Merge remote-tracking branch 'origin/master' into shayna-ch/np-legacy-issue-alerts

# Conflicts:
#	tests/sentry/notifications/notification_action/test_platform_dispatch.py

Co-Authored-By: Shayna Chambless <shayna.chambless@sentry.io>

Author: sentry-junior[bot]

.agents/skills/design-system/SKILL.md

@@ -523,6 +523,10 @@ If you answered yes to any of these, **use the primitive instead**.
 
 ## Other Core Components
 
+### Menus and Selects
+
+Use `DropdownMenu` for action menus and `CompactSelect` for choices. In forms, use the form system's `field.Select` or `field.CompactSelect`. `Menu` from `@sentry/scraps/menu` is an internal presentation primitive; use it directly only when implementing shared controls such as `DropdownMenu` and `CompactSelect`.
+
 ### Avatars
 
 Use the core avatar components (`<UserAvatar/>`, `<TeamAvatar/>`, `<ProjectAvatar/>`, `<OrganizationAvatar/>`, `<SentryAppAvatar/>`, `<DocIntegrationAvatar/>`) from `static/app/components/core/avatar`. For lists of avatars, use `<AvatarList>`.

.agents/skills/generate-frontend-forms/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: generate-frontend-forms
-description: Guide for creating forms using Sentry's new form system. Use when implementing forms, form fields, validation, or auto-save functionality.
+description: Guide for creating forms using Sentry's new form system. Use when implementing forms, form fields, display-only form content, validation, or auto-save functionality.
 ---
 
 # Form System Guide
@@ -23,6 +23,7 @@ import {z} from 'zod';
 import {
   AutoSaveForm,
   defaultFormOptions,
+  DisplayField,
   setFieldErrors,
   useScrapsForm,
 } from '@sentry/scraps/form';
@@ -98,7 +99,7 @@ function MyForm() {
 
 ## Field Components
 
-All fields are accessed via the `field` render prop and follow consistent patterns.
+Registered fields are accessed via the `field` render prop and follow consistent patterns. For display-only information without an input, use `DisplayField` as described below.
 
 ### Input Field (Text)
 
@@ -136,6 +137,8 @@ All fields are accessed via the `field` render prop and follow consistent patter
 
 ### Select Field (Single)
 
+Use `field.Select` for form choices. Do not compose a form select from bare `Menu` components; those are internal presentation primitives for shared controls.
+
 ```tsx
 <form.AppField name="country">
   {field => (
@@ -186,6 +189,10 @@ All fields are accessed via the `field` render prop and follow consistent patter
 </form.AppField>
 ```
 
+### Checkbox Group (Multiple Selections)
+
+Use `field.Checkbox.Group` and `field.Checkbox.Item` for multiple selections stored as one string array. Read the [checkbox group docs](../../../static/app/components/core/form/fields.mdx#checkbox-group) for the example, layout, validation, disabled state, and auto-save behavior.
+
 ### TextArea Field
 
 ```tsx
@@ -304,7 +311,7 @@ Use `field.Base` instead of building custom wrappers that duplicate this logic.
 
 ## Layouts
 
-Two layout options are available for positioning labels and fields.
+Use `field.Layout.Stack` or `field.Layout.Row` for registered fields. These layouts require field context and provide label/input association. For display-only information, use `DisplayField.Stack` or `DisplayField.Row` instead.
 
 ### Stack Layout (Vertical)
 
@@ -383,6 +390,38 @@ You are allowed to create new layouts if necessary, or not use any layouts at al
 
 ---
 
+## Display-Only Information
+
+Use `DisplayField.Row` or `DisplayField.Stack` for dates, status text, and other information without an input. Import `DisplayField` from `@sentry/scraps/form` and render it directly in a `FieldGroup` or alongside registered fields:
+
+```tsx
+<DisplayField.Row label={t('Created')}>
+  <Text>
+    <DateTime date={data.dateCreated} />
+  </Text>
+</DisplayField.Row>
+```
+
+- `Row` uses the same responsive layout as `field.Layout.Row`: it stacks below the `md` container breakpoint when a query container is present. Without a query container, it stays in a row.
+- `Stack` always places the value below the term.
+- Both accept `label`, `children`, `hintText`, `padding`, and `variant="compact"`. Compact mode puts the hint in a tooltip; otherwise it appears below the term in a row and after the value in a stack.
+- They render `dl`/`dt`/`dd`, without a `<label>`, input association, validation, or error-focus registration. No form or field context is required.
+- Style the displayed value explicitly, for example with `<Text>`; `DisplayField` does not wrap its children in `Text`.
+
+Do not register display-only information with `AppField` or `AutoSaveForm`, or add it to the schema or `defaultValues` just for layout. For a value derived from form state, calculate it during render with `form.Subscribe` rather than storing a second value with `form.setFieldValue`:
+
+```tsx
+<form.Subscribe selector={state => state.values.provider}>
+  {provider => (
+    <DisplayField.Stack label={t('Selected provider')}>
+      <Text>{provider ?? t('None selected')}</Text>
+    </DisplayField.Stack>
+  )}
+</form.Subscribe>
+```
+
+A read-only input is still a real input. Keep `AppField`, `field.Layout.*`, and `field.Input readOnly` for values that users select or copy from an input. Keep custom controls that handle form state on `field.Base`; do not replace them with `DisplayField`.
+
 ## Field Groups
 
 Group related fields into sections with a title.
@@ -1054,7 +1093,8 @@ When creating a new form:
 - [ ] Set `defaultValues` matching schema shape (use `z.input<typeof schema>` if schema has `.refine()`)
 - [ ] Set `validators: {onDynamic: schema}`
 - [ ] Wrap with `<form.AppForm form={form}>`
-- [ ] Use `<form.AppField>` for each field
+- [ ] Use `<form.AppField>` for each registered input, including read-only inputs
+- [ ] Use `DisplayField.Row` or `DisplayField.Stack` for display-only information; keep it out of form state
 - [ ] Choose appropriate layout (Stack or Row)
 - [ ] Narrow unknown errors to `RequestError` at the call site, convert them with `requestErrorToFieldErrors`, then call `setFieldErrors`
 - [ ] Add `<form.SubmitButton>` for submission
@@ -1081,4 +1121,5 @@ When creating auto-save fields:
 | `static/app/scrapsProviders/formError.tsx`             | Sentry request-error mapper |
 | `static/app/components/core/form/field/*.tsx`          | Individual field components |
 | `static/app/components/core/form/layout/index.tsx`     | Layout components           |
+| `static/app/components/core/form/displayField.tsx`     | Display-only layouts        |
 | `static/app/components/core/form/form.stories.tsx`     | Usage examples              |

.agents/skills/migrate-frontend-forms/SKILL.md

@@ -9,23 +9,24 @@ This skill helps migrate forms from Sentry's legacy form system (JsonForm, FormM
 
 ## Feature Mapping
 
-| Old System           | New System            | Notes                                                |
-| -------------------- | --------------------- | ---------------------------------------------------- |
-| `saveOnBlur: true`   | `AutoSaveForm`        | Default behavior                                     |
-| `confirm`            | `confirm` prop        | `string \| ((value) => string \| undefined)`         |
-| `showHelpInTooltip`  | `variant="compact"`   | On layout components                                 |
-| `disabledReason`     | `disabled="reason"`   | String shows tooltip                                 |
-| `extraHelp`          | JSX in layout         | Render `<Text>` below field                          |
-| `getData`            | `mutationFn`          | Transform data in mutation function                  |
-| `mapFormErrors`      | Request error adapter | Explicit for regular forms; provided for auto-save   |
-| `saveMessage`        | `onSuccess`           | Show toast in mutation onSuccess callback            |
-| `formatMessageValue` | `onSuccess`           | Control toast content in onSuccess callback          |
-| `resetOnError`       | `onError`             | Call form.reset() in mutation onError                |
-| `saveOnBlur: false`  | `useScrapsForm`       | Use regular form with explicit Save button           |
-| (automatic)          | `form.reset()`        | Call after successful mutation if form stays on page |
-| `help`               | `hintText`            | On layout components                                 |
-| `label`              | `label`               | On layout components                                 |
-| `required`           | `required`            | On layout + Zod schema                               |
+| Old System           | New System                                | Notes                                                |
+| -------------------- | ----------------------------------------- | ---------------------------------------------------- |
+| `saveOnBlur: true`   | `AutoSaveForm`                            | Default behavior                                     |
+| `confirm`            | `confirm` prop                            | `string \| ((value) => string \| undefined)`         |
+| `showHelpInTooltip`  | `variant="compact"`                       | On layout components                                 |
+| `disabledReason`     | `disabled="reason"`                       | String shows tooltip                                 |
+| `extraHelp`          | JSX in layout                             | Render `<Text>` below field                          |
+| `getData`            | `mutationFn`                              | Transform data in mutation function                  |
+| `mapFormErrors`      | Request error adapter                     | Explicit for regular forms; provided for auto-save   |
+| `saveMessage`        | `onSuccess`                               | Show toast in mutation onSuccess callback            |
+| `formatMessageValue` | `onSuccess`                               | Control toast content in onSuccess callback          |
+| `resetOnError`       | `onError`                                 | Call form.reset() in mutation onError                |
+| `saveOnBlur: false`  | `useScrapsForm`                           | Use regular form with explicit Save button           |
+| (automatic)          | `form.reset()`                            | Call after successful mutation if form stays on page |
+| `help`               | `hintText`                                | On layout components                                 |
+| `label`              | `label`                                   | On layout components                                 |
+| `required`           | `required`                                | On layout + Zod schema                               |
+| Display-only content | `DisplayField.Row` / `DisplayField.Stack` | No registered input or form state                    |
 
 ## Feature Details
 
@@ -591,6 +592,24 @@ return (
 
 A form that's never actually submitted bypasses validation, pending/disabled state, and field-error wiring.
 
+## Display-Only Information
+
+For dates, status text, or other content without an input, use `DisplayField.Row` or `DisplayField.Stack` from `@sentry/scraps/form`. Do not create an `AppField` or `AutoSaveForm` just to get a layout:
+
+```tsx
+<DisplayField.Row label={t('Created')}>
+  <Text>
+    <DateTime date={data.dateCreated} />
+  </Text>
+</DisplayField.Row>
+```
+
+Remove schema entries and default values that existed only to display this content. Preserve text styling with `<Text>` where needed. Use an existing `form.Subscribe` to calculate derived display values during render; do not copy them into form state with `form.setFieldValue`.
+
+`Row` matches the responsive field layout; `Stack` always stacks. These components use description-list semantics without a `<label>`, field context, or error-focus registration. Keep actual read-only inputs on `field.Input readOnly` inside `AppField` and `field.Layout.*` so they retain input association. Custom controls that handle form state still need `field.Base`.
+
+See the [form generation guide](../generate-frontend-forms/SKILL.md#display-only-information) for layout props and a subscription example.
+
 ## Preserving Form Search Functionality
 
 Sentry's SettingsSearch allows users to search for individual settings fields. When migrating forms, you must preserve this searchability by wrapping migrated forms with `FormSearch`.
@@ -728,7 +747,8 @@ For a nullable number field, use `z.number().nullable()` in the form schema and
 - [ ] Replace JsonForm/FormModel with useScrapsForm or AutoSaveForm
 - [ ] No generics on `useMutation` — type the `mutationFn` payload and use `fetchMutation<T>` for the return type
 - [ ] When using `useScrapsForm` with a Save button: mutation runs in `onSubmit`, triggered by `<form.SubmitButton>` (no form that's never submitted)
-- [ ] Convert field config objects to JSX AppField components
+- [ ] Convert input field config objects to JSX AppField components
+- [ ] Convert display-only content to `DisplayField.Row` or `DisplayField.Stack`, without schema or form-state entries
 - [ ] Validate conditionally required fields on the rendered `AppField`, with a permissive form schema
 - [ ] Replace `help` → `hintText` on layouts
 - [ ] Replace `showHelpInTooltip` → `variant="compact"`

.agents/skills/sentry-security/references/enforcement-layers.md

@@ -71,7 +71,7 @@ Classes like `Validator`, `ManualTokenRefresher`, `GrantExchanger`, and `Refresh
 
 ## Non-DRF Views
 
-OAuth views (`OAuthAuthorizeView`, `OAuthDeviceView`, `OAuthTokenView`) are plain Django views, **not** DRF endpoints. Layers 1–4 do not apply to the view itself. Check the view's own authentication decorators, `dispatch()`, and handler logic directly.
+OAuth token exchange (`OAuthTokenView`) and device code issuance (`OAuthDeviceAuthorizationView`) use plain Django views. Check their authentication, `dispatch()`, and handler logic directly. Consent uses the DRF `OAuthAuthorizeEndpoint` and `OAuthDeviceEndpoint`; layers 1–4 apply to those endpoints.
 
 However, tokens issued by these views are later used at DRF API endpoints where layers 1–7 **do** apply. See "Cross-Flow Enforcement" below.
 

.codeowners-config.yml

@@ -49,8 +49,7 @@ team_allowlist:
   - getsentry/profiling
   - getsentry/python-typing
   - getsentry/release-approvers
-  - getsentry/replay-backend
-  - getsentry/replay-frontend
+  - getsentry/replay
   - getsentry/revenue
   - getsentry/scm
   - getsentry/security

.craft.yml

@@ -1,11 +1,22 @@
-minVersion: '2.33.1'
+minVersion: '3.0.0'
 workspaces:
   sentry:
     preReleaseCommand: bash scripts/bump-version.sh
     releaseBranchPrefix: releases
     changelog:
       filePath: CHANGES
       policy: auto
+      # Files outside every workspace (src/, tests/, root config) belong to
+      # this changelog only, not to the scraps or icons changelogs.
+      unownedPaths: own
+      # Craft treats pnpm workspace directories as separately owned and drops
+      # their commits from this changelog unless they are listed here.
+      includePaths:
+        - api-docs
+        - static/app
+        - static/gsAdmin
+        - static/gsApp
+        - tests/js
     statusProvider:
       name: github
       config:
@@ -38,7 +49,7 @@ workspaces:
       name: github
       config:
         contexts:
-          - scraps-package-verify
+          - scraps-package-pack
     artifactProvider:
       name: github
       config:
@@ -52,3 +63,27 @@ workspaces:
         access: public
     versioning:
       policy: auto
+  static/packages/icons:
+    preReleaseCommand: >-
+      sh -c 'npm --prefix static/packages/icons --no-git-tag-version --package-lock=false --allow-same-version version "$CRAFT_NEW_VERSION"'
+    releaseBranchPrefix: icons/release
+    changelog:
+      policy: auto
+    statusProvider:
+      name: github
+      config:
+        contexts:
+          - icons-package-pack
+    artifactProvider:
+      name: github
+      config:
+        artifacts:
+          Icons package:
+            - icons-tarball
+    targets:
+      - name: github
+        tagPrefix: icons@
+      - name: npm
+        access: public
+    versioning:
+      policy: auto