Distillation

Date: Aug 29, 2026

• 🟡 (13:13) src/publish/validate-approval-attestation.js:8-52 defines authenticated GitHub REST helpers using APPROVAL_TOKEN, Accept: application/vnd.github+json, and X-GitHub-Api-Version: 2026-03-10; getIssue() fetches repos/${repository}/issues/${issueNumber}, and getAllPages() fetches events or comments with per_page=100&page=${page} until a page has fewer than 100 records, throwing resource-specific errors for non-OK responses.
• 🟡 (13:13) validateApprovalAttestation() in src/publish/validate-approval-attestation.js:55-100 concurrently retrieves current issue labels/title, all events, and all comments; approval is valid only when the title equals issueTitle, accepted remains labeled, a current accepted event exists and optionally matches expectedAcceptedEvent.actor/eventId, and a trusted approval attestation matches. With requireCiReadyAttestation=true, it additionally requires a current ci-ready event, current ci-ready label, and CI-ready attestation tied to the accepted event, CI-ready label actor, and title.
• 🟡 (13:13) src/publish/validate-approval-attestation.js:102-151 requires APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and APPROVAL_ATTESTATION_AUTHOR; optional expected approval identity is read only if both EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID exist, and REQUIRE_CI_READY_ATTESTATION === "true" enables CI-ready verification. Invalid validation throws Error("The current accepted label has no matching approval attestation").
• 🟡 (13:13) src/modules/__tests__/approval-attestation.js tests: latest accepted event ID "200" is selected over "100" and matches an attestation authored by github-actions[bot]; numeric GitHub event ID 29503999078 normalizes to string "29503999078"; CI-ready attestations bind accepted event { actor: "contractor", eventId: "200" } and CI-ready actor sentry-internal-app[bot], rejecting changed accepted event "201" or changed CI-ready label actor contractor; malformed base64 and attestations authored by an untrusted comment user or tied to stale title/event are rejected.
• 🟡 (13:13) src/modules/__tests__/approval-authorizer.js tests that getsantry[bot] is authorized without a target-repository permission lookup only when exact allowlist membership includes getsentry/sentry-javascript; it is denied outside that allowlist even if a mocked lookup says write. Human contractor is authorized for target-repository roles write, maintain, and admin, and denied for none, read, triage, "Elevated Bot", or undefined.
• 🟡 (13:13) src/modules/__tests__/approval-authorizer.js confirms unqualified title publish: sentry-javascript/packages/core@10.0.0 authorizes against getsentry/sentry-javascript; malformed titles publish: @1.0.0 and publish: getsentry/sentry-javascript return { authorized: false, repository: null } without GitHub querying; permission lookup failures such as Error("Not Found") propagate.
• 🟡 (13:13) src/publish/__tests__/authorize-approval.js uses test environment GITHUB_OUTPUT="/tmp/github-output", APPROVAL_TOKEN="release-bot-token", issue number "123", and approval repository getsentry/publish; it verifies getAutoApprovedRepositories() parses exact paths getsentry/sentry-javascript and getsentry/objectstore/clients, successful write permission emits authorized=true plus approval_attestation=<!-- publish-approval .+ -->, and a GitHub 404 permission response fails closed without output: Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404.
• 🟡 (13:13) src/publish/__tests__/current-accepted-event.js verifies getCurrentAcceptedEvent() returns latest accepted event { actor: "contractor", eventId: "200" } and rejects an empty event list with Error("The issue has no current accepted label event").
• 🟡 (13:13) src/publish/__tests__/record-ci-ready-attestation.js verifies recordCiReadyAttestation() produces a CI-ready proof binding accepted actor contractor, accepted event ID "100", authenticated app sentry-internal-app[bot], and title publish: getsentry/sentry-javascript@10.0.0; it rejects a changed title or a current re-approval event "200" that differs from poller-observed event "100" with Error("The approval changed before CI could be marked ready").
• 🟡 (13:13) src/publish/__tests__/validate-approval-attestation.js verifies valid trusted approval attestation acceptance and rejects: issue-title changes from getsentry/sentry-javascript@10.0.0 to getsentry/sentry-python@10.0.0; removal of accepted; re-adding accepted as newer event "200" after attested event "100"; and an expected observed approval { actor: "contractor", eventId: "100" } when current attested approval is event "200".
• 🟡 (13:13) src/publish/__tests__/validate-approval-attestation.js verifies CI-ready validation succeeds only with labels accepted and ci-ready, accepted event "100" by contractor, ci-ready event "200" by sentry-internal-app[bot], and both trusted attestations. A manually added ci-ready label by contractor is rejected even when the CI-ready attestation claims sentry-internal-app[bot].
• 🟡 (13:14) Repository working tree showed modified files .github/workflows/ci-poller.yml, .github/workflows/publish.yml, AGENTS.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js; untracked additions include .lore.md, approval-attestation/authorizer modules and tests, src/publish/__tests__/, authorize-approval.js, current-accepted-event.js, record-ci-ready-attestation.js, and validate-approval-attestation.js.
• 🔴 (13:14) User stated release policy: “Never move a release to ci-ready after it changes.”
• 🔴 (13:14) User stated a renamed or re-approved issue never reaches ci-ready.
• 🟡 (13:14) Proposed .github/workflows/ci-poller.yml changes elevate issues permission from read to write, add actions/checkout@v6 with persist-credentials: false, bind and validate the approval event before inspecting CI, remove accepted when approval binding/validation fails or changes during CI, record a CI-ready attestation before applying ci-ready, and revalidate after proof creation to prevent a changed approval from reaching ci-ready.
• 🟡 (13:14) .github/workflows/auto-approve.yml is named auto-approve non-sdks; on issue opening, it runs only when github.actor is sentry-release-bot[bot] or getsantry[bot] and title starts publish: . It checks out only auto-approve-repos.txt using actions/checkout@v4, obtains a Sentry Internal App token via actions/create-github-app-token@v3, extracts REPO from the issue title, and adds accepted only when grep -qxF "$REPO" auto-approve-repos.txt matches.
• 🟡 (13:14) src/modules/details-from-context.js:18-23 parses publish titles with PUBLISH_TITLE_REGEX = /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/; parsePublishTitle() returns named groups or null.
• 🟡 (13:14) detailsFromContext() in src/modules/details-from-context.js:25-75 requires context.payload.issue, rejects invalid publish titles, emits dry_run: "1" only when label dry-run is present, emits path as "." + (titleMatch.path || ""), optionally extracts merge_target from Merge target: <[\\w.\\-/]+>, and extracts checked target IDs from the matched Targets checklist section.
• 🟡 (13:17) auto-approve-repos.txt contains 46 exact auto-approval allowlist entries: 1. getsentry/arroyo; 2. getsentry/auto-type-annotate; 3. getsentry/devenv; 4. getsentry/infra-event-notifier; 5. getsentry/jest-sentry-environment; 6. getsentry/json-schema-diff; 7. getsentry/js-source-scopes; 8. getsentry/objectstore/clients; 9. getsentry/ophio; 10. getsentry/pdb; 11. getsentry/pyo3-python-tracing-subscriber; 12. getsentry/pytest-sentry; 13. getsentry/relay/py; 14. getsentry/responses; 15. getsentry/rust-proguard; 16. getsentry/rust-sourcemap; 17. getsentry/rust-usage-accountant; 18. getsentry/script-runner; 19. getsentry/sentry-api-schema; 20. getsentry/sentry-forked-djangorestframework-stubs; 21. getsentry/sentry-forked-django-stubs; 22. getsentry/sentry-forked-jsonnet; 23. getsentry/sentry-infra-tools; 24. getsentry/sentry-kafka-management; 25. getsentry/sentry-kafka-schemas; 26. getsentry/sentry-protos; 27. getsentry/sentry-redis-tools; 28. getsentry/service-registry; 29. getsentry/skrooge; 30. getsentry/snuba-sdk; 31. getsentry/statsdproxy; 32. getsentry/status-page-list; 33. getsentry/streams/sentry_streams; 34. getsentry/symbolic; 35. getsentry/taskbroker/clients; 36. getsentry/usage-accountant; 37. getsentry/watto; 38. getsentry/sentry; 39. getsentry/snuba; 40. getsentry/vroom; 41. getsentry/relay; 42. getsentry/symbolicator; 43. getsentry/taskbroker; 44. getsentry/uptime-checker; 45. getsentry/launchpad; 46. getsentry/self-hosted.
• 🟡 (13:18) src/publish/inputs.js calls detailsFromContext({ context: github.context }) and publishes the resulting parsed issue details through core.setOutput("result", result).
• 🔴 (13:18) User stated release-approval preference: always require a second person to approve, like a code review.
• 🟡 (13:18) docs/rfc.md states the central publish repository design goals: recycle publishing tokens without disrupting releases, limit token access to authorized personnel, require SDK release approval by a manager or senior engineer for SOC/ISO compliance, and avoid divergent per-project publishing configurations. Proposed flow uses a central repository, structured issue templates, per-repository craft prepare, and accepted to trigger release; OSS CalVer releases are automatically approved unless blocked.