Dashboard › publish › Distillation
2e9756d1-1047-4ab0-a7fb-40565daf30b9["lore_tm_v1_zCirGFxo2SRkTB18KvttWwteXnZzQsoIAkK-ct8AvZY","lore_tm_v1_-scOsqy7ivGoXUxYImQSrTbXEbhJe0FN-24X915dUt8","lore_tm_v1_trJslXTzc0i000XkpEj_RQ7al_a-KIcSEcMRRbQNyRU","lore_tm_v1_ApVi5XIaayr7zEKzU9xGjfb4pi4phCvprp42LaaWqgg","lore_tm_v1_Zo0Q7gus6XhJI_vbjU-Tnd06Zd5d_Pn0K2gxmPJ_rpw","lore_tm_v1_k6AZMicFW5oveumRs9wManSXsZOxa-SEBprSscEp2dY","lore_tm_v1_jR5aPLpzjbleLzuZeCC5OSeLlJQk8E7tOE5m_3aAJqQ"]
src/publish/__tests__/validate-approval-attestation.js:15-24 defines jsonResponse(json) as an OK mocked JSON response and issue(title, { body = "", labels = [{ name: "accepted" }], state = "open" } = {}) as the publish-issue fixture.src/publish/__tests__/validate-approval-attestation.js:27-62 verifies validateApprovalAttestation() accepts the current accepted event ID "100" by actor contractor when its approval attestation is authored by github-actions[bot].src/publish/__tests__/validate-approval-attestation.js:64-101 verifies an attestation for publish: getsentry/sentry-javascript@10.0.0 is rejected after the current title changes to publish: getsentry/sentry-python@10.0.0.src/publish/__tests__/validate-approval-attestation.js:103-140 verifies an attestation is rejected after the issue body changes from empty to Merge target: main\n\n- [ ] npm.src/publish/__tests__/validate-approval-attestation.js:142-177 verifies an attestation is rejected when the current issue no longer has the accepted label.src/publish/__tests__/validate-approval-attestation.js:179-214 verifies an attestation is rejected after the issue state changes from open to closed.src/publish/__tests__/validate-approval-attestation.js:216-257 verifies an attestation bound to accepted-label event "100" is rejected after accepted is re-added in event "200".src/publish/__tests__/validate-approval-attestation.js:259-301 verifies a later attestation for event "200" is rejected when expectedAcceptedEvent is { actor: "contractor", eventId: "100" }.src/publish/__tests__/validate-approval-attestation.js:303-360 verifies requireCiReadyAttestation: true succeeds when the issue has both accepted and ci-ready, approval event "100" belongs to contractor, the ci-ready label event belongs to sentry-internal-app[bot], and both attestations are posted by github-actions[bot].src/publish/__tests__/validate-approval-attestation.js:362-419 verifies requireCiReadyAttestation: true rejects a manually added ci-ready label whose event actor is contractor, even when a CI-ready attestation claims sentry-internal-app[bot].src/publish/__tests__/auto-approval-workflow.js:7-14 verifies .github/workflows/auto-approve.yml runs node src/publish/record-auto-approval-attestation.js before --add-label accepted.src/publish/__tests__/auto-approval-workflow.js:16-26 verifies the automated approval proof uses GH_TOKEN: ${{ github.token }} before labeling and that the later label operation uses GH_TOKEN: ${{ steps.token.outputs.token }}, ensuring the proof is posted as github-actions before the internal App labels the issue.src/publish/__tests__/ci-poller-workflow.js:4-8 loads .github/workflows/ci-poller.yml and the manual relay .github/workflows/ci-poller-dispatch.yml.src/publish/__tests__/ci-poller-workflow.js:11-19 verifies ci-poller.yml checks out trusted code at ${{ github.event.repository.default_branch }} using a 40-character pinned actions/checkout revision before the Get auth token step.src/publish/__tests__/ci-poller-workflow.js:21-38 verifies manual CI-poller recovery uses a protected relay: ci-poller.yml accepts repository_dispatch type [ci-poller], reacts to successful workflow_run events for Run CI Status Poller only when head_branch is the repository default branch, and contains no workflow_dispatch; .github/workflows/ci-poller-dispatch.yml contains workflow_dispatch, permissions: {}, and environment: production, but no secrets. or repository_dispatch.src/publish/__tests__/ci-poller-workflow.js:40-55 verifies repository-dispatch attempt validation appears before Get auth token, requires ATTEMPT to match ^(0|[1-5][0-9])$, defaults non-dispatch attempts to '0', increments with attempt=$((10#$ATTEMPT + 1)), and retries through gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input -.src/publish/__tests__/publish-workflow.js:7-15 verifies .github/workflows/publish.yml places Revalidate approval attestation after Set targets and immediately before Publish using Craft, with REQUIRE_CI_READY_ATTESTATION: "true".src/publish/__tests__/publish-workflow.js:17-21 verifies Craft is pinned to an immutable reference matching docker://getsentry/craft@sha256: plus exactly 64 lowercase hexadecimal characters.src/publish/__tests__/workflow-action-pinning.js:4-16 enumerates every .yml file under .github/workflows; SECRET_BEARING_JOBS maps .github/workflows/auto-approve.yml → auto-approve, .github/workflows/ci-poller.yml → check-ci, .github/workflows/cocoapods-keepalive.yml → keepalive, and .github/workflows/publish.yml → waiting-for-ci and publish.src/publish/__tests__/workflow-action-pinning.js:18-28 defines jobContents(workflow, jobName) to isolate a named YAML job from its ${jobName}: header through the next top-level two-space key.src/publish/__tests__/workflow-action-pinning.js:31-39 verifies every actions/* reference in every workflow is pinned to exactly a 40-character lowercase hexadecimal revision.src/publish/__tests__/workflow-action-pinning.js:41-50 verifies no workflow except .github/workflows/ci-poller-dispatch.yml contains workflow_dispatch:.src/publish/__tests__/workflow-action-pinning.js:52-63 verifies every job listed in SECRET_BEARING_JOBS contains environment: production.src/publish/__tests__/workflow-action-pinning.js:65-75 verifies .github/workflows/ci-poller-dispatch.yml is the sole protected manual-dispatch relay and contains workflow_dispatch:, permissions: {}, and environment: production, while containing no secrets...github/workflows/publish.yml uses actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 at lines 36, 192, and 274; actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 at lines 42, 52, 149, and 268; actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 at line 223; and docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b at line 353..github/workflows/ci-poller.yml uses actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 at line 49 and actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 at lines 60, 71, and 420..github/workflows/auto-approve.yml uses actions/checkout@11d5960a326750d5838078e36cf38b85af677262 at line 18 and actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 at line 24..github/workflows/test.yml uses actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 at line 19, actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 at line 20, and actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 at line 23.src/publish/__tests__/record-auto-approval-attestation.js:11-35 verifies recordAutoApprovalAttestation() binds automated requester getsantry[bot] to the live open request publish: getsentry/sentry-javascript@10.0.0, issue "123", repository getsentry/publish, body Merge target: main, and returns an attestation parsed as { autoApprover: "getsantry[bot]", requestDigest: expect.any(String), title }.src/publish/__tests__/record-auto-approval-attestation.js:37-53 verifies recordAutoApprovalAttestation() rejects with exact error The automated approval request changed before approval when the expected auto-approver is getsantry[bot] but the live issue author is contractor.