Dashboard › publish › Distillation
1017ced1-ff10-4102-861b-4c8df1c78c64["lore_tm_v1_nWk6DQqBuV9IuYBkQ56oTp0-PgFAUhnF4pZ6-DudMTQ","lore_tm_v1_hkoCQ46RaBhcT-CQxD_SkgB9nP4xQ6nOKS_wlzApuCk","lore_tm_v1_N_jdlwVf15R-drJzAwyClEaOpDWhirUhLUHh9HCRm1g","lore_tm_v1_xjG9TO9NY9d_cUzfZ9OEIUJu_GjGft-odY6-YhFCgVI"]
/home/byk/Code/getsentry/publish was on main...origin/main [behind 1], with 21 tracked files modified, 11 untracked paths, and a tracked diff totaling 499 insertions and 117 deletions..github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, docs/key_rotation_vault_changes.md, docs/rfc.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js..github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/publish/__tests__/, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js..github/workflows/ci-poller.yml replaced direct workflow_dispatch inputs with repository_dispatch type ci-poller and a workflow_run completion trigger for workflow Run CI Status Poller; trusted manual recovery is through repository_dispatch or a successful default-branch run of the protected workflow_dispatch relay..github/workflows/ci-poller.yml changed workflow permissions from issues: read to issues: write; contents: read remains.check-ci job now runs when vars.CI_POLLER_HAS_PENDING == 'true', for repository_dispatch, or for a successful workflow_run whose head_branch equals github.event.repository.default_branch.Validate dispatch attempt step accepts only repository_dispatch attempt values matching ^(0|[1-5][0-9])$, i.e. integers 0 through 59; invalid input emits repository_dispatch attempt must be an integer from 0 through 59 and exits 1.actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, explicitly setting ref: ${{ github.event.repository.default_branch }} and persist-credentials: false..github/workflows/ci-poller.yml pinned all shown actions/create-github-app-token uses to actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1, including internal-app, release-bot, and poller-app token creation..github/workflows/ci-poller.yml invokes src/publish/current-accepted-event.js with APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY, then extracts .actor and .eventId as accepted_actor and accepted_event_id.ci-pending and accepted, comments Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue., and continues without advancing the release.src/publish/validate-approval-attestation.js using APPROVAL_ATTESTATION_AUTHOR="github-actions[bot]", the current issue identity/title, and EXPECTED_ACCEPTED_ACTOR plus EXPECTED_ACCEPTED_EVENT_ID; failure removes ci-pending and accepted, posts the invalid-approval retry comment, and skips the issue.sed title parsing with parsePublishTitle() from ./src/modules/details-from-context.js; the target repository is constructed as getsentry/${parsed.repo}, and the version comes from parsed.version.ci-ready.ci-ready, the poller runs src/publish/record-ci-ready-attestation.js with the expected accepted actor/event ID and captures its GITHUB_OUTPUT via mktemp; output must begin with ci_ready_attestation=.GH_TOKEN="${{ github.token }}"; inability to generate, parse, or post the proof removes ci-pending and accepted, posts the invalid-approval retry comment, and skips advancement.src/publish/validate-approval-attestation.js check after recording CI-ready proof and immediately before moving the issue forward; changed or revoked approval removes ci-pending and accepted and prevents ci-ready.attempt=$((10#$ATTEMPT + 1)), stops at 60 attempts with cron fallback, and sends POST repos/$GITHUB_REPOSITORY/dispatches with JSON {event_type: "ci-poller", client_payload: {attempt: $attempt}} instead of running gh workflow run ci-poller.yml..github/workflows/publish.yml now checks out publish code with pinned actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 and persist-credentials: false before authorization..github/workflows/publish.yml creates a release-bot token for owner getsentry, runs node src/publish/authorize-approval.js, and, only when authorization succeeds with output authorized == 'true', posts ${{ steps.authorization.outputs.approval_attestation }} as a GitHub issue comment..github/workflows/publish.yml validates the newly posted approval with node src/publish/validate-approval-attestation.js and APPROVAL_ATTESTATION_AUTHOR: github-actions[bot]; authorization, attestation posting, or validation failure removes accepted, posts the invalid-approval retry comment, and exits 1..github/workflows/publish.yml dispatches the CI poller using gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" -f event_type=ci-poller rather than gh workflow run ci-poller.yml.publish job validates approval before setup using node .__publish__/src/publish/validate-approval-attestation.js with REQUIRE_CI_READY_ATTESTATION: "true"; invalid proof removes accepted, posts the retry comment, and exits 1.publish job revalidates the approval with the same CI-ready-attestation requirement immediately before publishing; revoked approval similarly removes accepted, comments, and exits 1..github/workflows/publish.yml pinned actions/setup-node to actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38, uses Node 24, and pins checkouts to actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803.docker://getsentry/craft:latest to immutable docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b.src/modules/details-from-context.js now defines and exports PUBLISH_TITLE_REGEX as /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/ and exports parsePublishTitle(title), which returns matched groups or null.detailsFromContext() now uses parsePublishTitle(context.payload.issue.title) and throws Invalid publish issue title: ${context.payload.issue.title} when parsing fails, replacing direct access to .match(...).groups.src/modules/update-issue.js now calls updateTargets() only when inputs?.version is truthy, allowing label cleanup to proceed even without parsed publish inputs.src/publish/update-issue.js now wraps execution in async main(), conditionally parses process.env.PUBLISH_ARGS, warns Could not parse publish inputs; skipping target update on invalid JSON, awaits updateIssue({ context, octokit, inputs }), catches top-level errors by setting process.exitCode = 1, and exports { main }.v4.0.17 completed successfully in /home/byk/Code/getsentry/publish: 16 test files passed and exactly 84 tests passed; duration was 3.80s, with Yarn completing in 4.99s.src/publish/__tests__/authorize-approval.js 7, src/modules/__tests__/approval-attestation.js 5, src/modules/__tests__/update-issue.js 6, src/publish/__tests__/validate-approval-attestation.js 9, src/publish/__tests__/current-accepted-event.js 2, src/modules/__tests__/process-end-state.js 4, src/publish/__tests__/record-ci-ready-attestation.js 3, src/publish/__tests__/workflow-action-pinning.js 16, src/modules/__tests__/approval-authorizer.js 15, src/modules/__tests__/post-workflow-details.js 1, src/publish/__tests__/ci-poller-workflow.js 3, src/publish/__tests__/record-auto-approval-attestation.js 2, src/modules/__tests__/details-from-context.js 5, src/libs/__tests__/github.js 2, src/publish/__tests__/publish-workflow.js 2, and src/publish/__tests__/auto-approval-workflow.js 2.yarn eslint src .github --ignore-pattern '!.github' completed successfully with no reported lint errors in 1.26s.