The function collect_sourcemap_references is supposed to associate sourcemaps with their corresponding minified source files. If the minified source file contains a URL pointing to the sourcemap, everything is clear, but otherwise there is some guesswork involved (e.g. if the minified source file is foo.js see if there is a sourcemap foo.js.map, and so on).

The function guess_sourcemap_reference which implements these heuristics contains this bit right at the start:

I.e. if there is exactly one sourcemap, it will be associated with every source file that doesn't have an explicit URL set! That's obviously not right. During injection this manifests as sentry-cli trying to inject the same sourcemap multiple times, and the result of the injection depending on which minified source file it encounters first.

Attached is a zip containing a folder with a few source files and a single sourcemap. Running injection on it produces the following result:

❯ sentry-cli sourcemaps inject --dry-run test
[…]
Source Map Debug ID Injection Report
  Modified: The following source files have been modified to have debug ids
    26feb2ad-831d-5f13-8772-bc09c6393c06 - test/bar.js
    26feb2ad-831d-5f13-8772-bc09c6393c06 - test/baz.js
    26feb2ad-831d-5f13-8772-bc09c6393c06 - test/foo.js
  Modified: The following sourcemap files have been modified to have debug ids
    26feb2ad-831d-5f13-8772-bc09c6393c06 - test/baz.js.map
  Ignored: The following sourcemap files already have debug ids
    26feb2ad-831d-5f13-8772-bc09c6393c06 - test/baz.js.map
    26feb2ad-831d-5f13-8772-bc09c6393c06 - test/baz.js.map

If we remove the offending bit of code from guess_sourcemap_reference, we instead get

Source Map Debug ID Injection Report
  Modified: The following source files have been modified to have debug ids
    e242ed3b-ffcc-5f27-9b7f-baf34ed72d08 - test/bar.js
    26feb2ad-831d-5f13-8772-bc09c6393c06 - test/baz.js
    f1d2d2f9-24e9-56ac-86fd-f7b36c94bcdf - test/foo.js
  Modified: The following sourcemap files have been modified to have debug ids
    26feb2ad-831d-5f13-8772-bc09c6393c06 - test/baz.js.map

which makes much more sense. Note that baz.js and baz.js.map have the same debug ID because they are associated, whereas foo.js and bar.js have different debug IDs because they aren't associated with baz.js.map.

ETA: Forgot to attach repro.

test.zip