Dashboard › publish › Distillation
304bf140-348d-439c-8805-516de7302d97["lore_tm_v1_pXwiDIU1DMQv-tmWeofxNCLkmlWNwbOulRZkjs_-HLI","lore_tm_v1_-luNpP3KxXRf5eD_t0Y4-ecN4nrVEJ8nT4YqWk4qsZg","lore_tm_v1_oOJgeYPSoBTyACZeTk6NTZQxzzW9xSmV8PPuP06IL_E","lore_tm_v1_ii3FAar1caxJFzGRgZzrfPRzkcbfbB1Fpi43fdFF9cM","lore_tm_v1_pm6rc7RUvdgfQlsvNBYFpR0kPZoPKnlGVPKzhKzATs4","lore_tm_v1_H8QpyjGkx5CPDU5mYcuOUC61KbFNNLWJKkpSVdGkRxg","lore_tm_v1_oJQP4uO8_xcVDH-Qjad7PfNWLH1unPEgbl-OpxXF3Lc","lore_tm_v1_3Gjo5I9xO779o2-xFEqiLYug2XsvORUD-RlwNJlB9Ag","lore_tm_v1_r0TmNFYYVZOhVC5R6ZtTUcY1WzYruDio3eWi5bcvZ8s","lore_tm_v1_nx_Yh_8OzjOqU_uAf7tle-TnNQZXnR4MhTB5sUPoWXU","lore_tm_v1_T9xGMRNNdfAyXLkwi-TPHJ3MTkPJXMVHjcsPmO8NQQI","lore_tm_v1_d-jmM7x5PBYsSOnVVTxpBp5XYAHGaLGDftYduSh18tM","lore_tm_v1_ekmaHUhvadNdeOObsr9v6-RmQYiGM1uQyfS7RlryXqc","lore_tm_v1_nUGKtaQ_uCejf3PxCtIY4dVeSKIRMHj320EdggnbQpk","lore_tm_v1_z3dVeBY6QXNWhJktAeLak9pht9KnyVbwJkpr79zvUN0","lore_tm_v1_s4euaCDaDT0Ql2erHwZUhXHaIxFvowO6fi9qFXJX1tw","lore_tm_v1_LGihRSWGpKdVti5Ykwlqold2GP4ZVGa1F1znnh0swNM","lore_tm_v1_fuKEhn6cDIWr_FG_26IDwyhzKlH6flTbwJeCd8VDmLM","lore_tm_v1_LACn7k_g4o5zxbYsU_wyxGTRauEYBlZ19ZdTVhSDHSU","lore_tm_v1_wjRHH-1_mnCUkLnDTY2GhUNlkKyJK0yJH49meuCfxhI","lore_tm_v1_L9ZbjP0xF8EY8E5jV5kzIQqkBHC-xVketEphcDnCiDc","lore_tm_v1_okhiwrKr6daoYkl84cLRthmLTC4ZXqFUJHznWcnhFG4"]
Date: Aug 29, 2026
src/publish/record-ci-ready-attestation.js (108 lines). recordCiReadyAttestation({ expectedAcceptedEvent, getAuthenticatedLogin, getIssue, getIssueEvents, issueNumber, issueTitle, repository }) concurrently gets issue labels/title, issue events, and authenticated login; derives acceptedEvent = currentAcceptedEvent(events); throws The approval changed before CI could be marked ready if title differs, accepted is absent, no current accepted event exists, or supplied expectedAcceptedEvent.actor/.eventId differs from the current event; otherwise returns createCiReadyAttestation({ acceptedEvent, ciReadyActor, title }).record-ci-ready-attestation.js main() requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, and APPROVAL_ISSUE_TITLE; it optionally builds expectedAcceptedEvent only when both EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID are set, retrieves paginated issue events through getAllPages({ repository, issueNumber, resource: "events" }), and appends ci_ready_attestation=${attestation}\n to GITHUB_OUTPUT.ci-ready..github/workflows/ci-poller.yml lines 215–339. CI readiness requires at least one check run or commit status, commit_status == "success" or zero statuses, zero pending checks, and zero unsuccessful completed check conclusions; success, neutral, and skipped are considered passing, while failure, cancelled, timed_out, action_required, stale, and startup_failure are unsuccessful.ci-poller.yml, before transition to ci-ready, the poller invokes node src/publish/validate-approval-attestation.js with APPROVAL_TOKEN="$GH_TOKEN", APPROVAL_ATTESTATION_AUTHOR="github-actions[bot]", issue number/repository/title, and bound EXPECTED_ACCEPTED_ACTOR="$accepted_actor" plus EXPECTED_ACCEPTED_EVENT_ID="$accepted_event_id"; validation failure removes ci-pending and accepted, comments that approval is invalid/unverifiable, and continues.ci-poller.yml, record-ci-ready-attestation.js receives the same bound expected accepted event, writes to a mktemp GITHUB_OUTPUT, and failures or malformed output not matching ci_ready_attestation=* remove ci-pending and accepted and post the invalid/unverifiable approval comment. The resulting attestation is posted with GH_TOKEN="${{ github.token }}" gh issue comment.ci-poller.yml, after posting CI-ready proof, the poller performs a second validate-approval-attestation.js invocation with the same bound event immediately before gh issue edit ... --remove-label "ci-pending" --add-label "ci-ready"; failure removes ci-pending and accepted and comments an invalid/unverifiable approval.src/publish/__tests__/record-ci-ready-attestation.js (3 tests): it verifies an accepted event { actor: "contractor", eventId: "100" } creates a parsed CI-ready attestation with ciReadyActor: "sentry-internal-app[bot]" and title publish: getsentry/sentry-javascript@10.0.0; rejects title/event invalidation; and rejects re-approval event ID "200" when bound expected event is contractor/"100", with The approval changed before CI could be marked ready.yarn vitest run src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js passed: 2 test files and 10 tests passed; duration 285ms (transform 96ms, import 136ms, tests 35ms)..github/workflows/ci-poller.yml..github/workflows/ci-poller.yml and src/publish/current-accepted-event.js; added src/publish/__tests__/current-accepted-event.js.current-accepted-event.js, validate-approval-attestation.js, and record-ci-ready-attestation.js passed: 3 test files and 12 tests passed; duration 399ms (transform 107ms, import 186ms, tests 66ms).prettier --write src --check .github/workflows/ci-poller.yml src/publish/current-accepted-event.js src/publish/__tests__/current-accepted-event.js src/publish/validate-approval-attestation.js src/publish/record-ci-ready-attestation.js src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js reported code style issues in exactly src/publish/__tests__/current-accepted-event.js and src/publish/current-accepted-event.js.src/publish/current-accepted-event.js (48 lines). getCurrentAcceptedEvent({ getIssueEvents, issueNumber, repository }) retrieves events, calls currentAcceptedEvent(...), throws The issue has no current accepted label event if none exists, and returns { actor, eventId }; main() requires APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY, retrieves paginated events via getAllPages, and writes JSON.stringify(event) to stdout.src/publish/__tests__/current-accepted-event.js (2 tests): getCurrentAcceptedEvent() returns the latest accepted-label event, contractor event ID "200" over earlier "100"; it rejects empty events with The issue has no current accepted label event.src/publish/current-accepted-event.js (86ms) and src/publish/__tests__/current-accepted-event.js (20ms).yarn vitest run passed: 11 test files and 50 tests passed; duration 1.30s (transform 239ms, import 899ms, tests 192ms).yarn eslint src passed in 0.81s..github/workflows/ci-poller.yml, .github/workflows/publish.yml, relevant src/modules/ approval files/tests, and approval-publishing scripts/tests including current-accepted-event.js; all matched files use Prettier style.git diff --check is clean; it launched independent correctness and security reviews of the final authorization path to determine further hardening.ses_fb25f14b5ffeOY3ZKCadaSpYkn.ses_fb25e4149ffe1nyk9U7RonoeIw.