feat(integrations): Block published SentryApps from dropdown
diff --git a/src/sentry/incidents/endpoints/organization_alert_rule_available_action_index.py b/src/sentry/incidents/endpoints/organization_alert_rule_available_action_index.py
index 55abfdbee493d..732b2c39181d6 100644
--- a/src/sentry/incidents/endpoints/organization_alert_rule_available_action_index.py
+++ b/src/sentry/incidents/endpoints/organization_alert_rule_available_action_index.py
@@ -89,7 +89,9 @@ def get(self, request, organization):
                 ):
                     actions += [
                         build_action_response(registered_type, sentry_app=app)
-                        for app in get_alertable_sentry_apps(organization.id)
+                        for app in get_alertable_sentry_apps(
+                            organization.id, with_metric_alerts=True
+                        )
                     ]
 
             else:
diff --git a/src/sentry/incidents/logic.py b/src/sentry/incidents/logic.py
index e502cfecad4db..d4e03d244b26b 100644
--- a/src/sentry/incidents/logic.py
+++ b/src/sentry/incidents/logic.py
@@ -11,7 +11,7 @@
 
 from sentry import analytics
 from sentry.api.event_search import get_filter, resolve_field
-from sentry.constants import SentryAppInstallationStatus
+from sentry.constants import SentryAppInstallationStatus, SentryAppStatus
 from sentry.incidents import tasks
 from sentry.incidents.models import (
     AlertRule,
@@ -1206,12 +1206,16 @@ def get_available_action_integrations_for_org(organization):
     return Integration.objects.filter(organizations=organization, provider__in=providers)
 
 
-def get_alertable_sentry_apps(organization_id):
-    return SentryApp.objects.filter(
+def get_alertable_sentry_apps(organization_id, with_metric_alerts=False):
+    query = SentryApp.objects.filter(
         installations__organization_id=organization_id,
         is_alertable=True,
         installations__status=SentryAppInstallationStatus.INSTALLED,
-    ).distinct()
+    )
+
+    if with_metric_alerts:
+        query = query.exclude(status=SentryAppStatus.PUBLISHED)
+    return query.distinct()
 
 
 def get_pagerduty_services(organization, integration_id):
diff --git a/tests/sentry/incidents/endpoints/test_organization_alert_rule_available_action_index.py b/tests/sentry/incidents/endpoints/test_organization_alert_rule_available_action_index.py
index 68de74f8e47e7..2569a5cab184b 100644
--- a/tests/sentry/incidents/endpoints/test_organization_alert_rule_available_action_index.py
+++ b/tests/sentry/incidents/endpoints/test_organization_alert_rule_available_action_index.py
@@ -29,6 +29,16 @@ def setUp(self):
         super(OrganizationAlertRuleAvailableActionIndexEndpointTest, self).setUp()
         self.login_as(self.user)
 
+    def install_new_sentry_app(self, name, **kwargs):
+        kwargs.update(
+            name=name, organization=self.organization, is_alertable=True, verify_install=False
+        )
+        sentry_app = self.create_sentry_app(**kwargs)
+        self.create_sentry_app_installation(
+            slug=sentry_app.slug, organization=self.organization, user=self.user
+        )
+        return sentry_app
+
     def test_build_action_response_email(self):
         data = build_action_response(self.email)
 
@@ -127,12 +137,7 @@ def test_no_feature(self):
         assert resp.status_code == 404
 
     def test_sentry_apps(self):
-        sentry_app = self.create_sentry_app(
-            name="foo", organization=self.organization, is_alertable=True, verify_install=False
-        )
-        self.create_sentry_app_installation(
-            slug=sentry_app.slug, organization=self.organization, user=self.user
-        )
+        sentry_app = self.install_new_sentry_app("foo")
 
         with self.feature(
             ["organizations:incidents", "organizations:integrations-sentry-app-metric-alerts"]
@@ -146,3 +151,21 @@ def test_sentry_apps(self):
             ),
             build_action_response(self.email),
         ]
+
+    def test_blocked_sentry_apps(self):
+        internal_sentry_app = self.install_new_sentry_app("internal")
+        # Should not show up in available actions.
+        self.install_new_sentry_app("published", published=True)
+
+        with self.feature(
+            ["organizations:incidents", "organizations:integrations-sentry-app-metric-alerts"]
+        ):
+            resp = self.get_valid_response(self.organization.slug)
+
+        assert resp.data == [
+            build_action_response(
+                AlertRuleTriggerAction.get_registered_type(AlertRuleTriggerAction.Type.SENTRY_APP),
+                sentry_app=internal_sentry_app,
+            ),
+            build_action_response(self.email),
+        ]

When we turn on Metric Alert Integrations, we don't want to surprise anyone with new webhook types. To prevent this, temporarily block public SentryApps from showing up in the dropdown. Rather than blocking the one app by DB ID, we're excluding it by `status`. Once we have an established metric alerts webhook format, then we can unblock them.