Distillation

Date: Aug 29, 2026

• 🟡 (12:17) Tool updated test files src/publish/__tests__/validate-approval-attestation.js and src/publish/__tests__/record-ci-ready-attestation.js.
• 🟡 (12:22) Focused command yarn vitest run src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js failed: 2 test files failed, with 8 passed and 2 failed tests; duration 464ms (transform 65ms, import 128ms, tests 68ms).
• 🟡 (12:22) src/publish/__tests__/record-ci-ready-attestation.js had 3 tests: passed “binds the current approval to the app that will add ci-ready” (6ms) and “rejects an approval that changes before ci-ready is recorded” (2ms); failed “rejects a re-approval after the event observed by the poller” (14ms).
• 🟡 (12:22) The failing record-ci-ready-attestation.js test expected recordCiReadyAttestation to reject with “The approval changed before CI could be marked …”, but it resolved with a <!-- publish-ci-ready ... --> comment attesting acceptedActor: "contractor", acceptedEventId: "200", ciReadyActor: "sentry-internal-app[bot]", and title publish: getsentry/sentry-javascript@10.0.0.
• 🟡 (12:22) src/publish/__tests__/validate-approval-attestation.js had 7 tests: passed acceptance of the current trusted attestation, rejection after title changes, rejection after accepted removal, rejection after accepted re-addition, CI-ready-proof requirement, and manual ci-ready rejection; failed “rejects a later attested approval when an earlier event was checked” (18ms), because validateApprovalAttestation() returned true rather than expected false.
• 🟡 (12:22) Assistant identified the two failing regressions as proof of a re-approval race and stated it would add exact expected-event matching to approval validation and CI-ready proof recording, then pass the bound event through the poller.
• 🟡 (12:26) Tool updated src/publish/validate-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and .github/workflows/ci-poller.yml.
• 🟡 (12:26) Assistant stated that the expected event still had to flow into the scripts; it planned to replace an ad hoc inline fetch with a validated event output and make both attestation commands reject any mismatch.
• 🟡 (12:29) Inspected src/publish/validate-approval-attestation.js (144 lines). It imports currentAcceptedEvent, currentCiReadyEvent, hasApprovalAttestation, and hasCiReadyAttestation from ../modules/approval-attestation.js.
• 🟡 (12:29) In src/publish/validate-approval-attestation.js, getGitHubResponse(path) fetches https://api.github.com/${path} with Accept: "application/vnd.github+json", Authorization: Bearer ${process.env.APPROVAL_TOKEN}, and "X-GitHub-Api-Version": "2026-03-10".
• 🟡 (12:29) getIssue({ repository, issueNumber }) retrieves repos/${repository}/issues/${issueNumber} and throws Could not retrieve issue #${issueNumber}: GitHub returned ${response.status} on a non-OK response. getAllPages({ repository, issueNumber, resource }) retrieves paginated issue events or comments with per_page=100&page=${page}, accumulating records until a page contains fewer than 100 entries.
• 🟡 (12:29) validateApprovalAttestation({ attestationAuthor, expectedAcceptedEvent, issueNumber, issueTitle, repository, requireCiReadyAttestation = false }) concurrently retrieves the issue, events, and comments; obtains event = currentAcceptedEvent(events) and ciReadyEvent = currentCiReadyEvent(events).
• 🟡 (12:29) Approval validation requires: fetched title exactly equals issueTitle; live accepted label exists; a current accepted event exists; if supplied, expectedAcceptedEvent.actor and .eventId exactly equal the current event’s actor and event ID; and hasApprovalAttestation({ attestationAuthor, comments, event, title }) succeeds.
• 🟡 (12:29) When requireCiReadyAttestation is true, validateApprovalAttestation() additionally requires a current ci-ready event, live ci-ready label, and hasCiReadyAttestation({ acceptedEvent: event, attestationAuthor, comments, ciReadyEvent, title }); otherwise it returns only the approval-validation result.
• 🟡 (12:29) main() currently requires environment variables APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and APPROVAL_ATTESTATION_AUTHOR; it passes REQUIRE_CI_READY_ATTESTATION === "true" but does not yet pass expectedAcceptedEvent from environment into validateApprovalAttestation(). Invalid validation throws The current accepted label has no matching approval attestation.
• 🔴 [requested-continuation] (12:37) User requested continuation of the implementation.
• 🟡 (12:37) Assistant stated its implementation plan: bind the earliest approval event in each poll cycle, validate it before CI work, and preserve that exact event through the final ci-ready transition; it stated this would close the re-approval race without changing manual-dispatch behavior.