Distillation

🔴 (11:49) Repository was on branch main, tracking origin/main; HEAD, ORIGIN_MAIN, and MERGE_BASE_HEAD_ORIGIN_MAIN were all 7c60ddb7f43040fe8fbfea70efc833f689c04e75, with HEAD_TO_ORIGIN_MAIN_COUNTS 0 0. 🔴 (11:49) Recent commit history included, in order: 7c60ddb feat: accept workspace publish requests; 83d210b build(deps): bump js-yaml from 4.3.0 to 4.3.1 (#9174) on opencode/tidy-orchid; 5268a23 feat: Add Vercel creds; 92eba3f feat: Add CLOUDFLARE_API_TOKEN (#9122); ada6147 build(deps): bump js-yaml from 4.1.1 to 4.3.0 (#8731); a4f961a fix: Add GITHUB_API_TOKEN for commit-on-git target (#9069); bf10f82 build(deps): bump postcss from 8.5.15 to 8.5.23 (#9017); 837edc0 docs: fix possessive apostrophe placement (#9015); 4da4a25 chore: replace deprecated trimRight() with trimEnd() (#9012); 22fd64d docs: fix typo 'acces' -> 'access' (#9011); 24b9ce3 docs: fix missing article in rfc.md (#9014); c1bded6 docs: fix run-on sentence in README (#9010). 🔴 (11:49) User stated the deprecated trimRight() should be replaced with trimEnd() under change #9012. 🔴 (11:49) Combined tracked changes covered 33 files with exactly 959 insertions and 228 deletions; staged changes covered 20 files with exactly 481 insertions and 95 deletions; unstaged changes covered 19 files with exactly 499 insertions and 154 deletions. 🔴 (11:49) .github/workflows/auto-approve.yml defines workflow auto-approve non-sdks, triggered for newly opened issues, with contents: read and issues: write; job auto-approve runs on ubuntu-latest in the production environment only when the actor is sentry-release-bot[bot] or getsantry[bot] and the issue title starts with publish: . 🔴 (11:49) .github/workflows/auto-approve.yml pins actions/checkout to 11d5960a326750d5838078e36cf38b85af677262 with persist-credentials: false, and pins actions/create-github-app-token to bcd2ba49218906704ab6c1aa796996da409d3eb1, using vars.SENTRY_INTERNAL_APP_ID and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY. 🔴 (11:49) .github/workflows/auto-approve.yml binds the request snapshot by running node src/publish/request-digest-from-event.js, then runs node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, AUTO_APPROVER, and EXPECTED_REQUEST_DIGEST. 🔴 (11:49) On successful attestation, .github/workflows/auto-approve.yml posts steps.attestation.outputs.auto_approval_attestation to the issue via gh issue comment; it then extracts the repository from the publish: ...@... issue title and adds label accepted only when the exact repository appears in auto-approve-repos.txt. 🔴 (11:50) User directed that workflow_dispatch, which can target any ref, must “Always run trusted code.” 🔴 (11:50) User established the invariant: “Never move a release to ci-ready after it changes.” 🔴 (11:50) The CI poller binds each poll cycle to the current accepted-label event before inspecting CI so a changed release cannot be moved to ci-ready. 🔴 (11:50) User stated that a renamed or re-approved issue “never reaches ci-ready.” 🔴 (11:50) The CI poller validates approval immediately before applying ci-ready; invalid or unverifiable approval results in the message Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue. 🔴 (11:50) If approval changes before ci-ready, the CI poller emits warning Approval for issue #${number} changed before ci-ready. Removing accepted. and removes the stale approval state rather than advancing the release. 🔴 (11:50) The CI poller resolves branch HEAD, which may differ from issue_sha; if resolution fails, it reports Could not resolve HEAD of ${branch}, using issue SHA. It paginates check runs to support repositories with more than 30 checks and separately handles combined commit statuses and check runs.