build(core): Add public API surface tracking with api-extractor

[antonis]

📢 Type of change

• Bugfix
• New feature
• Enhancement
• Refactoring

📜 Description

Adds @microsoft/api-extractor to track the public API surface of @sentry/react-native. A baseline report is generated and committed at packages/core/etc/sentry-react-native.api.md. A CI job validates the report is up to date on every PR.

New files:

• packages/core/api-extractor.json — api-extractor configuration
• packages/core/tsconfig.api-extractor.json — dedicated tsconfig for api-extractor compatibility
• packages/core/etc/sentry-react-native.api.md — committed API baseline (173 exported symbols)

Modified files:

• packages/core/package.json — added devDependency + api-report:generate / api-report:check scripts
• package.json — added yarn api-report root shortcut
• .github/workflows/buildandtest.yml — added job_api_report CI job
• .gitignore — excludes api-extractor temp files
• CONTRIBUTING.md — documents the developer workflow

💡 Motivation and Context

The Sentry Cocoa SDK uses swift-api-digester and the Android SDK uses Metalava to track public API surfaces and prevent accidental breaking changes. The React Native SDK had no equivalent. This brings parity with the native SDKs.

React Native core (facebook/react-native) also uses @microsoft/api-extractor for this purpose.

Closes #6092

💚 How did you test it?

• Generated the initial baseline with yarn api-report:generate — produced 751-line report with 173 exports
• Verified yarn api-report:check passes (no diff from baseline)
• All existing tests pass (yarn test)
• All linting passes (yarn lint)
• Circular dependency check passes (yarn circularDepCheck)

📝 Checklist

• I added tests to verify changes
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled
• I updated the docs if needed.
• I updated the wizard if needed.
• All tests passing
• No breaking changes

🔮 Next steps

• Review and clean up public API surface types #6094
• Audit RN-specific public exports against documentation #6095

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

• build(core): Add public API surface tracking with api-extractor by antonis in #6093

• chore(deps): bump axios from 1.15.0 to 1.16.0 by dependabot in #6091
• ci: Add workflow to notify issues when fix is released by antonis in #6089
• ci: Add Danger check to warn about auth token handling changes by antonis in #6087
• Fix PNPM iOS Upload Debug Symbol fail in EAS Build by alwx in #6086
• chore(deps): update Sentry Android Gradle Plugin to v6.6.0 by github-actions in #6085
• fix(e2e): Remove flaky iOS replay assertion from captureReplay test by antonis in #6072
• chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by dependabot in #6078
• fix: Prevent shell injection vulnerability in GitHub Actions workflow by fix-it-felix-sentry in #6077
• chore(deps): update Maestro to v2.5.1 by github-actions in #6075

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against 25767c0

[alwx]

I wonder if it’s really the best solution for this purpose. Have you explored any alternatives? I’ve just found this post with someone mostly complaining about api-extractor and started wondering: https://www.thecandidstartup.org/2024/07/19/bootstrapping-api-extractor.html

[antonis]

@alwx I did a short research and didn't find something better for this purpose. I chose this since it is actively maintained and also used on the react native repo
That said, I'll be happy to explore alternatives