Dashboard › publish › Distillation
2b2f039d-363d-4145-9329-11b2701193e8["lore_tm_v1_efKFTWkY9VZOAPS0b7w6Z37RXFJUu9_r_pcojrqNj0s","lore_tm_v1_Xd47LeUXrXGATmmodVjF8ohsLZvqfao2JyV6r9HCbsI","lore_tm_v1_MkM3fMIvMb_wvFI6RAhBQCl0X6VKol1Yv62jeWi32OY","lore_tm_v1__yYRyyUS3ktjd0ypjVd8npf_WPoK65ATLvQIagIlYt8","lore_tm_v1_UYsQs3RiTbfW5TUGUN3jcn15XHILl2_snkOEeuIcC1Y","lore_tm_v1_YZyNSXie_-iW_5jDeIGsTjiGI5clpdTMYdsw5e_A7k4","lore_tm_v1_XOW8Ho-TqBixnRGymTxCcAwnfHYrcA3JYgMPC4GUh00","lore_tm_v1_d5zqTrBZXdJGQztqUhXnkZPDi8pB-RcEGb1K4QplU9c","lore_tm_v1_fuveKZUPC6JIaRE0Wukj03fXDbDrXc7OuWX8HcZRg_g"]
/home/byk/Code/getsentry/publish/src/publish/__tests__/ci-poller-workflow.js is 75 lines and tests CI poller workflow trust boundaries, the protected manual-dispatch relay, dispatch-attempt validation, and request-snapshot binding."Get publish code" to use a 40-character pinned actions/checkout revision with ref: ${{ github.event.repository.default_branch }} and to occur before "Get auth token"..github/workflows/ci-poller.yml accepts repository_dispatch type [ci-poller] and successful workflow_run events for workflow [Run CI Status Poller] only when github.event.workflow_run.head_branch == github.event.repository.default_branch; it must not expose workflow_dispatch:..github/workflows/ci-poller-dispatch.yml is the manual relay and must contain workflow_dispatch:, permissions: {}, and environment: production, while containing neither secrets. nor repository_dispatch:."Get auth token" and accept decimal strings "0" through "59" while rejecting "", "00", "01", "60", "-1", "1x", and "$(id)"; the workflow sets ATTEMPT: ${{ github.event_name == 'repository_dispatch' && steps.dispatch-attempt.outputs.value || '0' }}, increments with attempt=$((10#$ATTEMPT + 1)), and dispatches via gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input -.request_digest=$(echo "$publish_input" | jq -r '.requestDigest') and contains exactly 4 EXPECTED_REQUEST_DIGEST="$request_digest" assignments./home/byk/Code/getsentry/publish/src/modules/__tests__/publish-workflow.js is 170 lines and executes the "Set targets" shell script extracted from .github/workflows/publish.yml, using temporary directories and CRAFT_PUBLISH_PATH, CRAFT_PUBLISH_REPO, CRAFT_PUBLISH_TARGETS_JSON, CRAFT_PUBLISH_VERSION, CRAFT_PUBLISH_WORKSPACE, GITHUB_OUTPUT, and GITHUB_WORKSPACE."Resolve CI-approved release revision", 2. "Inform start", 3. "Check out target repo", 4. "Resolve publish location", 5. "Set targets", 6. "Publish using Craft".ref: ${{ steps.release-revision.outputs.revision }}; contains exactly 2 references to actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1; runs node .__publish__/src/publish/discover-location.js; sets PUBLISH_REPOSITORY_DIRECTORY: __repo__; and uses docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b.CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.location.outputs.result).path }} and CRAFT_PUBLISH_WORKSPACE: ${{ fromJSON(steps.location.outputs.result).workspace || '' }}; Craft runs craft publish ${{ fromJSON(steps.inputs.outputs.result).version }} --rev ${{ steps.release-revision.outputs.revision }}."ci-ready" label event when the issue contains both "accepted" and "ci-ready" and contains neither "ci-pending" nor "ci-failed".{ path: ".", repo: "sentry", version: "21.3.1" }, the Set targets script creates a state filename matching .craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json with JSON { published: { github: true } }."packages/cli" resolved from "./packages/cli" in repository "toolkit" at version "1.2.3", the Set targets script creates a filename matching .craft-state/craft/publish-state-getsentry-toolkit-c232c383e26f-workspace-cGFja2FnZXMvY2xp-1.2.3.json with JSON { published: { github: true } }."4.2.6+sentry1" ends with -version-NC4yLjYrc2VudHJ5MQ.json, while "4.2.6+Sentry1" ends with -version-NC4yLjYrU2VudHJ5MQ.json; the two state paths must differ./home/byk/Code/getsentry/publish/src/publish/__tests__/publish-workflow.js is 116 lines and tests triggering-snapshot binding, immediate pre-Craft approval revalidation, immutable Craft pinning, independent poller activation, authorization reconciliation, and terminal reporting.node src/publish/request-digest-from-event.js and contains exactly 4 EXPECTED_REQUEST_DIGEST: ${{ steps.request-digest.outputs.request_digest }} references."Revalidate approval attestation" must occur after "Set targets" and before "Publish using Craft" and must include REQUIRE_CI_READY_ATTESTATION: "true".docker://getsentry/craft@sha256: followed by exactly 64 lowercase hexadecimal characters.waiting-for-ci job, required ordering is: 1. "Mark ci-pending", 2. "Trigger CI poller", 3. "Comment on issue", 4. "Enable cron poller", 5. "Revoke stranded approval"; the trigger, comment, and enable steps each use continue-on-error: true."Revoke stranded approval" runs when both steps.trigger-poller.outcome != 'success' and steps.enable-poller.outcome != 'success', removing both "ci-pending" and "accepted"."Publish using Craft", the workflow performs "Reconcile publish issue", then "Report publish result", then "Verify publish issue reconciliation"; both reconciliation sections use if: always(), inspect ${{ steps.publish.outcome }}, remove "accepted", "ci-pending", and "ci-ready", close the issue with --state closed, and must not invoke node."Report publish result" step. It always maps Craft outcomes as success) status=success ;;, cancelled) status=cancelled ;;, and *) status=failure ;;, then runs node .__publish__/src/publish/post-result.js "$status"; it does not use cancelled()./home/byk/Code/getsentry/publish/src/publish/__tests__/workflow-action-pinning.js is 76 lines and scans every .yml file under .github/workflows; every actions/...@revision reference must use exactly 40 lowercase hexadecimal characters.environment: production are .github/workflows/auto-approve.yml job "auto-approve", .github/workflows/ci-poller.yml job "check-ci", .github/workflows/cocoapods-keepalive.yml job "keepalive", and .github/workflows/publish.yml jobs "waiting-for-ci" and "publish"..github/workflows/ci-poller-dispatch.yml is prohibited from containing workflow_dispatch:; the relay itself must contain workflow_dispatch:, permissions: {}, and environment: production, and must not contain secrets../home/byk/Code/getsentry/publish/src/publish/__tests__/post-result.js is 34 lines. main() must still call report with an object containing { inputs: {}, status: "failure" } when PUBLISH_ARGS is absent or equals "not-json"./home/byk/Code/getsentry/publish/src/libs/__tests__/github.js is 19 lines. getGitHubToken() throws No "GITHUB_TOKEN" environment variable found. when GITHUB_TOKEN is absent and returns the exact environment value when present, as tested with "Example Token"./home/byk/Code/getsentry/publish/src/modules/__tests__/ci-poller-input.js is 105 lines. Its fixture uses revision 7e5ca7ed5581552de066e2a8bc295b8306be38ac, labels "accepted" and "dry-run", requester @byk, merge target "(default)", and toolkit comparison/check-runs links.getCiPollerInput() resolves both root-style title "publish: getsentry/toolkit/cli@1.2.3" and full-path title "publish: toolkit/packages/cli/v2@1.2.3" to { repo: "getsentry/toolkit", revision: "7e5ca7ed5581552de066e2a8bc295b8306be38ac", version: "1.2.3" }, with requestDigest computed from the exact body, labels, and respective title.path: .__publish__ and running node .__publish__/src/publish/resolve-ci-poller-input.js; it must not retain the prior grep -oP '(?<=commit/ parsing approach.getCiPollerInput() rejects repository identities "-toolkit", ".", "..", and "__proto__" with Invalid publish issue repository before CI API calls.getCiPollerInput() rejects versions "--config" and "1.2" with Invalid publish issue version before CI API calls.getCiPollerInput() rejects malformed titles "publish: getsentry/@1.2.3" and "publish: getsentry/toolkit$@1.2.3" with Invalid publish issue title.getCiPollerInput() rejects unsafe paths in "publish: getsentry/toolkit/../other@1.2.3", "publish: getsentry/toolkit/./other@1.2.3", "publish: getsentry/toolkit/__proto__/other@1.2.3", and "publish: getsentry/toolkit/--config@1.2.3" with Invalid publish issue path before CI API calls.