Distillation

Date: Sep 8, 2026

• 🔴 (20:29) User directive: Always run trusted code.
• 🔴 (20:29) User directive: Never move a release to ci-ready after its approval/request changes; a renamed or re-approved issue never reaches ci-ready.
• 🟡 (20:29) .github/workflows/auto-approve.yml now grants issues: write; pins actions/checkout to 11d5960a326750d5838078e36cf38b85af677262 and actions/create-github-app-token to bcd2ba49218906704ab6c1aa796996da409d3eb1.
• 🟡 (20:29) auto-approve.yml adds "Record automated approval attestation" before automated acceptance: runs node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN: ${{ github.token }}, issue number/repository/title, and AUTO_APPROVER: ${{ github.actor }}; "Post automated approval attestation" posts its auto_approval_attestation output with GH_TOKEN: ${{ github.token }}; "Auto-approve if repo is in the list" runs only when attestation succeeded and uses the internal-app token.
• 🟡 (20:29) .github/workflows/ci-poller.yml changes issues permission from read to write, adds validated workflow_dispatch attempt handling (ATTEMPT must match ^[0-9]+$), and defines later ATTEMPT from steps.dispatch-attempt.outputs.value only for workflow_dispatch, otherwise '0'.
• 🟡 (20:29) ci-poller.yml adds "Get publish code" before authentication, pinned to actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, with ref: ${{ github.event.repository.default_branch }} and persist-credentials: false, ensuring any dispatch ref executes default-branch trusted code. All actions/create-github-app-token uses are pinned to bcd2ba49218906704ab6c1aa796996da409d3eb1.
• 🟡 (20:29) CI poller binds each cycle to current-accepted-event.js before inspecting CI, captures accepted_actor and accepted_event_id, and runs validate-approval-attestation.js with expected actor/event. If binding or validation fails, it removes ci-pending and accepted, posts Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue., and continues.
• 🟡 (20:29) CI poller replaces shell sed title parsing with parsePublishTitle from src/modules/details-from-context.js; derives repo as "getsentry/" + .repo and version as .version, so polling and publishing share parsing semantics.
• 🟡 (20:29) When CI passes, ci-poller.yml revalidates the approval attestation after final CI checks; then runs record-ci-ready-attestation.js with current expected accepted actor/event, reads ci_ready_attestation from a mktemp GITHUB_OUTPUT, verifies output starts ci_ready_attestation=, posts it using ${{ github.token }}, and revalidates approval once more immediately before adding ci-ready. Any failure removes ci-pending/accepted, posts the invalid-approval message, and prevents moving forward.
• 🟡 (20:29) .github/workflows/publish.yml adds pinned "Get publish code" checkout (actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, persist-credentials: false) before authorizing an accepted-label event.
• 🟡 (20:29) Publish workflow authorization flow: obtains a release-bot token with pinned actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 and owner: getsentry; runs node src/publish/authorize-approval.js; posts its approval attestation as github-actions[bot]; validates it via node src/publish/validate-approval-attestation.js; on failed authorization, attestation posting, or validation, removes accepted, posts the invalid-approval retry message, and exits 1.
• 🟡 (20:29) Publish job checks out publish code to .__publish__ with pinned actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803; validates approval with REQUIRE_CI_READY_ATTESTATION: "true" before setup/publishing and rejects invalid approval by removing accepted, commenting, and exiting 1.
• 🟡 (20:29) Immediately after "Set targets" and before "Publish using Craft", publish workflow adds "Revalidate approval attestation" with REQUIRE_CI_READY_ATTESTATION: "true" plus "Reject revoked approval"; validation failure removes accepted, posts the invalid-approval retry message, and exits 1.
• 🟡 (20:29) Workflow dependencies are immutable-pinned: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38, actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830, all checkout actions at d23441a48e516b6c34aea4fa41551a30e30af803 where changed, and Craft from mutable docker://getsentry/craft:latest to docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b.
• 🟡 (20:29) AGENTS.md now links long-term lore-managed project knowledge to root .lore.md through a maintained ## Long-term Knowledge section.
• 🟡 (20:29) src/modules/details-from-context.js exports parsePublishTitle and PUBLISH_TITLE_REGEX; detailsFromContext() now calls that shared parser and throws Invalid publish issue title: ${context.payload.issue.title} when parsing fails. Tests cover qualified publish: getsentry/sentry-javascript/packages/core@10.0.0 → { repo: "sentry-javascript", path: "/packages/core", version: "10.0.0" } and legacy publish: sentry-javascript@10.0.0 → same repo/version with path: undefined.
• 🟡 (20:29) src/modules/update-issue.js now tolerates absent/unparseable publish inputs: it always removes the accepted label but calls updateTargets() only when inputs?.version exists. New test verifies undefined inputs for issue "211" removes { owner: "getsentry", repo: "publish", issue_number: "211", name: "accepted" } without checking state files, fetching/updating the issue, or updating targets.
• 🟡 (20:29) src/publish/update-issue.js is refactored into async main(): parses PUBLISH_ARGS only if set; invalid JSON logs Could not parse publish inputs; skipping target update; awaits updateIssue; invoked-main errors are logged and set process.exitCode = 1; exports { main }.
• 🟡 (20:29) Most other modified JavaScript files (src/libs/github.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/publish/inputs.js, src/publish/post-result.js, and src/publish/post-workflow-details.js) received formatting-only changes; getGitHubToken() retains its full missing-token error message despite its test now matching only the initial sentence.
• 🟡 (20:29) Test run yarn run v1.22.22 / vitest run --printConsoleTrace completed successfully: 16 test files passed and 71 tests passed; Vitest v4.0.17, duration 2.11s (transform 270ms, import 1.19s, tests 331ms), Yarn completed in 2.59s.
• 🟡 (20:29) src/publish/__tests__/publish-workflow.js verifies "Revalidate approval attestation" occurs after "Set targets" and before "Publish using Craft", includes REQUIRE_CI_READY_ATTESTATION: "true" afterward, and asserts Craft is pinned to docker://getsentry/craft@sha256:[a-f0-9]{64}.
• 🟡 (20:29) src/publish/__tests__/auto-approval-workflow.js verifies record-auto-approval-attestation.js runs before --add-label accepted; "Post automated approval attestation" uses GH_TOKEN: ${{ github.token }}, while the later labeling flow uses GH_TOKEN: ${{ steps.token.outputs.token }}.
• 🟡 (20:29) src/publish/__tests__/record-ci-ready-attestation.js verifies a CI-ready attestation binds title publish: getsentry/sentry-javascript@10.0.0, accepted actor/event "contractor"/"100", and CI-ready actor "sentry-internal-app[bot]"; it rejects changed live title with The approval changed before CI could be marked ready and rejects re-approval event "200" when expected accepted event is "100".
• 🟡 (20:29) src/publish/__tests__/record-auto-approval-attestation.js verifies automated requester "getsantry[bot]" is bound to a live open request authored by that bot, with title publish: getsentry/sentry-javascript@10.0.0, and rejects changed author "contractor" with The automated approval request changed before approval.
• 🟡 (20:30) src/publish/__tests__/current-accepted-event.js verifies getCurrentAcceptedEvent() selects latest accepted-label event "200" by "contractor" over "100" and rejects no event with The issue has no current accepted label event.
• 🟡 (20:30) Shell arithmetic failed with /usr/bin/bash: line 1: 09: value too great for base (error token is "09"), indicating a leading-zero value 09 was interpreted as invalid octal.