Distillation

Date: Sep 8, 2026

• 🟡 (02:13) src/modules/__tests__/release-revision.js defines REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac" and tests getReleaseRevision/updateReleaseRevision from src/modules/release-revision.js. Canonical request bodies begin Requested by: @byk, contain Merge target: (default), and a Quick links: block with View changes and View check runs URLs for getsentry/toolkit.
• 🟡 (02:13) Release-revision tests require getReleaseRevision to accept canonical request-header check-runs links, CRLF line endings, and an optional missing trailing slash after /checks; it rejects links missing the /checks path or targeting another repository with Expected a View check runs link for getsentry/toolkit.
• 🟡 (02:13) Release-revision tests reject decoy or embedded View check runs links outside the canonical request-header Quick links block with Expected exactly one View check runs link in Quick links; they reject a complete Quick links block outside the request header or a complete request header not at the issue start with Expected a View check runs link for getsentry/toolkit.
• 🟡 (02:13) updateReleaseRevision({ issueBody, repo: "toolkit", revision: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" }) is tested to update only the canonical request-header revision, producing /commit/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/checks/.
• 🟡 (02:13) src/modules/update-issue.js implements updateTargets({ octokit, stateFilePath, publishRepo, issue_number }): returns when stateFilePath is absent or nonexistent; otherwise concurrently fetches the issue and parses the JSON Craft state file, transforms the body, then calls octokit.rest.issues.update with the new body.
• 🟡 (02:13) transformIssueBody(craftState, issueBody) in src/modules/update-issue.js uses TARGETS_SECTION_PARSER_REGEX and TARGETS_PARSER_REGEX from ./details-from-context; it checks/unchecks declared target lines as - [x] ${targetId} according to craftState.published[targetId], then appends previously unlisted craftState.published targets and their checked status to the targets section.
• 🟡 (02:13) updateIssue({ context, octokit }) gets context.repo and context.payload.issue.number, then concurrently calls updateTargets using process.env.CRAFT_STATE_FILE_PATH and removes the accepted label via octokit.rest.issues.removeLabel.
• 🟡 (02:13) src/publish/__tests__/discover-location.js tests discoverLocation/getWorkspaceNames from src/publish/discover-location.js: when root config is absent (exists: () => false), { path: "./packages/cli" } remains unchanged; when present, Craft discovery maps exact path ./packages/CLI to { path: ".", workspace: "packages/CLI" }.
• 🟡 (02:13) Workspace discovery executes docker with arguments including getsentry/craft:latest, workspace, and list, with { encoding: "utf8" }; invalid JSON-object output "{}" and blank output "\n" both fail closed with Craft workspace discovery returned an invalid workspace list..
• 🟡 (02:14) src/modules/__tests__/generate-publish-issue-title-parser.js verifies generateDocumentation from scripts/generate-publish-issue-title-parser.js throws Could not find the generated title grammar in the documentation. when documentation # Publish Issue Format\n lacks generated grammar markers, even with titleGrammar: 'PublishIssueTitle = "publish: "'.
• 🟡 (02:14) package.json identifies the private publish package, version 0.0.1, as an Apache-2.0 Approval-based publishing system for Sentry; repository is git@github.com:getsentry/publish.git, author is Sentry Open Source <oss@sentry.io>, and Volta pins Node 24.0.0 and Yarn 1.22.22.
• 🟡 (02:14) package.json pins resolution undici: "^6.23.0"; scripts are generate (node scripts/generate-publish-issue-title-parser.js), check:generated (same with --check), test (yarn check:generated && vitest run), test:watch (vitest), lint (eslint src .github --ignore-pattern '!.github'), and prettier (prettier --write src).
• 🟡 (02:14) package.json dev dependencies are eslint ^8.9.0, eslint-config-prettier ^8.3.0, eslint-plugin-yml ^0.13.0, peggy 5.1.0, prettier ^2.2.1, and vitest ^4.1.0; runtime dependencies are @actions/core ^2.0.0, @actions/github ^7.0.0, and @sentry/node ^10.0.0.
• 🟡 (02:14) src/publish/__tests__/resolve-release-revision.js runs src/publish/resolve-release-revision.js with PUBLISH_ARGS: "" and PUBLISH_ISSUE_BODY: ""; missing workflow input must exit nonzero, report Publish input must define a repository., and not report Unexpected end of JSON input.
• 🟡 (02:14) src/publish/__tests__/resolve-location.js runs src/publish/resolve-location.js with PUBLISH_ARGS: "" and CRAFT_WORKSPACE_NAMES: "[]"; missing workflow input must exit nonzero, report Invalid publish path., and not report Unexpected end of JSON input.
• 🟡 (02:14) src/modules/__tests__/publish-workflow.js extracts the Set targets shell script from .github/workflows/publish.yml, runs it under bash -e -c with CRAFT_PUBLISH_PATH, CRAFT_PUBLISH_REPO, CRAFT_PUBLISH_TARGETS_JSON: '["github"]', CRAFT_PUBLISH_VERSION, CRAFT_PUBLISH_WORKSPACE, GITHUB_OUTPUT, and GITHUB_WORKSPACE, and expects a state JSON of { published: { github: true } }.
• 🟡 (02:14) Publish-workflow tests require the sequence Resolve CI-approved release revision → Inform start → Check out target repo → Resolve publish location → Set targets → Publish using Craft; checkout must use ref: ${{ steps.release-revision.outputs.revision }}, discovery must run node .__publish__/src/publish/discover-location.js with PUBLISH_REPOSITORY_DIRECTORY: __repo__, and the workflow must use getsentry/craft:latest rather than getsentry/craft:2.31.0.
• 🟡 (02:14) Publish-workflow tests require Craft inputs CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.location.outputs.result).path }} and CRAFT_PUBLISH_WORKSPACE: ${{ fromJSON(steps.location.outputs.result).workspace || '' }}, and publish command craft publish ${{ fromJSON(steps.inputs.outputs.result).version }} --rev ${{ steps.release-revision.outputs.revision }}.
• 🟡 (02:14) .github/workflows/publish.yml is tested to publish only after a fresh ci-ready label event, requiring github.event.label.name == 'ci-ready', labels accepted and ci-ready, and absence of ci-pending and ci-failed.
• 🟡 (02:14) Craft root releases use legacy state-file names matching .craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json; monorepo toolkit release 1.2.3 for workspace packages/cli uses .craft-state/craft/publish-state-getsentry-toolkit-c232c383e26f-workspace-cGFja2FnZXMvY2xp-1.2.3.json.
• 🟡 (02:14) State-file naming encodes version case to avoid collisions: 4.2.6+sentry1 matches -version-NC4yLjYrc2VudHJ5MQ.json, while 4.2.6+Sentry1 matches -version-NC4yLjYrU2VudHJ5MQ.json; their paths must differ.
• 🟡 (02:14) src/modules/__tests__/ci-poller-input.js tests getCiPollerInput from src/modules/ci-poller-input.js: titles publish: getsentry/toolkit/cli@1.2.3 and publish: toolkit/packages/cli/v2@1.2.3 both resolve to { repo: "getsentry/toolkit", revision: "7e5ca7ed5581552de066e2a8bc295b8306be38ac", version: "1.2.3" }.
• 🟡 (02:14) CI-poller input tests require .github/workflows/ci-poller.yml to check out the publish controller as .__publish__ and invoke node .__publish__/src/publish/resolve-ci-poller-input.js; the workflow must not parse revisions with grep -oP '(?<=commit/.
• 🟡 (02:14) getCiPollerInput rejects unsafe repository identities -toolkit, ., .., and __proto__ with Invalid publish issue repository; invalid versions --config and 1.2 with Invalid publish issue version; malformed title repository identities publish: getsentry/@1.2.3 and publish: getsentry/toolkit$@1.2.3 with Invalid publish issue title; and unsafe paths containing .., ., __proto__, or --config with Invalid publish issue path, all before CI API calls.
• 🟡 (02:14) src/modules/__tests__/details-from-context.js verifies detailsFromContext parses issue title publish: getsentry/sentry@21.3.1, Requested by: @BYK, merge target custom-branch, and mixed CRLF target checkboxes into { dry_run: "", merge_target: "custom-branch", path: ".", repo: "sentry", targets: ["github", "npm[@sentry/node]", "docker[latest]"], version: "21.3.1" }.
• 🟡 (02:14) detailsFromContext accepts version 4.2.6+sentry1; treats Merge target: (default) as merge_target: ""; and retains title workspace suffix publish: getsentry/toolkit/packages/cli@1.2.3 as repo: "toolkit", version: "1.2.3", path: "./packages/cli".
• 🟡 (02:14) detailsFromContext rejects an unexpected space before version (publish: getsentry/toolkit @1.2.3) and a version containing path syntax (publish: getsentry/toolkit@1.2.3/other) as Invalid publish issue title; it rejects title paths ../other and ./other as Invalid publish issue path, repository identities -toolkit, ., .., and __proto__ as Invalid publish issue repository, versions --config and 1.2 as Invalid publish issue version, and absent issue payload as Issue context is not defined.
• 🟡 (02:14) .github/workflows/cocoapods-keepalive.yml defines CocoaPods Token Keep-Alive, scheduled daily at midnight UTC via cron "0 0 * * *" and manually dispatchable. Comments state CocoaPods sessions expire after 3 days of inactivity (VALIDITY_LENGTH) and reference CocoaPods session.rb#L9.
• 🟡 (02:14) CocoaPods keep-alive has contents: read permission and a production keepalive job named Refresh CocoaPods Session on macos-15; it reads COCOAPODS_TRUNK_TOKEN from secrets.COCOAPODS_TRUNK_TOKEN, runs gem install cocoapods, prints pod --version, then refreshes the session with pod trunk me > /dev/null 2>&1.