Distillation

🔴 (15:56) [requested-review] User requested a substantive, independent adversarial correctness and security review of the exact current worktree at /home/byk/Code/getsentry/publish, covering the full integrated diff against origin/main, including every changed/untracked source, test, workflow, and relevant documentation file. 🔴 (15:56) User required the review to be READ ONLY: do not edit files, run formatters, or otherwise mutate the worktree. 🔴 (15:56) User directed special review attention to: approval provenance; latest label/unlabel event semantics; malformed event IDs; request-digest/event-snapshot binding; auto-approval identity; CI-poller trusted-code and secret boundaries; branch/check-suite API error handling; revision movement; ci-ready remove/revalidate/re-add behavior and failed-add recovery; publication privilege fences; immutable pins; organization/project scoping where applicable; shell injection; race/TOCTOU behavior; and fail-open paths. 🔴 (15:56) User stated GitHub event data and issue content must be treated as attacker-controlled. 🔴 (15:56) User stated the exact worktree had passed generated verification, 192 tests, lint, whitespace checks, and 10 focused stability runs, while directing that tests not be relied upon alone. 🔴 (15:56) User required a substantive report with current file:line evidence, classifying every point as PASS, CONCERN, or MUST-FIX. 🔴 (15:56) User required that if tooling or scope blocks the review, the response begin with BLOCKED and identify the exact blocker. 🔴 (15:56) User required the review response to end with exactly MERGE or DO-NOT-MERGE. 🔴 (15:56) User stated: “Never return an empty response.” 🔴 (15:57) Repository /home/byk/Code/getsentry/publish contains .eslintrc.js, .git/, .github/, .gitignore, .lore.md, AGENTS.md, auto-approve-repos.txt, docs/, LICENSE, node_modules/, package.json, README.md, scripts/, src/, vitest.config.js, and yarn.lock. 🔴 (15:57) Git status showed branch main...origin/main with modified tracked files and 23 untracked files; the displayed revision was 7c60ddb7f43040fe8fbfea70efc833f689c04e75. 🔴 (15:57) Modified workflow/documentation files included .github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, docs/key_rotation_vault_changes.md, and docs/rfc.md. 🔴 (15:57) Modified library/module files included src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/ci-poller-input.js, src/modules/__tests__/ci-poller-workflow.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/process-end-state.js, src/modules/__tests__/publish-location.js, src/modules/__tests__/publish-workflow.js, src/modules/__tests__/release-revision.js, src/modules/__tests__/update-issue.js, src/modules/ci-poller-input.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/publish-location.js, src/modules/release-revision.js, and src/modules/update-issue.js. 🔴 (15:57) Modified publish files included src/publish/__tests__/discover-location.js, src/publish/__tests__/resolve-release-revision.js, src/publish/discover-location.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, src/publish/resolve-ci-poller-input.js, and src/publish/update-issue.js. 🔴 (15:57) Untracked files were .github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/authorize-approval.js, src/publish/__tests__/auto-approval-workflow.js, src/publish/__tests__/ci-poller-workflow.js, src/publish/__tests__/current-accepted-event.js, src/publish/__tests__/post-result.js, src/publish/__tests__/publish-workflow.js, src/publish/__tests__/record-auto-approval-attestation.js, src/publish/__tests__/record-ci-ready-attestation.js, src/publish/__tests__/request-digest-from-event.js, src/publish/__tests__/validate-approval-attestation.js, src/publish/__tests__/workflow-action-pinning.js, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, src/publish/request-digest-from-event.js, and src/publish/validate-approval-attestation.js. 🔴 (15:57) SHA-256 hashes supplied for untracked production artifacts were: .github/workflows/ci-poller-dispatch.yml=570dcb023ae08f4fb8338923496a55bf1c2e012a944f9969650bc31feadd485c; .lore.md=7a8b139f81784011cc5b0d2f217ded95b981897e1fd4fce52c43774074dba988; src/modules/approval-attestation.js=9051b3a78e4ceb1ef079c599abf9550d03ba8527ca8bbf229631c38f65375b29; src/modules/approval-authorizer.js=c9ca690c7ca173c6cdc973e511dadb5479ff10cd958f9b0c4f10f83017e6ec55; src/publish/authorize-approval.js=98e714ef8884479883e63861602e251b2bead1c788b418f88000062662990209; src/publish/current-accepted-event.js=89327251626058674db523d8e541475bb9bf94cce2359adba06a85f99e359895; src/publish/record-auto-approval-attestation.js=53638e4f38677b512e137138947cb0b69dc82cdaf5612a52a057fc4f2ac4eca3; src/publish/record-ci-ready-attestation.js=8074dcf0e10d42dd61384f961b034c435124b3ae80b786c4a532c1ac27af5520; src/publish/request-digest-from-event.js=05407b089f33e1e47f785947b5e6a3d9370ef18e9a07aba557d02f6c62cea963; src/publish/validate-approval-attestation.js=fb98216f91686bba02532bd1683e508fcede08780cea99eeabf7ed699cf3afcb. 🔴 (15:57) SHA-256 hashes supplied for untracked tests were: src/modules/__tests__/approval-attestation.js=11a45a2ff4688586212aef5605db4c31d8d5a1d34735f2a5b7c1bf6bcbdd2a9b; src/modules/__tests__/approval-authorizer.js=c6f64660b2fa5339b7b7936608ce90455518d5445c0ce3ff0298f1035e48a407; src/publish/__tests__/authorize-approval.js=2a3811d65fb26ad2adc525c5b9b71783b0f3f98f31e6a53e8797eb8b79001075; src/publish/__tests__/auto-approval-workflow.js=7289831b54001c7cfad1943fb2450dc72aa985b4b0d6649b4bef9c3f89024394; src/publish/__tests__/ci-poller-workflow.js=36bd42e78c482a323d65d0283c1782e4d2291cd10252ad1a165e93bc2ff7c37a; src/publish/__tests__/current-accepted-event.js=bf5e5eddd6ab87e0caf1497bda6f8948e1b403ccc543319966de949b85b1e545; src/publish/__tests__/post-result.js=4d848e0402720f2033648a29cafe577c4ce58cf118edd46e2dc1cacdaaa504a5; src/publish/__tests__/publish-workflow.js=9e5b721275486492dcf80bc615df5825db590bc8659ce741e820acd8683c587e; src/publish/__tests__/record-auto-approval-attestation.js=d789425ae4a8aa9edb6160dab83a96ab2f1667f665765b822029deb66fa57fcd; src/publish/__tests__/record-ci-ready-attestation.js=685f3fbd2a5c1876f4ace2c30f608a6726793076dddd567d585a7a74fac7fc2c; src/publish/__tests__/request-digest-from-event.js=949635b3517b985c27c8e1c7883951a9f50edf45626088cb970e86ec20a30c62; src/publish/__tests__/validate-approval-attestation.js=4da80bdcb69818b02bd30fb418c705f435bc13267a38f16e1689efe598e67e77; src/publish/__tests__/workflow-action-pinning.js=f81aaf26af172b638b9ff9ef7c2eec036f0833dbe87d0b46c7e36c0c552c6e9a. 🔴 (15:58) The tracked integrated diff comprised 34 files, 1,064 insertions, and 243 deletions; major changes included .github/workflows/ci-poller.yml (+267-line-scale change), .github/workflows/publish.yml (+272-line-scale change), and src/modules/__tests__/ci-poller-workflow.js (+252-line-scale change). 🔴 (15:58) Repository conventions in AGENTS.md: pure JavaScript using CommonJS for source, ES Modules for tests, Node.js 24.0.0, Yarn 1.22.22 classic, and “Do NOT use npm.” 🔴 (15:58) Repository commands are yarn install, yarn test, yarn test:watch, yarn test src/modules/__tests__/update-issue.js, yarn test -t "pattern", yarn lint, and yarn prettier. 🔴 (15:58) Repository file/style conventions: kebab-case filenames; tests under __tests__/; camelCase variables/functions; UPPER_SNAKE_CASE constants/regex patterns; import order is Node.js built-ins, external packages, then local modules; Prettier defaults, double-quoted strings, and required semicolons. 🔴 (15:58) User stated: “Always throw for unexpected values,” including unknown switch cases rather than silently accepting them. 🔴 (15:58) package.json identifies package publish version 0.0.1, repository git@github.com:getsentry/publish.git, Node 24.0.0, Yarn 1.22.22, undici resolution ^6.23.0, Vitest ^4.1.0, @actions/core ^2.0.0, @actions/github ^7.0.0, and @sentry/node ^10.0.0. 🔴 (15:58) package.json scripts are generate=node scripts/generate-publish-issue-title-parser.js, check:generated=node scripts/generate-publish-issue-title-parser.js --check, test=yarn check:generated && vitest run, test:watch=vitest, lint=eslint src .github --ignore-pattern '!.github', and prettier=prettier --write src. 🔴 (16:00) .github/workflows/auto-approve.yml triggers on newly opened issues, grants contents: read and issues: write, runs in the production environment, and only enters the job when the actor is sentry-release-bot[bot] or getsantry[bot] and the issue title starts with publish: . 🔴 (16:00) .github/workflows/auto-approve.yml pins actions/checkout to 11d5960a326750d5838078e36cf38b85af677262 with persist-credentials: false, and pins actions/create-github-app-token to bcd2ba49218906704ab6c1aa796996da409d3eb1. 🔴 (16:00) Auto-approval workflow sequence: 1. check out trusted repository code; 2. obtain an app token using vars.SENTRY_INTERNAL_APP_ID and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY; 3. run node src/publish/request-digest-from-event.js; 4. run node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, AUTO_APPROVER, and EXPECTED_REQUEST_DIGEST; 5. post AUTO_APPROVAL_ATTESTATION via gh issue comment; 6. derive REPO from ISSUE_TITLE, require an exact fixed-string line match in auto-approve-repos.txt, then add the accepted label. 🔴 (16:00) Auto-approval attestation is posted using ${{ github.token }}, while the accepted label is added using the generated GitHub App token from steps.token.outputs.token. 🔴 (16:01) User stated: “Always run trusted code,” specifically noting that workflow_dispatch can target any ref and therefore trusted code must be selected. 🔴 (16:01) User stated: “Never move a release to ci-ready after it changes.” 🔴 (16:01) User stated that a renamed or re-approved issue “never reaches ci-ready,” requiring final revalidation after CI checks. 🔴 (16:01) The CI poller validates repository_dispatch attempt values as integers from 0 through 59. 🔴 (16:01) The CI poller only checks issues having both ci-pending and accepted labels; when no such issues exist, it reports No ci-pending + accepted issues found. 🔴 (16:01) For invalid publish requests, the CI poller posts: “The publish request is invalid and could not be checked. Fix the request and re-add the accepted label to retry.” 🔴 (16:01) CI-poller approval validation extracts accepted_event_id from .eventId; invalid approval causes removal of accepted. 🔴 (16:01) CI-poller logic includes final post-CI revalidation, removal of ci-ready, recording a CI-ready attestation with EXPECTED_ACCEPTED_EVENT_ID, and adding ci-ready only after successful validation; failed checks aggregate names whose completed conclusions are neither success, neutral, nor skipped. 🔴 (16:01) CI poller retries are capped at 60 attempts, described as approximately 30 minutes, after which cron is expected to handle continued polling. 🔴 (16:01) .github/workflows/ci-poller-dispatch.yml is a manually dispatched workflow named Run CI Status Poller, has permissions: {}, uses the production environment, runs on ubuntu-latest, and contains only run: ":". 🔴 (16:01) .github/workflows/ci-poller-dispatch.yml documents that repository secrets must never be used by that workflow and relies on protected environment secrets to prevent an arbitrary dispatched ref from adding them.