Distillation

Date: Aug 27, 2026

• 🟡 (15:24) Repository search found 16 matches relevant to approval/release-bot authentication. README.md:95 says publishing uses Craft and tokens from the Sentry Release Bot GitHub App, installed on all getsentry repositories with read/write access to code, PRs, and actions; short-lived tokens are generated per action run using actions/create-github-app-token with organization-level SENTRY_RELEASE_BOT_CLIENT_ID and SENTRY_RELEASE_BOT_PRIVATE_KEY.
• 🟡 (15:24) src/modules/approval-authorizer.js:2 defines AUTO_APPROVER = "getsantry[bot]"; src/modules/__tests__/approval-authorizer.js:13 uses actor "getsantry[bot]".
• 🟡 (15:24) .github/workflows/publish.yml:44-45 uses ${{ vars.SENTRY_INTERNAL_APP_ID }} and ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}; .github/workflows/publish.yml:54-55 and :212-213 use ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }} and ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}.
• 🟡 (15:24) .github/workflows/ci-poller.yml:36-37 uses ${{ vars.SENTRY_INTERNAL_APP_ID }} and ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}; :47-48 uses ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }} and ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}.
• 🟡 (15:24) .github/workflows/auto-approve.yml:13 permits github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]'; :24-25 uses ${{ vars.SENTRY_INTERNAL_APP_ID }} and ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}.