fix(graphql_api): handle invalid GraphQL queries gracefully

[sentry]

Previously, GraphQLErrors caused by invalid client queries (e.g., requesting a non-existent field) were treated as unhandled internal server errors, particularly for anonymous users. This led to these client-side validation errors being logged at an error level and captured by Sentry.

This change modifies the error_formatter in AsyncGraphqlView to correctly identify and handle is_bad_query scenarios. Now, such errors will always result in a standard GraphQL error response being returned to the client, regardless of the user's authentication status. Additionally, these events are now logged at a warning level, and Sentry will no longer capture them as unhandled exceptions, reducing noise from non-actionable client errors.

Legal Boilerplate

Look, I get it. The entity doing business as "Codecov" is owned by Harness, Inc. In 2026 Harness acquired Codecov and as a result Harness is going to need some rights from me in order to utilize my contributions in this PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Harness can use, modify, copy, and redistribute my contributions, under Harness's choice of terms.

Fixes API-EZG

_{This PR was automatically generated by Sentry. You can adjust this setting at any time.}

[thomasrockhu-codecov]

✨ Harness AI Code Review

View in Harness →

🛑 Risk: MEDIUM

This PR makes GraphQL schema-validation errors (Cannot query field ...) always return a standard GraphQL error and log at warning level, instead of surfacing as an internal server error for anonymous users. The behavior change is correct and matches the description, but it invalidates an existing test that asserts the old anonymous-user behavior, so CI will fail until that test is updated.

Top findings

• HIGH · TEST apps/codecov-api/graphql_api/views.py:349 — Existing test test_when_bad_query_and_anonymous still asserts "INTERNAL SERVER ERROR" for the anonymous bad-query path the new guard now returns as a normal GraphQL error; the test must be updated.