Distillation

Date: Aug 29, 2026

• 🟡 (13:20) publish-workspace-acceptance/package.json specifies package publish version 0.0.1, private, Apache-2.0, repository git@github.com:getsentry/publish.git; Volta pins Node 24.0.0 and Yarn 1.22.22; undici resolution is ^6.23.0. Scripts: generate runs node scripts/generate-publish-issue-title-parser.js; check:generated adds --check; test runs yarn check:generated && vitest run; test:watch runs vitest; lint runs eslint src .github --ignore-pattern '!.github'; prettier runs prettier --write src. Dev dependencies include peggy 5.1.0 and vitest ^4.1.0; dependencies include @actions/core ^2.0.0, @actions/github ^7.0.0, and @sentry/node ^10.0.0.
• 🟡 (13:20) Craft configuration tests in craft-workspace-action-propagation/src/__tests__/config.test.ts verify workspace configuration with minVersion: '2.27.0', base GitHub getsentry/toolkit, workspace cli with releaseBranchPrefix: 'release/cli' and GitHub target tag prefix cli@, and workspace mcp with GitHub target tag prefix mcp@. They allow partial per-workspace GitHub owner/repo overrides, reject workspace name cli/v2, reject YAML workspace key __proto__ with Workspace name "__proto__" is not supported., reject workspace github.projectPath, reject base github.projectPath: 'packages/cli' when nonempty workspaces are configured, and allow that base projectPath with workspaces: {}.
• 🟡 (13:20) Craft action tests in craft-workspace-action-propagation/src/__tests__/action.test.ts verify option-looking workspace --config-from=untrusted is passed inline as prepare --workspace=--config-from=untrusted and targets --workspace=--config-from=untrusted; Validate workspace receives PATH_INPUT: '${{ inputs.path }}', while Craft Prepare and Read Craft Targets receive WORKSPACE: '${{ inputs.workspace }}'.
• 🟡 (13:20) Craft action validation tests reject workspace inputs containing tab control characters (cli\tnext), U+202E format character (cli\u202enext), U+2028 line separator, U+2029 paragraph separator, and non-ASCII cli-é, before Git or Craft side effects; this also holds under en_US.utf8. Safe inputs '' and cli-v2 are accepted. A path packages/cli together with workspace cli is rejected before side effects; compact-title-invalid workspace cli/v2 is rejected.
• 🟡 (13:20) Craft action tests verify publish-request titles are publish: getsentry/toolkit@1.2.3 for root workspace and publish: getsentry/toolkit/cli@1.2.3 for workspace cli.
• 🟡 (13:21) publish-workspace-acceptance/.github/workflows/cocoapods-keepalive.yml defines workflow CocoaPods Token Keep-Alive, scheduled daily at midnight UTC (cron: "0 0 * * *") because CocoaPods sessions currently expire after 3 days of inactivity; it also supports workflow_dispatch. Job keepalive runs on macos-15 in production, with contents: read permission and COCOAPODS_TRUNK_TOKEN secret; it installs CocoaPods (gem install cocoapods), prints pod --version, then refreshes via pod trunk me > /dev/null 2>&1.
• 🟡 (13:21) Review found a critical release-revision vulnerability: getReleaseRevision() in publish/src/modules/release-revision.js:1-12 accepts the first same-repository check-runs link anywhere in an issue body rather than only the canonical Quick links entry. Its result controls checkout and craft publish --rev in publish/.github/workflows/publish.yml:164-167,247-249.
• 🟡 (13:21) Read-only reproduction of the release-revision vulnerability showed that an earlier decoy getsentry/toolkit check-runs link selected SHA aaaaaaaa… rather than the later intended Quick-links SHA. Repository identity validation prevents cross-repository links but does not prevent publishing a different CI-green revision in the same repository.
• 🟡 (13:21) The CI poller has the same broad check-runs-link extraction flaw in publish/.github/workflows/ci-poller.yml:107-110. Existing tests in publish/src/modules/__tests__/release-revision.js:26-49 cover missing links, wrong-repository links, and uppercase links, but do not cover decoy or duplicate links.
• 🟡 (13:21) Recommended critical fix: parse exactly one check-runs link from the canonical Quick links block; reject missing, duplicate, and out-of-block links; apply the same rule in ci-poller.yml; revise docs/publish-issue-format.md:91-92, which incorrectly calls the now-security-critical link “informational.”
• 🟡 (13:21) Review found a major workspace-name mismatch: Craft’s WorkspaceNameSchema in craft/src/schemas/project_config.ts:218-225 and action validation in craft/action.yml:84 permit workspace name ..; Craft then creates title …/..@version in craft/action.yml:268, whereas Publish converts it to ./.. and rejects it as traversal in publish/src/modules/details-from-context.js:53-55.
• 🟡 (13:21) The .. workspace mismatch makes a configured workspace unreleasable after craft prepare already ran. Neither craft/src/__tests__/config.test.ts:163-178 nor craft/src/__tests__/action.test.ts:207-234 covers . or .. workspace names.
• 🟡 (13:21) Recommended major fix for workspace-name mismatch: reject . and .. consistently in Craft’s schema, Craft action validation, and Publish discovery validation; add end-to-end regression tests.
• 🟡 (13:21) Review found a major test-validity issue: publish/src/modules/__tests__/publish-workflow.js:104-112 passes impossible location pair {path: './cli', workspace: 'cli'}, while publish/src/modules/publish-location.js:5-10 rejects simultaneous path and workspace. Compact-title classification actually returns {path: '.', workspace: 'cli'} in publish/src/modules/publish-location.js:24-30.
• 🟡 (13:21) The invalid state-path test does not establish state-file parity for the compact workflow’s actual root-CWD behavior. Recommended fix: first resolve a compact title, then assert the state filename using its returned {path: '.', workspace: …} pair.
• 🟡 (13:21) Review identified out-of-scope Publish hygiene issues: untracked publish/pnpm-lock.yaml must not be committed; branch-base diff includes unrelated quote-only change in publish/.github/workflows/cocoapods-keepalive.yml:1; src/modules/post-workflow-details.js and src/publish/inputs.js have newline-only changes. Recommended remediation: remove/revert these before staging and use an explicit allowlist.
• 🟡 (13:21) Review verified that new Craft titles include checkout repository identity and preserve workspace spelling (craft/action.yml:268; craft/src/__tests__/action.test.ts:236-248).
• 🟡 (13:21) Review verified checkout, workspace discovery, resolved location, workspace environment, state setup, and --rev are correctly ordered and wired in publish/.github/workflows/publish.yml:159-187,194-198,217-233,247-261.
• 🟡 (13:21) Review verified detached-SHA checkout safely falls back to the SHA while named refs retain current behavior in craft/src/commands/publish.ts:632-637,933-945.
• 🟡 (13:21) Review verified legacy workspace/path rejection, exact compact matching, root-config-absence behavior, and fail-closed workspace discovery are structurally correct in publish/src/modules/details-from-context.js:34-59, publish/src/modules/publish-location.js:1-40, and publish/.github/workflows/publish.yml:174-187.
• 🟡 (13:21) Review verified state filename logic matches Craft’s encoding/hash contract in craft/src/utils/publishState.ts:82-99.
• 🟡 (13:21) Review verified Peggy parser generation is pinned and checked by yarn test through publish/package.json:18-20; yarn test passed with 45 tests, including generated-parser drift detection.
• 🟡 (13:21) Review verified pnpm test passed in Craft with 1,152 passed and 1 skipped; both worktrees remained unchanged after testing, and git diff --check passed.
• 🟡 (13:21) Review determined getsentry/craft:latest in publish/.github/workflows/publish.yml:181-184,239 is intentional and correct for the release ordering, not a mutable-image finding.
• 🟡 (13:21) Assistant concluded the branch is DO-NOT-MERGE until the critical same-repository decoy check-runs-link vulnerability and the identified major issues are addressed.