fix(tempest): Prevent JSONDecodeError on empty error responses

[sentry]

This PR addresses an issue where JSONDecodeError: Input is a zero-length, empty document was raised when the Tempest API returned an HTTP error response (e.g., 504 Gateway Timeout) with an empty body.

The root cause was that response.json() was being called unconditionally in fetch_latest_item_id and _poll_tempest_crashes_impl within src/sentry/tempest/tasks.py, without first checking the HTTP status code using response.raise_for_status().

To fix this, response.raise_for_status() has been added before each call to response.json() in both affected functions. This ensures that non-2xx HTTP responses will correctly raise an HTTPError, which can then be handled by the existing exception logic, preventing the JSONDecodeError from occurring.

Legal Boilerplate

Look, I get it. The entity doing business as "Sentry" was incorporated in the State of Delaware in 2015 as Functional Software, Inc. and is gonna need some rights from me in order to utilize my contributions in this here PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Sentry can use, modify, copy, and redistribute my contributions, under Sentry's choice of terms.

Fixes SENTRY-3VC4

_{This PR was automatically generated by Sentry. You can adjust this setting at any time.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6b5b1cb. Configure here.}

[cursor]

Error body handling bypassed

High Severity

Calling raise_for_status() before response.json() in _fetch_latest_item_id_impl raises HTTPError for Tempest's documented error responses (401/403/500 with JSON bodies). That skips the existing "error" handling that sets user-facing messages for invalid_credentials, ip_not_allowlisted, and invalid_scope. Those failures fall into the generic Exception path, which only logs and leaves credentials.message unset.

 

^{Reviewed by Cursor Bugbot for commit 6b5b1cb. Configure here.}

[getsantry]

This pull request has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you add the label WIP, I will leave it alone unless WIP is removed ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀