fix(difs): Use PROTECT for shared debug files

`ProjectDebugFile.file` can now be shared by multiple rows.

Update the Django relation from `CASCADE` to `PROTECT` so ORM deletes match the intended ownership model. Keep deleting the backing `File` as a best-effort cleanup step after deleting a `ProjectDebugFile`, but leave it in place when another `ProjectDebugFile` still references it.

This prepares us for [#106947](#106947), where aliasing is a concrete use case for shared `File` rows.

The database should already reject deleting a referenced `File`; this change makes Django raise `ProtectedError` instead of relying on a DB-level failure path.

Author: szokeasaurusrex

migrations_lockfile.txt

@@ -33,7 +33,7 @@ replays: 0007_organizationmember_replay_access
 
 seer: 0002_add_default_coding_agent
 
-sentry: 1050_projectkeymapping_uniq_constraint
+sentry: 1051_protect_projectdebugfile_file
 
 social_auth: 0003_social_auth_json_field
 

src/sentry/migrations/1051_protect_projectdebugfile_file.py

@@ -0,0 +1,37 @@
+# Generated by Django 5.2.11 on 2026-03-11 11:29
+
+import django.db.models.deletion
+import sentry.db.models.fields.foreignkey
+from django.db import migrations
+
+from sentry.new_migrations.migrations import CheckedMigration
+
+
+class Migration(CheckedMigration):
+    # This flag is used to mark that a migration shouldn't be automatically run in production.
+    # This should only be used for operations where it's safe to run the migration after your
+    # code has deployed. So this should not be used for most operations that alter the schema
+    # of a table.
+    # Here are some things that make sense to mark as post deployment:
+    # - Large data migrations. Typically we want these to be run manually so that they can be
+    #   monitored and not block the deploy for a long period of time while they run.
+    # - Adding indexes to large tables. Since this can take a long time, we'd generally prefer to
+    #   run this outside deployments so that we don't block them. Note that while adding an index
+    #   is a schema change, it's completely safe to run the operation after the code has deployed.
+    # Once deployed, run these manually via: https://develop.sentry.dev/database-migrations/#migration-deployment
+
+    is_post_deployment = False
+
+    dependencies = [
+        ("sentry", "1050_projectkeymapping_uniq_constraint"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="projectdebugfile",
+            name="file",
+            field=sentry.db.models.fields.foreignkey.FlexibleForeignKey(
+                on_delete=django.db.models.deletion.PROTECT, to="sentry.file"
+            ),
+        ),
+    ]

src/sentry/models/debugfile.py

@@ -15,7 +15,7 @@
 from typing import TYPE_CHECKING, Any, BinaryIO, ClassVar
 
 from django.db import models
-from django.db.models import Q
+from django.db.models import ProtectedError, Q
 from django.db.models.functions import Now
 from django.utils import timezone
 from symbolic.debuginfo import Archive, BcSymbolMap, Object, UuidMapping, normalize_debug_id
@@ -119,7 +119,7 @@ def find_by_debug_ids(
 class ProjectDebugFile(Model):
     __relocation_scope__ = RelocationScope.Excluded
 
-    file = FlexibleForeignKey("sentry.File")
+    file = FlexibleForeignKey("sentry.File", on_delete=models.PROTECT)
     checksum = models.CharField(max_length=40, null=True, db_index=True)
     object_name = models.TextField()
     cpu_name = models.CharField(max_length=40)
@@ -195,7 +195,16 @@ def features(self) -> frozenset[str]:
 
     def delete(self, *args: Any, **kwargs: Any) -> tuple[int, dict[str, int]]:
         ret = super().delete(*args, **kwargs)
-        self.file.delete()
+
+        # If another debug file row still references this File, keep the File.
+        # Concurrent last-reference deletes can still leave an unreferenced File
+        # row behind, but no surviving ProjectDebugFile should point to a deleted
+        # File.
+        try:
+            self.file.delete()
+        except ProtectedError:
+            pass
+
         return ret
 
 

tests/sentry/models/test_debugfile.py

@@ -8,6 +8,7 @@
 from typing import Any
 
 import pytest
+from django.core.files.base import ContentFile
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.urls import reverse
 
@@ -43,6 +44,34 @@ def test_delete_dif(self) -> None:
         assert not ProjectDebugFile.objects.filter(id=dif_id).exists()
         assert not File.objects.filter(id=dif.file.id).exists()
 
+    def test_delete_shared_file_keeps_file_until_last_reference_removed(self) -> None:
+        file = self.create_file(
+            name="shared.dSYM",
+            type="project.dif",
+            headers={"Content-Type": "application/x-mach-binary"},
+        )
+        file.putfile(ContentFile(b""))
+
+        dif1 = self.create_dif_file(
+            debug_id="00000000-0000-0000-0000-000000000000",
+            file=file,
+        )
+        dif2 = self.create_dif_file(
+            debug_id="11111111-1111-1111-1111-111111111111",
+            file=file,
+        )
+
+        dif1.delete()
+
+        assert not ProjectDebugFile.objects.filter(id=dif1.id).exists()
+        assert ProjectDebugFile.objects.filter(id=dif2.id).exists()
+        assert File.objects.filter(id=file.id).exists()
+
+        dif2.delete()
+
+        assert not ProjectDebugFile.objects.filter(id=dif2.id).exists()
+        assert not File.objects.filter(id=file.id).exists()
+
     def test_find_dif_by_debug_id(self) -> None:
         debug_id1 = "dfb8e43a-f242-3d73-a453-aeb6a777ef75"
         debug_id2 = "19bd7a09-3e31-4911-a5cd-8e829b845407"