Distillation

Date: Sep 10, 2026

• 🔴 [requested-review] (15:56) User requested a substantive, independent workflow and release-lifecycle correctness review of the exact current worktree at /home/byk/Code/getsentry/publish.
• 🔴 [enforced-read-only] (15:56) User required the review to be READ ONLY: do not edit files, run formatters, or mutate the tree.
• 🔴 (15:56) User required review of the full integrated diff against origin/main, including every changed or untracked file relevant to behavior.
• 🔴 (15:56) User required end-to-end tracing of: issue opened/accepted; waiting-for-CI activation; manual relay and retries; per-issue poller processing; malformed/transient API failures; CI failure; revision changes; ci-ready handoff including add failure; publish setup failures; Craft success/failure/cancellation; issue close/deauthorization; target restoration; terminal reporting; and cleanup retries.
• 🔴 (15:56) User required verification that comments, telemetry, and dependencies never gate critical state transitions; retries cannot strand or incorrectly advance releases; and updateIssue handles already-absent labels without hiding target-restoration errors.
• 🔴 (15:56) User required inspection of tests for false positives and missing adversarial states.
• 🔴 (15:56) User stated the exact tree had passed generated verification, 192 tests, lint, whitespace checks, and 10 focused stability runs.
• 🔴 (15:56) User required evidence with current file:line references and classification of every point as PASS, CONCERN, or MUST-FIX.
• 🔴 (15:56) User required that a blocked response begin exactly BLOCKED and state the exact blocker.
• 🔴 (15:56) User required the review to end exactly MERGE or DO-NOT-MERGE.
• 🔴 (15:56) User directive: “Never return empty output.”
• 🟡 (15:56) Assistant stated the required repo-setup skill was unavailable and planned to apply repository instructions directly, fingerprint the worktree, inspect the complete origin/main...worktree delta and all untracked files, trace lifecycle and tests, run only read-only checks, and verify the fingerprint afterward.
• 🟡 (15:57) Worktree fingerprint showed HEAD and origin/main both at commit 7c60ddb7f43040fe8fbfea70efc833f689c04e75.
• 🟡 (15:57) Integrated tracked diff reported 34 files changed, 1,064 insertions, and 243 deletions.
• 🟡 (15:57) Changed tracked files and statuses included: MM .github/workflows/auto-approve.yml, MM .github/workflows/ci-poller.yml, M .github/workflows/cocoapods-keepalive.yml, MM .github/workflows/publish.yml, M .github/workflows/test.yml, M AGENTS.md, M README.md, M docs/key_rotation_vault_changes.md, M docs/rfc.md, M src/libs/__tests__/github.js, M src/libs/github.js, M src/modules/__tests__/ci-poller-input.js, M src/modules/__tests__/ci-poller-workflow.js, MM src/modules/__tests__/details-from-context.js, M src/modules/__tests__/process-end-state.js, M src/modules/__tests__/publish-location.js, M src/modules/__tests__/publish-workflow.js, M src/modules/__tests__/release-revision.js, MM src/modules/__tests__/update-issue.js, M src/modules/ci-poller-input.js, M src/modules/details-from-context.js, M src/modules/post-workflow-details.js, MM src/modules/process-end-state.js, M src/modules/publish-location.js, M src/modules/release-revision.js, M src/modules/update-issue.js, M src/publish/__tests__/discover-location.js, M src/publish/__tests__/resolve-release-revision.js, M src/publish/discover-location.js, M src/publish/inputs.js, MM src/publish/post-result.js, M src/publish/post-workflow-details.js, M src/publish/resolve-ci-poller-input.js, and M src/publish/update-issue.js.
• 🟡 (15:57) Untracked files were: .github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/authorize-approval.js, src/publish/__tests__/auto-approval-workflow.js, src/publish/__tests__/ci-poller-workflow.js, src/publish/__tests__/current-accepted-event.js, src/publish/__tests__/post-result.js, src/publish/__tests__/publish-workflow.js, src/publish/__tests__/record-auto-approval-attestation.js, src/publish/__tests__/record-ci-ready-attestation.js, src/publish/__tests__/request-digest-from-event.js, src/publish/__tests__/validate-approval-attestation.js, src/publish/__tests__/workflow-action-pinning.js, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, src/publish/request-digest-from-event.js, and src/publish/validate-approval-attestation.js.
• 🟡 (15:57) Worktree inventory contained .eslintrc.js, .git/, .github/, .gitignore, .lore.md, AGENTS.md, auto-approve-repos.txt, docs/, LICENSE, node_modules/, package.json, README.md, scripts/, src/, vitest.config.js, and yarn.lock.
• 🟡 (15:57) AGENTS.md identified the repository as the Sentry Publish Repository: a GitHub Actions-based approval system for publishing releases across multiple Sentry projects using Craft, implemented as CommonJS JavaScript on Node.js 24.0.0.
• 🟡 (15:57) Repository tooling rules in AGENTS.md: use Yarn 1.22.22 and do not use npm; commands include yarn install, yarn test, yarn test:watch, yarn test src/modules/__tests__/update-issue.js, yarn test -t "pattern", yarn lint, and yarn prettier.
• 🟡 (15:57) Repository structure documented in AGENTS.md: src/libs/ contains shared utilities, src/modules/ contains reusable core business logic, and src/publish/ contains GitHub Actions entry points.
• 🟡 (15:57) Repository conventions documented in AGENTS.md: kebab-case filenames; tests under __tests__/; camelCase variables/functions; UPPER_SNAKE_CASE constants/regexes; CommonJS source modules; ES modules for tests; imports ordered as Node built-ins, external packages, then local modules; Prettier defaults with double quotes and required semicolons.
• 🔴 (15:57) User directive: “Always throw for unexpected values:” Unknown switch cases must throw descriptive errors, exemplified by throw new Error(\Unknown status: '${status}'`)`.
• 🟡 (15:57) AGENTS.md testing guidance specified Vitest v4.0.0 with globals enabled, automatically cleared mocks, external dependencies mocked before importing the module under test, and inline snapshots for complex output.
• 🟡 (15:57) Key dependencies documented in AGENTS.md: @actions/core, @actions/github, and @sentry/node; all code is owned by @getsentry/releng.
• 🟡 (15:58) package.json identified package publish, version 0.0.1, repository git@github.com:getsentry/publish.git, Apache-2.0 license, Node 24.0.0, Yarn 1.22.22, and resolution undici: ^6.23.0.
• 🟡 (15:58) package.json scripts were: generate → node scripts/generate-publish-issue-title-parser.js; check:generated → the same command with --check; test → yarn check:generated && vitest run; test:watch → vitest; lint → eslint src .github --ignore-pattern '!.github'; prettier → prettier --write src.
• 🟡 (15:58) package.json dependencies were @actions/core ^2.0.0, @actions/github ^7.0.0, and @sentry/node ^10.0.0; dev dependencies included eslint ^8.9.0, eslint-config-prettier ^8.3.0, eslint-plugin-yml ^0.13.0, peggy 5.1.0, prettier ^2.2.1, and vitest ^4.1.0.
• 🟡 (15:58) .github/workflows/auto-approve.yml defines auto-approve non-sdks, triggered when an issue is opened, with contents: read and issues: write; the job runs in the production environment only when the actor is sentry-release-bot[bot] or getsantry[bot] and the issue title starts with publish: .
• 🟡 (15:58) .github/workflows/auto-approve.yml pins actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with persist-credentials: false and actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1.
• 🟡 (15:58) Auto-approval workflow sequence: 1. run node src/publish/request-digest-from-event.js; 2. run node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, AUTO_APPROVER, and EXPECTED_REQUEST_DIGEST; 3. if attestation succeeds, post AUTO_APPROVAL_ATTESTATION using gh issue comment; 4. if attestation succeeds, parse the repository from ISSUE_TITLE, require an exact fixed-string match in auto-approve-repos.txt, and add the accepted label with gh issue edit.
• 🔴 (15:59) User directive: “Always run trusted code.” In the CI poller context, workflow_dispatch may target any ref, so execution must use trusted code rather than arbitrary dispatched-ref code.
• 🔴 (15:59) User directive: “Never move a release to ci-ready after it changes.”
• 🔴 (15:59) User required that a renamed or re-approved issue never reaches ci-ready, including when changes happen while CI checks are running.
• 🟡 (15:59) CI poller workflow evidence showed it processes only issues carrying both ci-pending and accepted; malformed requests are commented with “The publish request is invalid and could not be checked. Fix the request and re-add the accepted label to retry.”
• 🟡 (15:59) CI poller workflow revalidates after the final CI check because checks can take hours, specifically to prevent a renamed or re-approved issue from reaching ci-ready.
• 🟡 (15:59) CI poller dispatch attempts must be integers from 0 through 59; relay retries are capped at 60 attempts, approximately 30 minutes, after which cron is expected to continue polling.
• 🟡 (15:59) CI poller logic treats completed checks with conclusions other than success, neutral, or skipped as failed and joins their names into failed_names.
• 🟡 (15:59) .github/workflows/ci-poller-dispatch.yml defines Run CI Status Poller, triggered only by workflow_dispatch, with permissions: {}; its sole dispatch job uses the production environment, runs on ubuntu-latest, and executes only run: ":".
• 🟡 (15:59) .github/workflows/ci-poller-dispatch.yml documents that production permits deployments only from main; repository secrets must never be used by the workflow, and protected environment secrets prevent an arbitrary dispatched ref from adding them.