fix(graphql): stop Sentry reporting for client-side validation errors

[sentry]

Previously, when an anonymous client submitted a GraphQL query requesting a field that did not exist in the schema (e.g., isUser on the Owner type), the error_formatter in graphql_api/views.py would incorrectly categorize this as an INTERNAL SERVER ERROR.

This led to these client-side schema validation errors being logged as server errors and captured by Sentry, creating unnecessary noise and misrepresenting the nature of the issue.

This change modifies the error_formatter to specifically detect Cannot query field errors. For anonymous users, these are now returned as a ValidationError with a generic message, and crucially, they no longer trigger Sentry error capture. Authenticated users continue to receive the full GraphQL validation details. This ensures that only genuine server-side issues are reported to Sentry.

Legal Boilerplate

Look, I get it. The entity doing business as "Codecov" is owned by Harness, Inc. In 2026 Harness acquired Codecov and as a result Harness is going to need some rights from me in order to utilize my contributions in this PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Harness can use, modify, copy, and redistribute my contributions, under Harness's choice of terms.

Fixes API-F1D

_{This PR was automatically generated by Sentry. You can adjust this setting at any time.}

[thomasrockhu-codecov]

✨ Harness AI Code Review

View in Harness →

🛑 Risk: MEDIUM

This PR stops Sentry from capturing client-side GraphQL schema-validation errors ("Cannot query field") for anonymous users by returning a typed ValidationError response and returning early before capture_exception. The change itself is correct and well-scoped, but it changes behavior that an existing test explicitly asserts without updating that test, so CI will fail as-is. Fix the stale assertion before merge.

Top findings

• HIGH · TEST apps/codecov-api/graphql_api/views.py:353 — Existing test_when_bad_query_and_anonymous still asserts "INTERNAL SERVER ERROR"; the new anonymous bad-query path returns "Bad query: field does not exist on this type", so that test breaks.

[sentry]

⚠️ Seer needs additional GitHub permissions

Seer wants to keep iterating on this pull request to get CI passing, but the Sentry GitHub App installation is missing permissions it needs to read the failing checks and push a fix.

Review and accept the updated permissions to let Seer continue: https://github.com/organizations/codecov/settings/installations/86101127/permissions/update