fix(graphql): prevent invalid queries from anonymous users being reported as server errors

[sentry]

Previously, when an anonymous user submitted a GraphQL query that attempted to query a non-existent field (e.g., `foo` on `CoverageAnnotation`), the `GraphQLError` generated was incorrectly treated as an internal server error. This led to unnecessary logging as "GraphQL internal server error" and capture by Sentry.

The error_formatter in apps/codecov-api/graphql_api/views.py has been updated. The condition if debug or (not is_anonymous and is_bad_query): was modified to if debug or is_bad_query:. This ensures that any GraphQLError containing "Cannot query field" is correctly identified as a client-side schema validation error, regardless of whether the user is authenticated or anonymous. Such errors will now be returned directly to the client as a standard GraphQL error, without being logged as a server fault or sent to Sentry.

Legal Boilerplate

Look, I get it. The entity doing business as "Codecov" is owned by Harness, Inc. In 2026 Harness acquired Codecov and as a result Harness is going to need some rights from me in order to utilize my contributions in this PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Harness can use, modify, copy, and redistribute my contributions, under Harness's choice of terms.

Fixes API-F08

_{This PR was automatically generated by Sentry. You can adjust this setting at any time.}

[thomasrockhu-codecov]

✨ Harness AI Code Review

View in Harness →

✅ Risk: LOW

This PR simplifies the error_formatter condition in apps/codecov-api/graphql_api/views.py from if debug or (not is_anonymous and is_bad_query): to if debug or is_bad_query:, so that "Cannot query field" schema-validation errors from anonymous users are returned to the client as normal GraphQL errors instead of being masked as INTERNAL SERVER ERROR, logged, and sent to Sentry. The change is correct, low-risk, and matches its description; these errors only reveal schema field names, which are already exposed via GraphQL introspection.

No issues found above the confidence threshold.

[sentry]

⚠️ Seer needs additional GitHub permissions

Seer wants to keep iterating on this pull request to get CI passing, but the Sentry GitHub App installation is missing permissions it needs to read the failing checks and push a fix.

Review and accept the updated permissions to let Seer continue: https://github.com/organizations/codecov/settings/installations/86101127/permissions/update