avoid order-dependent failures.

1 open issue

• Resolve merge-conflict markers in the updater spec · New

What changed in this PR

Extends the error-context reporting introduced in #16801 to common error sources shared across ecosystems, adding diagnostic details without changing error grouping.

Changes:

• Extracts HTTP, socket, helper, allowlisted Sentry extras, and cause details.
• Attaches request method and host to registry failures while preserving cached errors’ original context.
• Expands specs for context extraction, sensitive-data exclusion, and reporting.

File	Description
common/​lib/​dependabot/​error_report_context.rb	Extracts diagnostic context from common error types.
common/​lib/​dependabot/​registry_client.rb	Attaches method and host to registry failures.
common/​spec/​dependabot/​error_report_context_spec.rb	Covers extraction, allowlisting, and cause precedence.
common/​spec/​dependabot/​registry_client_spec.rb	Tests host-only context and cached-error preservation.
updater/​spec/​dependabot/​service_spec.rb	Verifies allowlisted helper context is reported.
updater/​spec/​dependabot/​updater/​error_handler_spec.rb	Adds helper error-class expectations.
updater/​spec/​dependabot/​updater_spec.rb	Updates grouped-update error-context expectations.

_{Review effort: Balanced}

The base branch was changed.

[Copilot]

🟢 Approval recommended

No active review issues remain for the changes adding richer diagnostic context to shared error reports.

No open issues 🎉

1 resolved since last review

• Resolve merge-conflict markers in the updater spec

_{Review effort: Balanced}