Distillation

Date: Aug 27, 2026

• 🔴 [requested-security-review] (15:55) User requested a read-only, adversarial compatibility/security review of the proposed compact workspace-title redesign across /home/byk/Code/getsentry/craft-workspace-action-propagation and /home/byk/Code/getsentry/publish-workspace-acceptance; instructed not to modify files or write code.
• 🔴 (15:55) User stated they reject any new issue-body marker or issue-body identity changes.
• 🔴 (15:55) User stated the desired design may use release-branch configuration as the source of truth for classifying title suffixes.
• 🔴 (15:55) User required the review to examine action.yml, publish.yml, ci-poller.yml, title parsing, workflow sequencing, existing check-run/branch mechanisms, configuration schema, and workspace resolution.
• 🔴 (15:55) User required determining whether a secure, backward-compatible no-marker design is possible.
• 🔴 (15:55) User required legacy field-less titles to never convert into new requests.
• 🔴 (15:55) User required no normalization before workspace lookup.
• 🔴 (15:55) User required workflow_dispatch to remain enabled.
• 🔴 (15:55) User requested precise file:line evidence, prioritized blockers, a concrete minimal safe contract if possible, required regression tests, and a MERGE/DO-NOT-MERGE verdict.
• 🟡 (15:55) Repository /home/byk/Code/getsentry/craft-workspace-action-propagation contains 33 top-level entries including action.yml, .craft.yml, src/, dist/, package.json, pnpm-lock.yaml, AGENTS.md, vitest.config.mts, and .github/.
• 🟡 (15:56) Repository /home/byk/Code/getsentry/publish-workspace-acceptance contains 14 top-level entries including .github/, src/, package.json, yarn.lock, AGENTS.md, README.md, and vitest.config.js.
• 🔴 (15:56) User stated package-management preference: always use pnpm; never use npm or yarn.
• 🟡 (15:56) craft-workspace-action-propagation/AGENTS.md:7-9 specifies pnpm only; Node.js is Volta-managed at v22.12.0; dependencies install with pnpm install --frozen-lockfile.
• 🟡 (15:56) craft-workspace-action-propagation/AGENTS.md:13-18 specifies pnpm build outputs to dist/craft, pnpm test runs tests, pnpm lint runs ESLint, and pnpm fix auto-fixes lint issues.
• 🟡 (15:56) craft-workspace-action-propagation/AGENTS.md:28-30 specifies TypeScript throughout, Prettier 3.x with single quotes/no arrow parentheses via .prettierrc.yml, and ESLint 9.x flat configuration in eslint.config.mjs using typescript-eslint.
• 🟡 (15:56) craft-workspace-action-propagation/AGENTS.md:36-50 documents src/ directories __mocks__/, __tests__/, artifact_providers/, commands/, schemas/, status_providers/, targets/, types/, utils/; key files config.ts, index.ts, logger.ts; and bundled executable dist/craft.
• 🟡 (15:56) craft-workspace-action-propagation/AGENTS.md:53-58 states tests use Vitest, live in src/__tests__/ as *.test.ts, run with pnpm test, and use vi.fn(), vi.mock(), and vi.spyOn().
• 🟡 (15:56) craft-workspace-action-propagation/AGENTS.md:62-69 states main branch is master, CI tests Node.js 20 and 22, Craft dogfoods its own release tooling, repository config is root .craft.yml, and configuration schema is in src/schemas/.
• 🟡 (15:56) craft-workspace-action-propagation/AGENTS.md:73-105 documents centralized dry-run-aware wrappers: getGitClient()/createGitClient(directory) for Git, getGitHubClient() for GitHub APIs, safeFs for writes, and safeExec()/safeExecSync() for other commands; lint prohibits direct simple-git imports and new Octokit() outside wrappers.
• 🟡 (15:56) publish-workspace-acceptance/AGENTS.md:7 describes the repository as a GitHub Actions-based approval system for publishing releases across multiple Sentry projects using Craft; it is pure JavaScript/CommonJS and uses Node.js 24.0.0.
• 🟡 (15:56) publish-workspace-acceptance/AGENTS.md:13-14 independently specifies Yarn 1.22.22 Classic and prohibits npm, with Volta version management; this conflicts with the user's pnpm-only directive.
• 🟡 (15:56) publish-workspace-acceptance/AGENTS.md:54-67 documents src/libs/, src/modules/, and src/publish/; libs/ provides shared utilities, modules/ holds reusable business logic, and publish/ contains GitHub Actions entry points.
• 🔴 (15:56) User stated unexpected values must always throw.
• 🟡 (15:56) publish-workspace-acceptance/AGENTS.md:126-170 requires descriptive errors, guard clauses, and a throwing default branch for unexpected switch values, exemplified by throw new Error(\Unknown status: '${status}'`)`.
• 🟡 (15:56) publish-workspace-acceptance/AGENTS.md:182-223 specifies Vitest v4.0.0 with globals enabled, auto-cleared mocks, mock-before-require test structure, and supports inline snapshots.
• 🟡 (15:56) publish-workspace-acceptance/AGENTS.md:265-275 states src/publish/ entry points use @actions/core and @actions/github, issue-based workflows are triggered by labels/comments, and all code is owned by @getsentry/releng.
• 🟡 (15:56) craft-workspace-action-propagation/.github/workflows/ contains build.yml, changelog-preview.yml, docs-preview.yml, enforce-license-compliance.yml, image.yml, lint.yml, and release.yml.
• 🟡 (15:56) publish-workspace-acceptance/.github/workflows/ contains auto-approve.yml, ci-poller.yml, cocoapods-keepalive.yml, publish.yml, and test.yml.
• 🟡 (15:57) Git state for Craft repository: branch feat/workspace-action-propagation at 6dae341 (feat: propagate release workspaces), based on 21270a1 (feat(config): add release workspaces) over origin/master at 21270a1.
• 🟡 (15:57) Git state for Publish repository: branch feat/workspace-acceptance at b658ffa (fix: validate publish workspace JSON), preceded by 33de3f1 (feat: accept workspace publish requests), based on origin/main/main at 83d210b; attempting origin/master...HEAD failed because origin/master is unknown/ambiguous.
• 🔴 (15:57) User stated/identified commit 4da4a25: chore: replace deprecated trimRight() with trimEnd() (#9012).
• 🟡 (16:03) Proposed Craft change 6dae341 adds optional workspace input in action.yml described as “Named Craft release workspace to prepare and publish.”
• 🟡 (16:03) Proposed Craft change 6dae341 adds a Validate workspace composite-action step in action.yml that rejects workspace values containing Unicode control (\p{Cc}), format (\p{Cf}), line-separator (\p{Zl}), or paragraph-separator (\p{Zp}) characters.
• 🟡 (16:03) Proposed Craft change 6dae341 passes WORKSPACE: ${{ inputs.workspace }} to the targets-related action step, conditionally constructs CRAFT_ARGS=("--workspace=$WORKSPACE"), and invokes craft targets "${CRAFT_ARGS[@]}".
• 🟡 (16:03) Proposed Craft change 6dae341 includes tests that exercise workspace propagation, including a Unicode bidi-control workspace value cli\u202enext and validation failure behavior.