Dashboard › publish › Distillation
09d571fb-16e5-438f-9bda-138c5a9c2ce7["lore_tm_v1_Bhfr5d1MQ-cQXs-WWBx3Fw5-cJX1QWe9WQZ0EWL20O4","lore_tm_v1_Cj684HQ_JzY8ks305qBYYB5pH-CYNsuHzsxB0yZb6j4","lore_tm_v1_7qbgwnglPFqShOs3E_r9SLBqdCSrO2fsxotdLbz5w2E","lore_tm_v1_RRsgVioXxim2GSC09Foa7GeXMpheeel4wPUs-bQCI8U"]
.github/workflows/auto-approve.yml defines auto-approve non-sdks, triggered when issues are opened; job auto-approve runs only when github.actor is sentry-release-bot[bot] or getsantry[bot] and the issue title starts with publish: ..github/workflows/auto-approve.yml uses the production environment, contents: read and issues: write permissions, actions/checkout@11d5960a326750d5838078e36cf38b85af677262, sparse-checkout of auto-approve-repos.txt, and actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 with SENTRY_INTERNAL_APP_ID and protected secret SENTRY_INTERNAL_APP_PRIVATE_KEY.node src/publish/record-auto-approval-attestation.js, posts ${{ steps.attestation.outputs.auto_approval_attestation }} as an issue comment using github.token, then uses the generated app token to add the accepted label only when the repository parsed from publish: <repo>@... exactly matches an entry in auto-approve-repos.txt.src/publish/authorize-approval.js reads auto-approve-repos.txt into a Set; queries GitHub through getGitHubResponse() with APPROVAL_TOKEN, API version 2026-03-10; and paginates issue events and comments at per_page=100.src/publish/authorize-approval.js requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY; missing values throw explicit errors.AUTO_APPROVAL_LABELER, src/publish/authorize-approval.js authorizes only when the live issue remains open with the expected title, the requester belongs to AUTO_APPROVERS, the repository is auto-approved, the current accepted event was produced by that actor, and hasAutoApprovalAttestation() finds a matching attestation authored by github-actions[bot].src/publish/authorize-approval.js calls authorizeApproval() using the actor, issue title, target-repository permission lookup, and auto-approved repository set; final validation rejects closed or renamed issues, missing/currently mismatched accepted events, and self-approval where requester and actor match case-insensitively.createApprovalAttestation({ actor: event.actor, eventId: event.eventId, issue }) and writes authorized=true plus approval_attestation to GITHUB_OUTPUT; failed authorization writes authorized=false..github/workflows/ci-poller-dispatch.yml is a manually dispatched Run CI Status Poller workflow with permissions: {}, a dispatch job in the protected production environment, and a no-op run: ":" step..github/workflows/ci-poller-dispatch.yml; protected environment secrets enforce that an arbitrarily dispatched ref cannot add them.workflow_dispatch must always be allowed for manual recovery.actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803.ci-ready after it changes while CI is being inspected.ci-ready.src/publish/validate-approval-attestation.js; invalid or unverifiable approval causes an issue comment: Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue.gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input - and uses current effective target-repository role checks without exposing RBAC data.