fix(graphql): prevent client schema errors from Sentry reporting

[sentry]

Previously, GraphQL schema validation errors (e.g., a client querying a non-existent field like 'foo' on 'TestResult') were being logged as 'GraphQL internal server error' and captured by Sentry. This was incorrect, as these are client-side mistakes, not server-side bugs.

This change modifies the error_formatter in graphql_api/views.py to specifically handle these client-side schema validation errors. For anonymous users, if the error message indicates a 'Cannot query field' issue, a generic INVALID_QUERY error is returned to the client, and the error is no longer logged to Sentry. This reduces Sentry noise and correctly classifies the error type, while preserving the security boundary of not exposing specific field names to anonymous users for invalid queries.

Legal Boilerplate

Look, I get it. The entity doing business as "Codecov" is owned by Harness, Inc. In 2026 Harness acquired Codecov and as a result Harness is going to need some rights from me in order to utilize my contributions in this PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Harness can use, modify, copy, and redistribute my contributions, under Harness's choice of terms.

Fixes API-EZF

_{This PR was automatically generated by Sentry. You can adjust this setting at any time.}

[thomasrockhu-codecov]

✨ Harness AI Code Review

View in Harness →

🛑 Risk: MEDIUM

This PR reclassifies GraphQL schema-validation errors from anonymous users (Cannot query field) as client errors, returning a generic INVALID_QUERY response and skipping the Sentry capture_exception path to cut noise. The branching logic is correct — the new if is_bad_query block is only reachable for anonymous users with a bad query, since authenticated/debug cases are handled by the guard above it. The one thing to fix first: an existing test still asserts the old INTERNAL SERVER ERROR message for this exact path and will now fail.

Top findings

• HIGH · TEST-GAP apps/codecov-api/graphql_api/views.py:355 — Existing test test_when_bad_query_and_anonymous still asserts the old INTERNAL SERVER ERROR message; not updated, will break CI.