Distillation

🔴 (12:01) /home/byk/Code/getsentry/publish/src/publish/__tests__/ci-poller-workflow.js reads .github/workflows/ci-poller.yml and .github/workflows/ci-poller-dispatch.yml and tests the CI poller workflow. 🔴 (12:01) The CI poller must check out trusted code at github.event.repository.default_branch in "Get publish code" before "Get auth token". 🔴 (12:01) The CI poller uses repository_dispatch: type [ci-poller] and workflow_run: for [Run CI Status Poller], gated on a successful conclusion and head_branch == github.event.repository.default_branch; the main poller workflow must not contain workflow_dispatch:. 🔴 (12:01) .github/workflows/ci-poller-dispatch.yml must use workflow_dispatch:, permissions: {}, and environment: production, and must contain neither secrets. nor repository_dispatch:. 🔴 (12:01) CI poller dispatch validation occurs before "Get auth token" and accepts decimal attempts 0 through 59 while rejecting "", "00", "01", "60", "-1", "1x", and "$(id)". 🔴 (12:01) The CI poller sets ATTEMPT: ${{ github.event_name == 'repository_dispatch' && steps.dispatch-attempt.outputs.value || '0' }}, increments with attempt=$((10#$ATTEMPT + 1)), and dispatches using gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input -. 🔴 (12:01) Every CI-poller approval fence is bound to the listed request snapshot: the workflow extracts request_digest=$(echo "$publish_input" | jq -r '.requestDigest') and contains exactly 4 EXPECTED_REQUEST_DIGEST="$request_digest" assignments. 🔴 (12:01) /home/byk/Code/getsentry/publish/src/modules/__tests__/publish-workflow.js loads .github/workflows/publish.yml, imports resolvePublishLocation() from ../publish-location.js, extracts the "Set targets" shell script, and executes it in temporary directories with CRAFT_PUBLISH_TARGETS_JSON='["github"]'. 🔴 (12:01) The module-level publish workflow test requires this order: "Resolve CI-approved release revision" → "Inform start" → "Check out target repo" → "Resolve publish location" → "Set targets" → "Publish using Craft". 🔴 (12:01) Publication uses ref: ${{ steps.release-revision.outputs.revision }}, exactly 2 references to actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1, node .__publish__/src/publish/discover-location.js, PUBLISH_REPOSITORY_DIRECTORY: __repo__, and docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b. 🔴 (12:01) The publish workflow passes CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.location.outputs.result).path }} and CRAFT_PUBLISH_WORKSPACE: ${{ fromJSON(steps.location.outputs.result).workspace || '' }}, then runs craft publish ${{ fromJSON(steps.inputs.outputs.result).version }} --rev ${{ steps.release-revision.outputs.revision }}. 🔴 (12:01) Publication triggers only on a fresh ci-ready label event and requires labels accepted and ci-ready while excluding ci-pending and ci-failed. 🔴 (12:01) The "Set targets" script preserves Craft’s legacy root state filename: repository sentry, version 21.3.1, and path "." produce a filename ending .craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json with state { published: { github: true } }. 🔴 (12:01) A monorepo release resolved from path "./packages/cli" and workspace "packages/cli" for repository toolkit version 1.2.3 produces a filename ending .craft-state/craft/publish-state-getsentry-toolkit-c232c383e26f-workspace-cGFja2FnZXMvY2xp-1.2.3.json with state { published: { github: true } }. 🔴 (12:01) Craft state files remain distinct for case-sensitive versions: 4.2.6+sentry1 ends in -version-NC4yLjYrc2VudHJ5MQ.json, while 4.2.6+Sentry1 ends in -version-NC4yLjYrU2VudHJ5MQ.json. 🔴 (12:02) /home/byk/Code/getsentry/publish/src/publish/__tests__/publish-workflow.js tests that .github/workflows/publish.yml invokes node src/publish/request-digest-from-event.js and contains exactly 4 EXPECTED_REQUEST_DIGEST: ${{ steps.request-digest.outputs.request_digest }} bindings. 🔴 (12:02) "Revalidate approval attestation" must occur after "Set targets" and before "Publish using Craft", with REQUIRE_CI_READY_ATTESTATION: "true". 🔴 (12:02) The publish workflow test requires Craft to be pinned using uses: docker://getsentry/craft@sha256: followed by exactly 64 lowercase hexadecimal characters. 🔴 (12:02) In the waiting-for-ci job, the required order is "Mark ci-pending" → "Trigger CI poller" → "Comment on issue" → "Enable cron poller" → "Revoke stranded approval"; trigger, comment, and enable steps each use continue-on-error: true. 🔴 (12:02) "Revoke stranded approval" runs when both steps.trigger-poller.outcome and steps.enable-poller.outcome are not "success", and removes both "ci-pending" and "accepted". 🔴 (12:02) In the publish job, "Publish using Craft" is followed by "Reconcile publish issue", "Report publish result", and "Verify publish issue reconciliation"; both reconciliation sections use if: always(), inspect steps.publish.outcome, remove "accepted", "ci-pending", and "ci-ready", close the issue with --state closed, and contain no node command. 🔴 (12:02) The publish workflow must report exactly 1 terminal status: "success" maps to status=success, "cancelled" maps to status=cancelled, all other outcomes map to status=failure, and reporting invokes node .__publish__/src/publish/post-result.js "$status" without using cancelled(). 🔴 (12:02) /home/byk/Code/getsentry/publish/src/publish/__tests__/post-result.js verifies main() still calls report() with { inputs: {}, status: "failure" } when PUBLISH_ARGS is either absent or "not-json". 🔴 (12:02) /home/byk/Code/getsentry/publish/src/publish/__tests__/auto-approval-workflow.js requires the checkout preceding "Record automated approval attestation" to omit sparse-checkout:. 🔴 (12:02) The auto-approval workflow computes the event request digest with node src/publish/request-digest-from-event.js, passes EXPECTED_REQUEST_DIGEST: ${{ steps.request-digest.outputs.request_digest }}, and runs node src/publish/record-auto-approval-attestation.js before --add-label accepted. 🔴 (12:02) The auto-approval proof is posted using GH_TOKEN: ${{ github.token }} before the internal app adds accepted; the later label operation uses GH_TOKEN: ${{ steps.token.outputs.token }}. 🔴 (12:02) /home/byk/Code/getsentry/publish/src/modules/__tests__/ci-poller-input.js tests getCiPollerInput() with revision 7e5ca7ed5581552de066e2a8bc295b8306be38ac, labels accepted and dry-run, and a request body authored by @byk. 🔴 (12:02) getCiPollerInput() parses both root title publish: getsentry/toolkit/cli@1.2.3 and full-path title publish: toolkit/packages/cli/v2@1.2.3 as { repo: "getsentry/toolkit", revision: "7e5ca7ed5581552de066e2a8bc295b8306be38ac", version: "1.2.3", requestDigest: requestDigest(...) }. 🔴 (12:02) The CI poller checks out shared publish code at .__publish__ and invokes node .__publish__/src/publish/resolve-ci-poller-input.js; it must not parse the revision with grep -oP '(?<=commit/. 🔴 (12:02) getCiPollerInput() rejects repository identities "-toolkit", ".", "..", and "__proto__" with "Invalid publish issue repository" before CI API calls. 🔴 (12:02) getCiPollerInput() rejects release versions "--config" and "1.2" with "Invalid publish issue version" before CI API calls. 🔴 (12:02) getCiPollerInput() rejects malformed titles publish: getsentry/@1.2.3 and publish: getsentry/toolkit$@1.2.3 with "Invalid publish issue title". 🔴 (12:02) getCiPollerInput() rejects unsafe paths in publish: getsentry/toolkit/../other@1.2.3, publish: getsentry/toolkit/./other@1.2.3, publish: getsentry/toolkit/__proto__/other@1.2.3, and publish: getsentry/toolkit/--config@1.2.3 with "Invalid publish issue path". 🔴 (12:03) /home/byk/Code/getsentry/publish/src/modules/__tests__/release-revision.js tests getReleaseRevision() and updateReleaseRevision() using revision 7e5ca7ed5581552de066e2a8bc295b8306be38ac. 🔴 (12:03) getReleaseRevision() extracts the CI-approved revision only from the canonical request-header View check runs URL for getsentry/toolkit; it accepts CRLF bodies and URLs both with and without a trailing slash after /checks. 🔴 (12:03) getReleaseRevision() rejects a URL lacking /checks or targeting getsentry/other with "Expected a View check runs link for getsentry/toolkit". 🔴 (12:03) getReleaseRevision() rejects decoy or embedded View check runs links outside the canonical request header with "Expected exactly one View check runs link in Quick links". 🔴 (12:03) getReleaseRevision() rejects a complete Quick links block or complete request header placed after ### Changelog rather than at the beginning of the issue, with "Expected a View check runs link for getsentry/toolkit". 🔴 (12:03) updateReleaseRevision() replaces only the canonical request-header revision, preserving CRLF and trailing content; the tested replacement is bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb. 🔴 (12:03) updateReleaseRevision() rejects "A".repeat(40), "a".repeat(39), and "a".repeat(41) with "Release revision must be a lowercase 40-character SHA.". 🔴 (12:03) /home/byk/Code/getsentry/publish/src/modules/__tests__/publish-location.js contains tests for resolvePublishLocation(). 🔴 (12:03) resolvePublishLocation() classifies exact workspace path "./packages/CLI" against workspace names ["packages/cli", "packages/CLI"] without case normalization, returning { path: ".", workspace: "packages/CLI" }. 🔴 (12:03) resolvePublishLocation() keeps "./packages" as a checkout path when only workspace "cli" exists, and keeps "./packages/cli" as a checkout path when "cli" is not an exact full workspace path. 🔴 (12:03) resolvePublishLocation() keeps root path "." at the checkout root. 🔴 (12:03) resolvePublishLocation() rejects discovery output ["packages/../cli"] for a root release and ["cli-日本語"] for a nested release with "Craft workspace discovery returned an invalid workspace list.". 🔴 (12:03) resolvePublishLocation() rejects unsafe publish paths "./.", "./..", and "./packages/../other" with "Invalid publish path.". 🔴 (12:03) resolvePublishLocation() rejects unsafe workspace names ".", "..", "packages/./cli", "packages/../cli", "packages/__proto__/cli", "packages/-cli", "packages/foo]", "packages/foo!", and "packages/foo^" with "Craft workspace discovery returned an invalid workspace list.". 🔴 (12:04) /home/byk/Code/getsentry/publish/src/publish/__tests__/discover-location.js tests discoverLocation() and getWorkspaceNames(). 🔴 (12:04) discoverLocation() retains checkout-path behavior when the root config is absent: input path "./packages/cli" and repository directory "__repo__" return { path: "./packages/cli" }. 🔴 (12:04) Workspace discovery uses the released Craft image getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b with Docker arguments containing "workspace" and "list"; output ["packages/CLI"] resolves "./packages/CLI" to { path: ".", workspace: "packages/CLI" }. 🔴 (12:04) getWorkspaceNames() fails closed with "Craft workspace discovery returned an invalid workspace list." when Craft returns either "{}" or only a newline. 🔴 (12:04) /home/byk/Code/getsentry/publish/src/modules/__tests__/details-from-context.js tests detailsFromContext() and parsePublishTitle(). 🔴 (12:04) detailsFromContext() parses issue 223, title publish: getsentry/sentry@21.3.1, requester @BYK, merge target "custom-branch", and selected targets into { dry_run: "", merge_target: "custom-branch", path: ".", repo: "sentry", targets: ["github", "npm[@sentry/node]", "docker[latest]"], version: "21.3.1" }. 🔴 (12:04) detailsFromContext() accepts version "4.2.6+sentry1" from title publish: getsentry/sentry-forked-django-stubs@4.2.6+sentry1. 🔴 (12:04) parsePublishTitle("publish: getsentry/sentry-javascript/packages/core@10.0.0") returns { path: "/packages/core", repo: "sentry-javascript", version: "10.0.0" }; legacy title publish: sentry-javascript@10.0.0 returns { path: "", repo: "sentry-javascript", version: "10.0.0" }. 🔴 (12:04) A canonical merge target of "(default)" maps to merge_target: ""; for the tested Sentry request, selected targets are ["github", "docker[latest]"]. 🔴 (12:04) detailsFromContext() uses the canonical request-header merge target "custom-branch" rather than a later decoy line Merge target: decoy. 🔴 (12:04) A concrete title suffix in publish: getsentry/toolkit/packages/cli@1.2.3 is preserved as path: "./packages/cli" with repository "toolkit" and version "1.2.3". 🔴 (12:04) detailsFromContext() rejects publish: getsentry/toolkit @1.2.3 with "Invalid publish issue title". 🔴 (12:04) detailsFromContext() rejects paths publish: getsentry/toolkit/../other@1.2.3 and publish: getsentry/toolkit/./other@1.2.3 with "Invalid publish issue path". 🔴 (12:04) detailsFromContext() rejects repository identities "-toolkit", ".", "..", and "__proto__" with "Invalid publish issue repository". 🔴 (12:04) detailsFromContext() rejects versions "--config" and "1.2" with "Invalid publish issue version", and rejects title publish: getsentry/toolkit@1.2.3/other with "Invalid publish issue title". 🔴 (12:04) detailsFromContext({ context: {} }) rejects with "Issue context is not defined".