Distillation

Date: Aug 29, 2026

• 🟡 (13:19) package.json identifies the private publish project, version 0.0.1, as “Approval-based publishing system for Sentry”; repository git@github.com:getsentry/publish.git; Apache-2.0 license; Volta Node 24.0.0 and Yarn 1.22.22; resolution undici: "^6.23.0"; scripts test: "vitest run", test:watch: "vitest", lint: "eslint src .github --ignore-pattern '!.github'", and prettier: "prettier --write src"; dev dependencies include eslint "^8.9.0", eslint-config-prettier "^8.3.0", eslint-plugin-yml "^0.13.0", prettier "^2.2.1", vitest "^4.1.0"; runtime dependencies are @actions/core "^2.0.0", @actions/github "^7.0.0", and @sentry/node "^10.0.0".
• 🟡 (13:19) Targeted ESLint invocation over .github/workflows/publish.yml, .github/workflows/ci-poller.yml, and the approval-attestation/authorizer/publish source and test files completed with 0 errors and 2 warnings: both workflow YAML files were ignored by default because no negated ignore pattern was supplied. Yarn completed in 0.74s.
• 🟡 (13:20) ESLint command eslint .github/workflows/publish.yml .github/workflows/ci-poller.yml --ignore-pattern !.github completed successfully with no reported warnings or errors; Yarn completed in 0.73s.
• 🟡 (13:22) auto-approve-repos.txt contains exactly 46 allowlisted paths, in order: 1. getsentry/arroyo; 2. getsentry/auto-type-annotate; 3. getsentry/devenv; 4. getsentry/infra-event-notifier; 5. getsentry/jest-sentry-environment; 6. getsentry/json-schema-diff; 7. getsentry/js-source-scopes; 8. getsentry/objectstore/clients; 9. getsentry/ophio; 10. getsentry/pdb; 11. getsentry/pyo3-python-tracing-subscriber; 12. getsentry/pytest-sentry; 13. getsentry/relay/py; 14. getsentry/responses; 15. getsentry/rust-proguard; 16. getsentry/rust-sourcemap; 17. getsentry/rust-usage-accountant; 18. getsentry/script-runner; 19. getsentry/sentry-api-schema; 20. getsentry/sentry-forked-djangorestframework-stubs; 21. getsentry/sentry-forked-django-stubs; 22. getsentry/sentry-forked-jsonnet; 23. getsentry/sentry-infra-tools; 24. getsentry/sentry-kafka-management; 25. getsentry/sentry-kafka-schemas; 26. getsentry/sentry-protos; 27. getsentry/sentry-redis-tools; 28. getsentry/service-registry; 29. getsentry/skrooge; 30. getsentry/snuba-sdk; 31. getsentry/statsdproxy; 32. getsentry/status-page-list; 33. getsentry/streams/sentry_streams; 34. getsentry/symbolic; 35. getsentry/taskbroker/clients; 36. getsentry/usage-accountant; 37. getsentry/watto; 38. getsentry/sentry; 39. getsentry/snuba; 40. getsentry/vroom; 41. getsentry/relay; 42. getsentry/symbolicator; 43. getsentry/taskbroker; 44. getsentry/uptime-checker; 45. getsentry/launchpad; 46. getsentry/self-hosted.
• 🟡 (13:24) A shell expression involving $(printf injected >&2) failed with bash: line 1: $(printf injected >&2): syntax error: operand expected.
• 🟡 (13:28) src/publish/inputs.js imports @actions/github, @actions/core, and detailsFromContext from ../modules/details-from-context; async inputs() calls detailsFromContext({ context: github.context }), then writes the result with core.setOutput("result", result), and is invoked immediately.
• 🟡 (13:29) Search found 65 relevant matches across approval-attestation tests, src/modules/process-end-state.js, src/modules/post-workflow-details.js, their tests, .github/workflows/publish.yml, and .github/workflows/ci-poller.yml; the workflow files use gh issue comment and set APPROVAL_ATTESTATION_AUTHOR / APPROVAL_ATTESTATION_AUTHOR="github-actions[bot]", while tests model attestations authored by github-actions[bot].
• 🟡 (13:33) src/modules/post-workflow-details.js exports async postWorkflowDetails({ context, octokit }): it extracts publishRepo and run_id from context.repo / context.runId, gets issue_number from context.payload.issue.number, fetches the workflow run via octokit.rest.actions.getWorkflowRun({ ...publishRepo, run_id }), then posts Publishing: [run#${run_id}](${workflowInfo.html_url}) through octokit.rest.issues.createComment({ ...publishRepo, issue_number, body }).
• 🟡 (13:33) Assistant release-gate review found a MUST-FIX / DO-NOT-MERGE issue: early failures in .github/workflows/publish.yml before Parse and set inputs—specifically setup or dependency installation at lines 221-233—leave steps.inputs.outputs.result empty. The failure handler at lines 383-388 passes empty PUBLISH_ARGS; src/publish/update-issue.js:7 parses it and throws before calling updateIssue, preventing src/modules/update-issue.js:67-74 from removing accepted. The issue can retain both accepted and ci-ready; a rerun can validate old attestations and publish without fresh acceptance, violating invariant 5. Assistant recommended a regression test for failures before Parse and set inputs and cleanup independent of parsed publish inputs.
• 🟡 (13:33) Assistant review PASS finding: authorization permits only write, maintain, and admin repository roles (src/modules/approval-authorizer.js:1,28-34) and looks up permissions for the repository parsed from the release title (src/modules/approval-authorizer.js:17-18,28-32). The bot exception permits only getsantry[bot] on an exact allowlisted release path (src/modules/approval-authorizer.js:2,20-25; src/publish/authorize-approval.js:8-15); authorization failures remove accepted and stop the job (.github/workflows/publish.yml:93-111).
• 🟡 (13:33) Assistant review PASS finding: CI remains bound to the title and accepted event. .github/workflows/ci-poller.yml snapshots the current accepted event before CI (:100-116), then checks live title plus exact event ID before CI, after CI, before proof creation, and immediately before ci-ready (:117-131,253-267,274-289,316-333). src/modules/approval-attestation.js:11-16,19-25 binds actor, event ID, and title; src/publish/validate-approval-attestation.js:71-99 validates both current approval and CI-ready proofs against live current events; re-approval tests cover this in src/publish/__tests__/record-ci-ready-attestation.js:63-89 and src/publish/__tests__/validate-approval-attestation.js:177-220.
• 🟡 (13:33) Assistant review PASS finding: manually applied ci-ready labels cannot publish. The CI-ready proof records the authenticated internal-app actor (src/publish/record-ci-ready-attestation.js:39-57), and publishing requires this actor to equal the actual ci-ready label actor (src/modules/approval-attestation.js:146-166; src/publish/validate-approval-attestation.js:89-99). Manually added labels fail this validation (src/publish/__tests__/validate-approval-attestation.js:283-342), and the workflow removes accepted before publishing (.github/workflows/publish.yml:196-219).
• 🟡 (13:33) Assistant review PASS finding: manual poller recovery remains available because workflow_dispatch is still defined and bypasses the pending-variable gate (.github/workflows/ci-poller.yml:3-11,21-24).
• 🟡 (13:33) Assistant verification reported yarn test passing 50 tests; reviewed files passing ESLint; and full yarn lint still blocked only by unrelated .github/workflows/cocoapods-keepalive.yml:1.