Distillation

Date: Aug 29, 2026

• 🟡 (01:20) src/modules/publish-issue-title.peggy defines canonical PublishIssueTitle grammar: "publish: ", optional "getsentry/", repo:Repository, optional path:Path, optional legacy workspace:LegacyWorkspace, "@", and version:Version, followed by end-of-input. It returns { repo, path: path || "", version, ...(workspace ? { workspace } : {}) }.
• 🟡 (01:20) publish-issue-title.peggy treats a path suffix as syntactic only; controller-side logic must resolve a single path segment as a workspace only after checkout of the CI-approved revision.
• 🟡 (01:20) publish-issue-title.peggy RepositoryCharacter and PathSegment allow [A-Za-z0-9_.-]; Path joins one or more slash-prefixed path segments; Version allows [A-Za-z0-9_.+-]+.
• 🟡 (01:20) publish-issue-title.peggy supports legacy workspace syntax [workspace: <JsonString>], where JsonString preserves its quoted JSON form and permits non-control, non-quote, non-backslash characters plus JSON escapes (\", \\, \/, \b, \f, \n, \r, \t, and \u followed by four hex digits).
• 🟡 (01:22) src/modules/release-revision.js defines CHECK_RUNS_LINK as /^- \[View check runs\]\(https:\/\/github\.com\/getsentry\/(?<repo>[A-Za-z0-9_.-]+)\/commit\/(?<revision>[0-9a-f]{40})\/checks\/?\)$/m.
• 🟡 (01:22) getReleaseRevision({ issueBody, repo }) in src/modules/release-revision.js matches the issue body’s View check runs link, requires matched groups.repo === repo, throws Expected a View check runs link for getsentry/${repo} in the publish issue body. if absent/mismatched, and returns the matched 40-character lowercase hexadecimal commit revision.
• 🟡 (01:25) src/publish/resolve-release-revision.js parses process.env.PUBLISH_ARGS || "" for repo, calls getReleaseRevision({ issueBody: process.env.PUBLISH_ISSUE_BODY || "", repo }), and exposes it as the GitHub Actions output revision via core.setOutput("revision", ...).
• 🟡 (01:26) Assistant stated it was applying a Publish workflow change that would pin Craft to 2.31.0; run craft workspace list only after checkout of the exact CI-approved revision; treat a missing root .craft.yml as path-only; and fail closed for any workspace-discovery error when configuration exists.
• 🟡 (01:28) craft-workspace-action-propagation/src/commands/publish.ts lines 640–679 show the no-rev flow: it calculates branchName = \${branchPrefix}/${newVersion}`, checks it out, and on failure calls findReleaseBranches(git, branchPrefix). It throws ConfigurationErrorcontaining the missing branch, suggestion to runcraft prepare, configured/default release branch prefix, exact and fuzzy branch matches where present, or No release branches found on the remote.`, plus the original error.
• 🟡 (01:28) src/commands/publish.ts lines 682–694 resolves revision = await git.revparse('HEAD'), checks CI status with checkRevisionStatus(statusProvider, revision, argv.noStatusCheck), prints artifact summary, and checks required artifacts. Lines 712 onward expands workspace targets before deriving the publish-state path.
• 🟡 (01:30) An attempted broad patch to .github/workflows/publish.yml failed because the expected Set target repo checkout branch block did not match the current file exactly; the failed expected block omitted the current step’s env declarations for MERGE_TARGET and REPO.
• 🟡 (01:31) Assistant stated it would re-read the current Publish workflow and apply narrow edits after the broad patch failure to preserve concurrent changes.
• 🟡 (01:33) Current .github/workflows/publish.yml parses issue inputs through node .__publish__/src/publish/inputs.js (id: inputs) and, on success, posts workflow details through node .__publish__/src/publish/post-workflow-details.js.
• 🟡 (01:33) Current Publish workflow retains a branch-selection step, Set target repo checkout branch (id: target-repo-branch), for specific repo/merge-target pairs: sentry-migr8/tmp-merge-target; sentry-javascript/v10, v9, v8, v7, or master; sentry-python/alpha; and sentry-wizard/1.x. It exports target_repo_branch=$MERGE_TARGET; comments require registered branches to be protected.
• 🟡 (01:33) Current Publish workflow creates a cross-repository Release Bot token using actions/create-github-app-token@v3, vars.SENTRY_RELEASE_BOT_CLIENT_ID, secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY, and owner: getsentry.
• 🟡 (01:33) Current Publish workflow checks out getsentry/${{ fromJSON(steps.inputs.outputs.result).repo }} into __repo__ using actions/checkout@v6, token ${{ steps.token.outputs.token }}, fetch-depth: 0, and ref ${{ steps.target-repo-branch.outputs.target_repo_branch || '' }}—therefore defaulting to the repository default branch when no allowlisted target branch applies.
• 🟡 (01:33) Current Publish workflow’s Set targets step runs only when parsed issue targets exist. It receives CRAFT_PUBLISH_REPO, CRAFT_PUBLISH_PATH, CRAFT_PUBLISH_VERSION, optional CRAFT_PUBLISH_WORKSPACE, and JSON targets; it generates {"published": ...} JSON using jq.
• 🟡 (01:33) The Set targets script uses realpath -m "/github/workspace/__repo__/$CRAFT_PUBLISH_PATH" and rejects paths outside /github/workspace/__repo__; hashes the container cwd as first 12 characters of SHA-1; sanitizes owner/repo/version to lowercase [a-z0-9._-] tokens; base64url-encodes an optional workspace name; and writes state to $GITHUB_WORKSPACE/.craft-state/craft/publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${workspace_prefix}${version_sanitised}.json.
• 🟡 (01:33) Current Publish workflow runs Craft as docker://getsentry/craft:latest, changes directory to __repo__/${{ fromJSON(steps.inputs.outputs.result).path }}, and executes craft publish ${{ fromJSON(steps.inputs.outputs.result).version }}. It sets XDG_STATE_HOME: /github/workspace/.craft-state, optional CRAFT_WORKSPACE, CRAFT_MERGE_TARGET, and CRAFT_PUBLISH_STATE_GITHUB_REPO: getsentry/<parsed repo>.
• 🟡 (01:33) Current Publish workflow runs node .__publish__/src/publish/update-issue.js on cancellation or failure with PUBLISH_ARGS, CRAFT_STATE_FILE_PATH, and GITHUB_TOKEN; it separately posts cancellation with node .__publish__/src/publish/post-result.js cancelled.
• 🟡 (01:35) src/modules/details-from-context.js parses issue titles using parsePublishIssueTitle(), converts an optional legacy JSON workspace value with JSON.parse, and rejects invalid JSON with Invalid publish workspace JSON in title: '<title>'.
• 🟡 (01:35) detailsFromContext() rejects a legacy workspace that is empty or contains Unicode control (Cc), format (Cf), line separator (Zl), or paragraph separator (Zp) characters, with Workspace names must be nonempty and cannot contain Unicode control, format, or separator characters.
• 🟡 (01:35) detailsFromContext() derives path = "." + parsedTitleDetails.path, rejects any path whose slash-separated components include .., extracts merge_target from ^Merge target: (?<merge_target>[\w.\-/]+)$ in the issue body, and returns { ...parsedTitleDetails, dry_run, merge_target, path, targets, ...(workspace ? { workspace } : {}) }.
• 🟡 (01:35) detailsFromContext() determines dry_run as "1" when any issue label has name === "dry-run", otherwise ""; parses checked target IDs from the issue body’s targets section using TARGETS_SECTION_PARSER_REGEX and CHECKED_TARGETS_PARSER_REGEX.
• 🟡 (01:36) Assistant stated legacy JSON-qualified workspace titles remain backward-compatible at controller parsing time, while only compact titles use checkout-time workspace discovery. It was checking the issue-body check-runs link format and action Docker mounts before narrowed workflow edits.
• 🟡 (01:37) src/modules/__tests__/details-from-context.js verifies a View check runs link of the shape https://github.com/getsentry/sentry/commit/7e5ca7ed5581552de066e2a8bc295b8306be38ac/checks/ appears in representative publish issue bodies.
• 🟡 (01:37) details-from-context tests expect publish: getsentry/sentry@21.3.1 with selected targets github, npm[@sentry/node], and docker[latest] to parse as { dry_run: "", merge_target: "custom-branch", path: ".", repo: "sentry", targets: ["github", "npm[@sentry/node]", "docker[latest]"], version: "21.3.1" }.
• 🟡 (01:37) details-from-context tests verify version 4.2.6+sentry1, default merge-target parsing as merge_target: "", legacy title publish: getsentry/toolkit [workspace: "cli/v2"] @1.2.3 parsing to workspace cli/v2, and escaped legacy workspace syntax such as cli [preview] \"next\".
• 🟡 (01:39) craft-workspace-action-propagation/action.yml constructs publish issue titles as publish: ${GITHUB_REPOSITORY}${SUBDIRECTORY}${WORKSPACE:+/$WORKSPACE}@${RESOLVED_VERSION}; SUBDIRECTORY is /${inputs.path} unless inputs.path == '.', and WORKSPACE is appended as another slash segment.
• 🟡 (01:39) action.yml reads RELEASE_SHA from ${{ steps.craft.outputs.sha }}, derives issue metadata including RELEASE_BRANCH, RELEASE_PREVIOUS_TAG, MERGE_TARGET, PUBLISH_REPO, and WORKSPACE, and looks for an existing open issue by exact title using gh -R "$PUBLISH_REPO" issue list --json title,url,number,body filtered with jq.
• 🟡 (01:39) action.yml preserves checked publish targets from an existing issue by extracting only text between ### Targets and Checked targets will be skipped, storing checked target names in a Bash associative array, then applying [x] to matching targets in the rebuilt target list.
• 🟡 (01:39) action.yml truncates changelog content to MAX_CHANGELOG_CHARS=60000, appending \n\n---\n*Changelog truncated for issue body.* when exceeded, to remain under the approximately 65,536-character GitHub issue-body limit.
• 🟡 (01:42) publishMain(argv: PublishOptions) in craft-workspace-action-propagation/src/commands/publish.ts checks for dirty repository state unless argv.noGitChecks; it obtains branchPrefix from config.releaseBranchPrefix || DEFAULT_RELEASE_BRANCH_NAME.
• 🟡 (01:42) In publishMain, when argv.rev is supplied, Craft calls git.raw('name-rev', '--name-only', '--no-undefined', rev), uses the resolved branch name or the supplied revision as checkoutTarget, logs Checking out revision, and runs await git.checkout(checkoutTarget). When argv.rev is absent, it instead follows the release-branch lookup/check-out flow.