Distillation

Date: Aug 27, 2026

• 🟡 (20:55) src/publish/authorize-approval.js reads auto-approve-repos.txt synchronously as UTF-8, splits on /\r?\n/, filters blank lines, and returns a Set via getAutoApprovedRepositories().
• 🟡 (20:55) src/publish/authorize-approval.js GitHub API helper getGitHubResponse(path) calls fetch("https://api.github.com/${path}") with Accept: "application/vnd.github+json", Authorization: Bearer ${process.env.APPROVAL_TOKEN}, and X-GitHub-Api-Version: "2026-03-10".
• 🟡 (20:55) getPermission({ owner, repository, username }) in src/publish/authorize-approval.js requests repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/collaborators/${encodeURIComponent(username)}/permission; on a non-OK response it throws Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ${response.status}, otherwise returns response.json().
• 🟡 (20:55) getIssue({ repository, issueNumber }) in src/publish/authorize-approval.js requests repos/${repository}/issues/${issueNumber} and throws Could not retrieve issue #${issueNumber}: GitHub returned ${response.status} on non-OK responses.
• 🟡 (20:55) getIssueEvents({ repository, issueNumber }) in src/publish/authorize-approval.js paginates repos/${repository}/issues/${issueNumber}/events?per_page=100&page=${page}, appends all page events, and stops only when a response page contains fewer than 100 events; a failed request throws Could not retrieve events for issue #${issueNumber}: GitHub returned ${response.status}.
• 🟡 (20:55) main() in src/publish/authorize-approval.js requires environment variables GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY, throwing explicit No "... " environment variable found errors when absent.
• 🟡 (20:55) Approval flow in src/publish/authorize-approval.js: calls authorizeApproval({ actor: process.env.APPROVAL_ACTOR, issueTitle: process.env.APPROVAL_ISSUE_TITLE, getPermission, autoApprovedRepositories: getAutoApprovedRepositories() }); if unauthorized, appends authorized=false\n to GITHUB_OUTPUT and returns.
• 🟡 (20:55) After initial authorization, src/publish/authorize-approval.js concurrently fetches the current issue and all issue events with Promise.all, derives the latest accepted-label event via currentAcceptedEvent(events), and denies approval (authorized=false\n) if the fetched issue title differs from APPROVAL_ISSUE_TITLE, no eligible accepted event exists, or that event’s actor differs from APPROVAL_ACTOR.
• 🟡 (20:55) On validated approval, src/publish/authorize-approval.js creates an attestation with createApprovalAttestation({ actor: event.actor, eventId: event.eventId, title }) and appends exactly authorized=true\napproval_attestation=${attestation}\n to GITHUB_OUTPUT; direct execution invokes main() and logs errors before setting process.exitCode = 1.