Dashboard › craft › Distillation
2a909d3d-6c84-4aa9-aa6e-5e9a73793e38["lore_tm_v1__mxAFJMohkPIxkxxoNk6tHU3QxRvt-JGAGk4X_EFv4k","lore_tm_v1_cxOXPBrCYj0fa7eERcUf5uMe39HzVGk-k9Q6dI_zyR4","lore_tm_v1_Rtc8aNxdSoPAlaWSgmk07BWEqp-KiqaMkf-IEqK2pZs","lore_tm_v1_c5kgV7ycZwd0x70Epy9iybZFwAyWKL3tgzbCbX1bCww","lore_tm_v1_BDCV7gtVuEZatmEzVdHj7jSyvm87X8OYBnkNylVvldU","lore_tm_v1_EIauCPMEm9rR9ieB6qMjZko9peBe1lfiJZDQO8q7qus","lore_tm_v1_Dxgz0wEcyDRPK8TfAOQcdVZ0gbBU_dgj2xP3ZmWac-s","lore_tm_v1_MmcYffMKoqFjXmE4FoUK2YY_8k3MpXHR0HWcKP1rMSk","lore_tm_v1_NhtpQeQ7jWJzJuaWrosDIaB_z-rZ1Of5gJx-1a21fRw"]
Date: Sep 8, 2026
src/publish/resolve-ci-poller-input.js:8 using PUBLISH_REVISION, src/modules/ci-poller-input.js:4,34 importing/calling updateReleaseRevision, src/modules/release-revision.js:34,39 defining/exporting it, and its test at src/modules/__tests__/release-revision.js:5,132; checkout action versions were actions/checkout@v6 in .github/workflows/test.yml:19 and .github/workflows/publish.yml:120,159, actions/checkout@v7 in .github/workflows/ci-poller.yml:52, and actions/checkout@v4 in .github/workflows/auto-approve.yml:16..github/workflows/ci-poller.yml:145 invokes src/publish/resolve-ci-poller-input.js with PUBLISH_ISSUE_BODY="$body", PUBLISH_REVISION="$sha", and PUBLISH_TITLE="$title" to produce updated_body.ReleaseRevision and CheckRunsLinkCount parser start rules in src/modules/publish-issue-title.js:199-200, with implementations at lines 748 and 1093.src/modules/publish-issue-title.js constants for title grammar: "publish: ", "getsentry/", "@", "/", "Requested by: @", "Merge target: ", "Quick links:", view-changes and view-check-runs Markdown link prefixes, "/commit/", "/checks", and both "\r\n" and "\n" newline tokens. Repository characters match [A-Za-z0-9_.-], version characters match [A-Za-z0-9_.+-], and check-runs revisions match lowercase [0-9a-f].peg$parseReleaseRevision() parses a RequestHeader then consumes remaining body input; peg$parseRequestHeader() requires Requested by: @…, Merge target: …, Quick links:, a View changes link, and a https://github.com/getsentry/<repository>/commit/<revision>/checks View check-runs link, allowing an optional terminal / before ). peg$parseCheckRunsRevision() requires one or more lowercase hexadecimal characters and applies semantic predicates/actions; peg$parseCheckRunsLinkCount() iterates check-runs links through input.attacker-branch.{"merge_target":"attacker-branch","revision":"7e5ca7ed5581552de066e2a8bc295b8306be38ac"} from a valid canonical header followed by a decoy Merge target: attacker-branch; audit concluded canonical revision remained bound but independently parsed decoy merge target controlled the result.true..github/workflows/ci-poller.yml, .github/workflows/publish.yml, docs/publish-issue-format.md, scripts/generate-publish-issue-title-parser.js, src/modules/__tests__/publish-workflow.js, src/modules/__tests__/release-revision.js, src/modules/publish-issue-title.js, src/modules/publish-issue-title.peggy, src/modules/release-revision.js, src/publish/inputs.js, src/publish/resolve-location.js, and src/publish/resolve-release-revision.js; untracked paths: src/modules/__tests__/generate-publish-issue-title-parser.js, src/publish/__tests__/, and src/publish/discover-location.js. Tool output reported 26.origin/main at 83d210b; current HEAD was a81ab03 with uncommitted changes. Audit reviewed 26 tracked diff paths and all untracked paths. git diff --check origin/main and node scripts/generate-publish-issue-title-parser.js --check both passed.Merge target is not bound to the body-start header. src/modules/publish-issue-title.peggy:42-47 requires but discards that header’s merge target; src/modules/details-from-context.js:53-59 reads the first syntactically valid Merge target: anywhere in the body; .github/workflows/publish.yml:247 passes that independently parsed value to Craft. Recommended extracting and validating merge target only from the canonical parsed header.src/modules/release-revision.js:34-36 validates the existing link but inserts supplied revision without validation; src/modules/ci-poller-input.js:33-35 forwards PUBLISH_REVISION. Reproduction: updateReleaseRevision(..., revision: "not-a-sha") returns a body containing /commit/not-a-sha/checks/. Recommended requiring exactly 40 lowercase hexadecimal characters before update..github/workflows/ci-poller.yml:98,145-147 capture bodies with command substitution and jq -r; Bash command substitution removes all trailing newlines, so branch-move updates rewrite trailing body whitespace. Recommended preserving all bytes outside the revision span, including trailing newlines..github/workflows/publish.yml:120,159 still use actions/checkout@v6 rather than requested actions/checkout@v7; related CI poller uses v7 at .github/workflows/ci-poller.yml:52..github/workflows/cocoapods-keepalive.yml:17 updates runner to macos-15; audit judged it unrelated to workspace publish acceptance and recommended removal from diff.publish-issue-title.peggy:38-62, but merge-target authority and replacement-revision validation fail; (2) PASS—Peggy is source of title parser and documentation markers fail closed in scripts/generate-publish-issue-title-parser.js:26-38, with regression coverage src/modules/__tests__/generate-publish-issue-title-parser.js:7-14; (3) PASS—missing root config falls back to checkout paths at discover-location.js:14-16, while blank/malformed/non-array/unsafe lists fail closed at discover-location.js:33-42 and publish-location.js:6-10; (4) FAIL—CI revision checkout precedes discovery and discovery/state handling fail closed, but publish checkout actions remain v6; (5) PASS—outputs use explicit JSON serialization and empty PUBLISH_ARGS falls back to contextual validation errors at inputs.js:9, resolve-location.js:5-22, and resolve-release-revision.js:5-16; (6) FAIL—generated artifacts current, but no tests cover merge-target decoy, invalid replacement revision, trailing-newline preservation, or checkout v7; (7) FAIL—no whitespace errors, but CocoaPods runner update is unrelated churn.DO-NOT-MERGE.