Distillation

Date: Sep 8, 2026

• 🔴 [requested-audit] (02:11) User requested a strict read-only adversarial final audit of /home/byk/Code/getsentry/publish-workspace-acceptance, with no file edits, formatting, artifact generation, git-mutating commands, or state changes. Requested review of the complete diff against origin/main and relevant surrounding source/tests/workflows; evidence-based severity-ordered findings with exact file:line references; explicit PASS/FAIL for each contract; exact final verdict MERGE or DO-NOT-MERGE; exact blocker if blocked; and only a final audit report.
• 🔴 (02:11) User required audit verification of release-revision contract: canonical header at body start; required Merge target; exactly one global - [View check runs]( occurrence including embedded and outside-header strings; URL bound to requested getsentry repository, a 40-character lowercase hexadecimal revision, /checks, and optional terminal slash; error/update behavior remains correct.
• 🔴 (02:11) User required audit verification that the title parser/documentation use a generated single source and that generation fails when documentation markers are absent.
• 🔴 (02:11) User required audit verification that blank/malformed Craft workspace discovery fails with a contextual invalid-list error, while a missing root configuration remains checkout-path fallback.
• 🔴 (02:11) User required audit verification that workflow refactor preserves checkout of the exact CI revision before discovery, getsentry/craft:latest, fail-closed discovery, and state handling.
• 🔴 (02:11) User required audit verification of JSON output serialization/fallback behavior and the checkout@v7 request.
• 🔴 (02:11) User required audit verification that tests cover fixes, generated artifacts are current, and the diff/repository have no unrelated churn.
• 🔴 (02:11) User supplied repository guidance: project is the Sentry Publish Repository, a GitHub Actions approval system for publishing releases across Sentry projects using Craft; pure CommonJS JavaScript targeting Node.js 24.0.0; Yarn classic 1.22.22 is required and npm must not be used; code owned by @getsentry/releng.
• 🔴 (02:11) User stated coding convention: always throw for unexpected values, illustrated by a switch (status) default case throwing new Error(\Unknown status: '${status}'`)`.
• 🔴 (02:12) User stated that new Craft requests always include the checkout repository identity.
• 🔴 (02:12) User stated that a missing root .craft.yml always means checkout-path behavior.
• 🔴 (02:12) User stated that the controller never normalizes names.
• 🔴 (02:12) User stated title/workspace safety rules: title workspace path segments use [A-Za-z0-9_.-]+; repository identities use the same safe-token rule; neither may be ., .., __proto__, or start with -; Craft preserves exact spelling; versions must be valid Craft semantic versions, with build metadata such as 4.2.6+sentry1 valid.
• 🔴 (02:12) User stated getsentry/ remains optional when parsing existing publish-issue titles.
• 🔴 (02:12) User stated workflow behavior: after checkout of the exact CI-approved View check runs revision, a root .craft.yml causes craft workspace list to supply exact concrete workspace paths; an exact suffix match is a workspace and any other suffix remains a checkout path; discovery errors with root configuration fail the release.
• 🔴 (02:12) User stated publish issue body contract: required body-start fields are Requested by: @<actor>, Merge target: <branch-or-(default)>, Quick links:, - [View changes](compare-url), and - [View check runs](checks-url); Merge target is required; (default) means the target repository default branch; permitted branch characters are letters, digits, _, ., /, and -.
• 🔴 (02:12) User stated Quick links ordering/cardinality contract: Quick links follows Requested by and Merge target and contains exactly one View changes line followed by exactly one View check runs line for the checkout repository; controller and CI poller use the check-runs revision as release authority.
• 🔴 (02:12) User stated CI lifecycle: accepted starts CI waiting; publishing starts only when the CI poller adds a fresh ci-ready label to an open accepted issue with neither ci-pending nor ci-failed; dry-run enables dry-run mode.
• 🔴 (02:13) User stated the CI poller always adds ci-ready.
• 🟡 (02:11) Current working tree contains modified .github/workflows/ci-poller.yml, .github/workflows/publish.yml, docs/publish-issue-format.md, scripts/generate-publish-issue-title-parser.js, src/modules/__tests__/publish-workflow.js, src/modules/__tests__/release-revision.js, src/modules/publish-issue-title.js, src/modules/publish-issue-title.peggy, src/modules/release-revision.js, src/publish/inputs.js, src/publish/resolve-location.js, and src/publish/resolve-release-revision.js; untracked src/modules/__tests__/generate-publish-issue-title-parser.js, src/publish/__tests__/, and src/publish/discover-location.js.
• 🟡 (02:11) Repository branch state: HEAD/origin/feat/workspace-acceptance at a81ab033098f151fbc291b7b0c934901405bb162 (feat: resolve workspace publish paths); origin/main at 83d210b29553ea6f4d97508821724a834c43856e (build(deps): bump js-yaml from 4.3.0 to 4.3.1 (#9174)); preceding branch commits are 52ef600 feat: resolve compact workspace publish requests, b658ffa fix: validate publish workspace JSON, and 33de3f1 feat: accept workspace publish requests.
• 🟡 (02:12) Full branch diff against origin/main reports 26 files changed, 2,673 insertions, and 93 deletions; current uncommitted diff reports 12 files changed, 918 insertions, and 67 deletions.
• 🟡 (02:12) src/modules/release-revision.js: getReleaseRevisionDetails({ issueBody, repo }) requires parse(issueBody, { startRule: "CheckRunsLinkCount" }) === 1, otherwise throws Expected exactly one View check runs link in Quick links for getsentry/${repo}.; parses ReleaseRevision, throws contextual expected-link error on parse failure or repository mismatch; getReleaseRevision() returns revision.value; updateReleaseRevision() replaces only the parsed revision range.
• 🟡 (02:12) src/modules/publish-issue-title.peggy: PublishIssueTitle parses publish: , optional getsentry/, safe-token repository, optional slash-separated safe-token path, @, and version token. RequestHeader requires Requested by, blank lines, indented Merge target, blank lines, indented Quick links, blank lines, View changes, then a View check runs URL matching https://github.com/getsentry/<repo>/commit/<40 lowercase hex revision>/checks with optional /; ReleaseRevision starts from RequestHeader; CheckRunsLinkCount globally counts literal - [View check runs]( occurrences.
• 🟡 (02:12) scripts/generate-publish-issue-title-parser.js: grammar source is src/modules/publish-issue-title.peggy; generated parser output is src/modules/publish-issue-title.js; documentation output is docs/publish-issue-format.md; generateDocumentation() requires <!-- BEGIN GENERATED TITLE GRAMMAR --> through <!-- END GENERATED TITLE GRAMMAR --> and throws Could not find the generated title grammar in the documentation. if absent; extracts grammar between // BEGIN TITLE GRAMMAR and // END TITLE GRAMMAR, throwing Could not find the publish issue title grammar. if absent; generates CommonJS Peggy parser with allowed start rules PublishIssueTitle, ReleaseRevision, and CheckRunsLinkCount; --check throws stale-parser or stale-documentation errors, otherwise writes parser and documentation.
• 🟡 (02:12) docs/publish-issue-format.md presents generated title grammar from src/modules/publish-issue-title.peggy, documents canonical examples publish: getsentry/sentry@21.3.1 and publish: getsentry/toolkit/packages/cli@1.2.3, and documents selected target handling: checked - [x] <target-id> entries in ### Targets are read; Craft refresh preserves checked entries; failed-release checkboxes are updated from secure Craft publish-state and checked targets are skipped on retry unless manually unchecked.
• 🟡 (02:12) src/modules/publish-issue-validation.js: isPublishRepository(name) accepts /^[A-Za-z0-9_.-]+$/ excluding ., .., __proto__, and leading -; isReleaseVersion(version) validates semantic-version-like strings with numeric major/minor/patch, optional prerelease, and optional build metadata.
• 🟡 (02:12) src/modules/details-from-context.js: parses issue title with parsePublishIssueTitle; throws contextual invalid-title, invalid-repository, invalid-version, and invalid-path errors; detects dry-run label as "1" else ""; turns parser suffix into path = "." + titleDetails.path; extracts Merge target via /^Merge target: (?<merge_target>[\w.\-/]+)$/m, defaulting merge_target to ""; extracts checked targets from the matched Targets section.
• 🟡 (02:12) src/publish/inputs.js: invokes detailsFromContext({ context: github.context }) and serializes its result with core.setOutput('result', JSON.stringify(result)).
• 🟡 (02:12) src/publish/resolve-release-revision.js: parses process.env.PUBLISH_ARGS || "{}", requires repo or throws Publish input must define a repository., then writes getReleaseRevision({ issueBody: process.env.PUBLISH_ISSUE_BODY || "", repo }) to output revision.
• 🟡 (02:13) src/publish/discover-location.js: getWorkspaceNames() returns [] if <repositoryDirectory>/.craft.yml does not exist; otherwise executes docker run --rm --volume ${path.resolve(repositoryDirectory)}:/github/workspace/__repo__ --workdir /github/workspace/__repo__ getsentry/craft:latest workspace list; invalid JSON or a non-array result throws Craft workspace discovery returned an invalid workspace list.; discoverLocation() resolves input path using discovered names; main() parses PUBLISH_ARGS || "{}", requires input.path, defaults PUBLISH_REPOSITORY_DIRECTORY to __repo__, and JSON-serializes output result.
• 🟡 (02:13) src/modules/publish-location.js: resolvePublishLocation({ path, workspaceNames }) rejects invalid paths and any workspace list whose members fail isWorkspaceName, with Craft workspace discovery returned an invalid workspace list.; returns { path } for root path "."; for non-root paths, returns { path: ".", workspace } only if path.slice(2) exactly appears in workspaceNames; otherwise returns { path }. Safe segments match /^[A-Za-z0-9_.-]+$/ and exclude ., .., __proto__, and leading -.
• 🟡 (02:13) src/publish/resolve-location.js: parses PUBLISH_ARGS || "{}" and CRAFT_WORKSPACE_NAMES || "[]"; rejects a non-array workspace list with Craft workspace discovery returned an invalid workspace list.; JSON-serializes resolvePublishLocation({ path: input.path, workspaceNames }) to output result.
• 🟡 (02:13) src/publish/resolve-ci-poller-input.js writes JSON serialization of getCiPollerInput({ issueBody: process.env.PUBLISH_ISSUE_BODY || "", title: process.env.PUBLISH_TITLE || "", revision: process.env.PUBLISH_REVISION || "" }) directly to stdout.
• 🟡 (02:13) src/modules/ci-poller-input.js: parses/validates title repository, version, and path; obtains current revision via getReleaseRevision({ issueBody, repo }); if a revision argument is supplied, includes issueBody: updateReleaseRevision({ issueBody, repo, revision }); returns repo: getsentry/${repo}, current revision, and version.