ci(cloudflare): Run the integration tests on the latest wrangler too

The required Cloudflare integration test job keeps the wrangler and
`@cloudflare/vite-plugin` versions of the package. A new optional job
runs the same steps with the latest versions of both, so a new wrangler
or workerd release shows up in CI early but cannot block a PR. Like the
optional E2E tests, it does not run on release branches. The two jobs
share their steps through a YAML anchor.

The runner starts `wrangler dev` on 127.0.0.1, because with the latest
wrangler `localhost` connects over IPv6 and changes the captured client
address.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: JPeer264

.github/workflows/build.yml

@@ -854,6 +854,7 @@ jobs:
         working-directory: dev-packages/node-integration-tests
         run: pnpm run test --shard=${{ matrix.shard }}/3
 
+  # Runs on the wrangler pinned in the package, so the required run stays on a fixed, older runtime.
   job_cloudflare_integration_tests:
     name: Cloudflare Integration Tests (${{ matrix.shard }}/2)
     needs: [job_get_metadata, job_build]
@@ -864,7 +865,7 @@ jobs:
       fail-fast: false
       matrix:
         shard: [1, 2]
-    steps:
+    steps: &cloudflare_integration_tests_steps
       - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
         uses: actions/checkout@v7
         with:
@@ -878,10 +879,37 @@ jobs:
         with:
           dependency_cache_key: ${{ needs.job_build.outputs.dependency_cache_key }}
 
+      # The Vite plugin depends on wrangler and writes config for it, so both move together. In the hoisted layout,
+      # pnpm keeps the nested `node_modules` folders of the old versions (for example an old workerd under
+      # `node_modules/wrangler`), so the install starts from empty `node_modules` folders.
+      - name: Install the latest wrangler
+        if: matrix.wrangler == 'latest'
+        run: |
+          pnpm --filter @sentry-internal/cloudflare-integration-tests add --save-dev --lockfile-only wrangler@latest @cloudflare/vite-plugin@latest
+          rm -rf node_modules packages/*/node_modules dev-packages/*/node_modules
+          pnpm install --frozen-lockfile --filter @sentry-internal/cloudflare-integration-tests...
+
       - name: Run integration tests
         working-directory: dev-packages/cloudflare-integration-tests
         run: pnpm run test --shard=${{ matrix.shard }}/2
 
+  # Shows breakage from new wrangler and workerd releases early. It is not in `job_required_jobs_passed`, so it cannot
+  # block a PR, and like the optional E2E tests it does not run on release branches.
+  job_optional_cloudflare_integration_tests:
+    name: Cloudflare Integration Tests (${{ matrix.shard }}/2, latest wrangler) (optional)
+    needs: [job_get_metadata, job_build]
+    if:
+      needs.job_get_metadata.outputs.is_release != 'true' && (needs.job_build.outputs.changed_cloudflare_integration ==
+      'true' || github.event_name != 'pull_request')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2]
+        wrangler: [latest]
+    steps: *cloudflare_integration_tests_steps
+
   job_bundler_plugin_integration_tests:
     name: Bundler Plugin Integration Tests (Node ${{ matrix.node }})
     needs: [job_get_metadata, job_build]

dev-packages/cloudflare-integration-tests/runner.ts

@@ -489,6 +489,8 @@ export function createRunner(...paths: string[]) {
                 'false',
                 '--var',
                 `SENTRY_DSN:http://public@localhost:${mockServerPort}/1337`,
+                '--ip',
+                '127.0.0.1',
                 '--port',
                 '0',
                 '--inspector-port',
@@ -521,6 +523,10 @@ export function createRunner(...paths: string[]) {
               `SENTRY_DSN:http://public@localhost:${mockServerPort}/1337`,
               '--var',
               `SERVER_URL:${serverUrl}`,
+              // Requests go to `localhost`, which can resolve to `::1`. The IPv4 listener keeps the
+              // client address at `127.0.0.1`, which the event expectations check.
+              '--ip',
+              '127.0.0.1',
               '--port',
               '0',
               '--inspector-port',