Distillation

Date: Aug 28, 2026

• 🟡 (19:27) yarn test (vitest run, Vitest v4.0.17) passed: 9 test files and 41 tests passed; duration 1.51s (transform 212ms, import 929ms, tests 269ms).
• 🟡 (19:27) Working tree had modified files: .github/workflows/ci-poller.yml, .github/workflows/publish.yml, AGENTS.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js.
• 🟡 (19:27) Working tree had untracked files/directories: .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/, src/publish/authorize-approval.js, and src/publish/validate-approval-attestation.js.
• 🔴 (19:28) [required-second-approval] User stated releases should always require a second person to approve, like code review.
• 🔴 (19:28) [required-ci-ready-label] User stated ci-poller must always add ci-ready after passing CI, including when that label already exists, because re-adding emits the label event needed to start publishing after the waiting-for-ci race.
• 🔴 (19:28) [manual-recovery] User stated workflow_dispatch must always remain allowed for manual recovery, independent of the pending-work repository variable.
• 🔴 (19:28) [approval-policy] User stated triage never authorizes approval; human authorization is limited to GitHub collaborator roles write, maintain, and admin.
• 🔴 (19:28) [approval-policy] User stated getsantry[bot] never falls through to collaborator permission lookup; it authorizes only for an exact parsed repository/release path listed in auto-approve-repos.txt.
• 🟡 (19:28) Approval-authorizer decision: live GitHub collaborator permission checks were chosen over private “security-as-code,” because Publish is public and GitHub reflects effective target-repository access without exposing RBAC.
• 🟡 (19:28) Approval-attestation event-ID decision: normalize decimal GitHub issue-event IDs before comparison because live issue-events API IDs are numeric while attestation payload IDs are strings; BigInt was rejected because this project’s ESLint environment flags it as undefined. Use a strict decimal-ID comparator.
• 🟡 (19:28) Authorization title-parsing decision: share PUBLISH_TITLE_REGEX from details-from-context.js rather than using a separate flexible authorization regex, to prevent authorization/parser drift. The shared regex supports qualified and legacy unqualified getsentry titles, optional release paths, and Publish-valid versions; unqualified titles map to owner getsentry, while malformed/unsupported titles are rejected before permission lookup.
• 🟡 (19:28) Auto-approval provenance investigation: an internal-app token can add the accepted label but GitHub records the app, rather than getsantry[bot], as the label-event actor; authorizing github.actor can therefore reject legitimate allowlisted automation or check the app’s target-repository role. Required approach: preserve trusted auto-approval provenance independently of label-event actor, or consume an authenticated signal identifying the original bot.
• 🟡 (19:28) publish.yml rejection-cleanup decision: cleanup only after checkout or token creation was rejected because failed prerequisites skip later steps and can leave accepted attached. Required approach: create cleanup credentials before authorization, run authorization with continue-on-error, remove accepted unless authorized is exactly true, then fail; GitHub permission API failures after authorization begins must also remove the label.
• 🟡 (19:28) publish.yml TOCTOU mitigation: proof must bind the exact current accepted event, actor, and title. Before moving to ci-ready and before publication, require live title, current accepted event, and live accepted label to match; title changes, label removal, or a later accepted event require fresh approval.
• 🟡 (19:34) auto-approve-repos.txt contains exactly 46 allowlisted release paths, in order: 1. getsentry/arroyo; 2. getsentry/auto-type-annotate; 3. getsentry/devenv; 4. getsentry/infra-event-notifier; 5. getsentry/jest-sentry-environment; 6. getsentry/json-schema-diff; 7. getsentry/js-source-scopes; 8. getsentry/objectstore/clients; 9. getsentry/ophio; 10. getsentry/pdb; 11. getsentry/pyo3-python-tracing-subscriber; 12. getsentry/pytest-sentry; 13. getsentry/relay/py; 14. getsentry/responses; 15. getsentry/rust-proguard; 16. getsentry/rust-sourcemap; 17. getsentry/rust-usage-accountant; 18. getsentry/script-runner; 19. getsentry/sentry-api-schema; 20. getsentry/sentry-forked-djangorestframework-stubs; 21. getsentry/sentry-forked-django-stubs; 22. getsentry/sentry-forked-jsonnet; 23. getsentry/sentry-infra-tools; 24. getsentry/sentry-kafka-management; 25. getsentry/sentry-kafka-schemas; 26. getsentry/sentry-protos; 27. getsentry/sentry-redis-tools; 28. getsentry/service-registry; 29. getsentry/skrooge; 30. getsentry/snuba-sdk; 31. getsentry/statsdproxy; 32. getsentry/status-page-list; 33. getsentry/streams/sentry_streams; 34. getsentry/symbolic; 35. getsentry/taskbroker/clients; 36. getsentry/usage-accountant; 37. getsentry/watto; 38. getsentry/sentry; 39. getsentry/snuba; 40. getsentry/vroom; 41. getsentry/relay; 42. getsentry/symbolicator; 43. getsentry/taskbroker; 44. getsentry/uptime-checker; 45. getsentry/launchpad; 46. getsentry/self-hosted.
• 🟡 (19:41) src/modules/update-issue.js updateIssue({ context, octokit, inputs }) obtains version from inputs, publishRepo from context.repo, and issue_number from context.payload.issue.number; it concurrently calls updateTargets({ octokit, version, publishRepo, issue_number }) and octokit.rest.issues.removeLabel({ ...publishRepo, issue_number, name: "accepted" }).
• 🟡 (19:41) yarn eslint src .github --ignore-pattern '!.github' failed with 1 error and 0 warnings: .github/workflows/cocoapods-keepalive.yml:1:7 violates yml/plain-scalar (“Must use plain style scalar”); the error is potentially fixable with --fix.
• 🟡 (19:41) Lookup of /home/byk/Code/getsentry/publish/.jj failed because the file was not found.
• 🟡 (19:42) A subsequent yarn test (vitest run, Vitest v4.0.17) passed: 9 test files and 41 tests passed; duration 1.32s (transform 168ms, import 1.14s, tests 185ms).
• 🟡 (19:42) Lookup of .github/workflows/ci-pending.yml failed because the file does not exist; .github/workflows/ contains exactly auto-approve.yml, ci-poller.yml, cocoapods-keepalive.yml, publish.yml, and test.yml.
• 🔴 (19:42) [manual-recovery] User reiterated that workflow_dispatch must always be allowed for manual recovery.
• 🟡 (19:42) Visible ci-poller.yml behavior includes workflow_dispatch, a no-runner skip when there is nothing to check, validation of approval attestation before proceeding, removal of ci-pending, adding ci-ready on successful CI, and a cleanup/synchronization mechanism using repository variable CI_POLLER_HAS_PENDING; it self-dispatches for subsequent checks with an approximate 30–60 second GitHub Actions startup delay.