Automate junior-prod update PRs after Junior release completion

[dcramer]

Summary

Set up an automated path from a completed @sentry/junior release to a dependency update PR in getsentry/junior-prod.

The intent is to push the event from getsentry/junior when the release is actually complete, rather than having junior-prod poll for new versions.

Why

junior-prod pins Junior packages directly. When a new Junior release lands, we want a predictable update PR opened in the consumer app repo without relying on manual follow-up.

This also needs validation built into the flow, because a version bump will not always produce a clean patch. In particular, the update workflow should run junior check (or the equivalent repo command) and fail loudly instead of opening a broken PR.

Proposed design

1. In getsentry/junior, emit a cross-repo trigger after the release/publish workflow has fully completed.
2. In getsentry/junior-prod, add a workflow that accepts the released version as input, updates pinned Junior packages, runs validation, and opens a PR.
3. Prefer a push model from junior to junior-prod over polling from junior-prod.

Requirements

• Trigger only after the Junior release is actually complete.
• Pass the exact released version into the consumer-repo workflow.
• Update all pinned Junior packages in junior-prod, not just @sentry/junior.
• Run validation before creating a PR:
  • pnpm install
  • pnpm check (junior check)
  • any other lightweight gate we consider necessary for this repo, such as pnpm typecheck
• Create a PR only when there is an actual diff.
• Make reruns/idempotency safe so we do not open duplicate PRs for the same version.
• Document the auth model for the cross-repo trigger.

Implementation notes

• workflow_dispatch in junior-prod is probably the cleanest receiver, with a version input.
• getsentry/junior can call that workflow via GitHub API once publish has succeeded.
• The source repo will need credentials that can dispatch workflows in junior-prod.
  • likely a GitHub App or a fine-grained PAT
• We should avoid triggering on an event that can race package availability.
  • If needed, key this off the final successful publish job rather than a generic release-created event.

Acceptance criteria

• Releasing Junior automatically kicks off the update workflow in junior-prod.
• The workflow bumps the pinned Junior packages to the released version.
• Validation runs before PR creation and blocks broken updates.
• A PR is opened automatically when the update is clean.
• No PR is created when there is no effective change.
• The setup and required secrets/auth are documented.