Distillation

Date: Sep 8, 2026

• 🔴 (20:08) User stated that the CI poller always adds the ci-ready label; the publish.yml comment says publishing fires only on ci-ready label events, not accepted, to avoid racing with waiting-for-ci on the same event.
• 🟡 (20:08) .github/workflows/publish.yml has a waiting-for-ci job and uses concurrency so issues for the same repo@version share a concurrency group.
• 🟡 (20:08) waiting-for-ci checks out publish code (“Get publish code”), creates tokens using SENTRY_INTERNAL_APP_PRIVATE_KEY and SENTRY_RELEASE_BOT_CLIENT_ID, authorizes approval, validates the approval attestation through node src/publish/validate-approval-attestation.js, and conditionally removes ci-failed while managing CI labels.
• 🟡 (20:08) publish.yml obtains a poller app token and conditionally executes subsequent poller-related steps only when steps.poller-token.outcome == 'success'.
• 🟡 (20:08) The publishing job is gated on a ci-ready label event and requires that the issue not retain a ci-pending label.
• 🟡 (20:08) The publishing job checks out publish code into .__publish__, supplies APPROVAL_ISSUE_NUMBER: ${{ github.event.issue.number }}, invokes node .__publish__/src/publish/post-workflow-details.js, and runs a “Setup Node” step.
• 🟡 (20:08) publish.yml includes special conditional handling when parsed inputs identify either repo == 'sentry-migr8' && merge_target == 'tmp-merge-target' or another elided condition.
• 🟡 (20:08) The workflow has a target-repo-branch step, creates another GitHub App token via actions/create-github-app-token@v3, and conditionally handles targets when fromJSON(steps.inputs.outputs.result).targets is present.
• 🟡 (20:08) Publish state-file logic documents that CRAFT_PUBLISH_PATH is either "." or another path; it writes a state file and logs Wrote state file: $state_file.
• 🟡 (20:08) The workflow’s Craft publishing step is named “Publish using Craft” and sets GIT_COMMITTER_NAME: sentry-release-bot[bot].
• 🟡 (20:08) The Craft publishing environment includes DOCKER_GHCR_IO_PASSWORD: ${{ secrets.GITHUB_TOKEN }} for ghcr.io authentication, plus HEX_API_KEY: ${{ secrets.HEX_API_KEY }}, GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}, and other elided secret configuration.
• 🟡 (20:08) After Craft publishing, publish.yml has an “Update completed targets and remove label” step and includes GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} in its environment.