Distillation

Date: Sep 8, 2026

• 🟡 (20:11) .github/workflows/cocoapods-keepalive.yml defines "CocoaPods Token Keep-Alive" scheduled daily at midnight UTC (cron: "0 0 * * *") because CocoaPods sessions expire after 3 days of inactivity (VALIDITY_LENGTH), plus workflow_dispatch; permissions are contents: read. Its keepalive job runs on macos-15 in production, exposes COCOAPODS_TRUNK_TOKEN: ${{ secrets.COCOAPODS_TRUNK_TOKEN }}, runs gem install cocoapods, pod --version, then pod trunk me > /dev/null 2>&1.
• 🟡 (20:11) package.json defines private package publish version 0.0.1, described as "Approval-based publishing system for Sentry", with repository git@github.com:getsentry/publish.git, Apache-2.0 license, Volta Node 24.0.0 and Yarn 1.22.22, resolution undici: "^6.23.0", scripts test: "vitest run", test:watch: "vitest", lint: "eslint src .github --ignore-pattern '!.github'", and prettier: "prettier --write src". Dependencies are @actions/core: "^2.0.0", @actions/github: "^7.0.0", and @sentry/node: "^10.0.0"; dev dependencies include ESLint ^8.9.0, Prettier ^2.2.1, and Vitest ^4.1.0.
• 🟡 (20:11) src/publish/inputs.js imports @actions/github, @actions/core, and detailsFromContext from ../modules/details-from-context; its inputs() function passes github.context to detailsFromContext() and sets GitHub Action output "result" via core.setOutput("result", result), then executes inputs().
• 🟡 (20:11) src/modules/details-from-context.js extracts publish issue details using exported PUBLISH_TITLE_REGEX /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/ and exported parsePublishTitle(title), returning named groups or null. detailsFromContext({ context }) now throws exact errors "Issue context is not defined" for absent issue context and Invalid publish issue title: ${context.payload.issue.title} for malformed titles, rather than dereferencing .groups; it returns repo, optional path prefixed with ".", version, dry_run as "1" or "", merge_target parsed from Merge target: ..., and checked targets. It also exports TARGETS_SECTION_PARSER_REGEX, TARGETS_PARSER_REGEX, and CHECKED_TARGETS_PARSER_REGEX.
• 🟡 (20:11) .github/workflows/publish.yml approval job now checks out publish code with actions/checkout@v6 and persist-credentials: false, mints a getsentry release-bot token using actions/create-github-app-token@v3 with SENTRY_RELEASE_BOT_CLIENT_ID and SENTRY_RELEASE_BOT_PRIVATE_KEY, then runs node src/publish/authorize-approval.js with APPROVAL_TOKEN, actor, issue number/repository/title. It posts approval_attestation as a github-actions[bot] issue comment only after authorization succeeds and outputs authorized == 'true', validates it with node src/publish/validate-approval-attestation.js, and on any authorization/attestation/validation failure removes "accepted", posts "Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue.", and exits 1.
• 🟡 (20:11) .github/workflows/publish.yml publish execution job checks out trusted publish code into .__publish__ with persist-credentials: false, validates approval with REQUIRE_CI_READY_ATTESTATION: "true" before setup, and rejects invalid approval by removing "accepted", commenting the standard invalid-approval message, and exiting 1. Immediately after writing its Craft state file, it runs "Revalidate approval attestation" with the same CI-ready requirement; failed final validation triggers "Reject revoked approval" with the same label removal/comment/exit. Craft changed from unpinned docker://getsentry/craft:latest to pinned docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b.
• 🟡 (20:12) .github/workflows/auto-approve.yml adds issues: write; before adding "accepted", it runs node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN: ${{ github.token }}, issue number/repository/title, and AUTO_APPROVER: ${{ github.actor }}, then posts auto_approval_attestation using gh issue comment "$ISSUE_URL" --body "$AUTO_APPROVAL_ATTESTATION". The "Auto-approve if repo is in the list" step now runs only when steps.attestation.outcome == 'success'; attestation comment posting also has this condition.
• 🔴 (20:12) User directive: Always run trusted code.
• 🔴 (20:12) User directive: Never move a release to ci-ready after it changes.
• 🔴 (20:12) User directive: A renamed or re-approved issue never reaches ci-ready.
• 🟡 (20:12) .github/workflows/ci-poller.yml changes permission from issues: read to issues: write and first checks out trusted publish code using actions/checkout@v6 at ${{ github.event.repository.default_branch }} with persist-credentials: false, specifically because workflow_dispatch can target any ref.
• 🟡 (20:12) ci-poller.yml binds each poll cycle to current-accepted-event.js output (accepted_actor, accepted_event_id) before CI inspection; failure removes "ci-pending" and "accepted", posts the standard invalid-approval comment, and continues. It validates with validate-approval-attestation.js, passing EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID; invalid approval follows the same cleanup. Repository/version parsing changed from sed to parsePublishTitle imported from ./src/modules/details-from-context.js, yielding getsentry/${parsed.repo} and ${parsed.version}, to ensure CI and publishing target the same repository/version.
• 🟡 (20:12) When CI succeeds in ci-poller.yml, approval is revalidated before advancing, then record-ci-ready-attestation.js is run with the bound expected accepted actor/event and its ci_ready_attestation output is captured through GITHUB_OUTPUT="$(mktemp)". The workflow requires output prefix ci_ready_attestation=, posts the proof with GH_TOKEN="${{ github.token }}", and validates approval once more immediately before adding "ci-ready". Any failed validation, proof creation, malformed output, or comment-post failure removes "ci-pending" and "accepted", posts the standard invalid-approval comment, and continues.
• 🟡 (20:12) Test run yarn run v1.22.22 / vitest run --printConsoleTrace completed successfully: 15 test files passed and 65 tests passed. Duration was 1.99s (transform 278ms, import 1.15s, tests 306ms); Yarn completed in 2.50s.