Dashboard › publish › Distillation
31470470-c4eb-49b7-8081-42ddea91ef3c["lore_tm_v1_LApK2uGYP9Cf-LH1h1VVRylMFdX2Q303Aerl6L4Q4yI","lore_tm_v1_so753Oxl3VuoEzfkXOmbf7I-oIDBBrRVKuwK3F3GJAA"]
/home/byk/Code/getsentry/publish/AGENTS.md has 281 lines and defines the Sentry Publish Repository as a GitHub Actions-based approval system using Craft, pure JavaScript, Node.js 24.0.0, and CommonJS source modules.1.22.22 classic, managed through Volta and pinned in package.json; npm must not be used.yarn install for dependencies; yarn test for all tests; yarn test:watch for watch mode; yarn test src/modules/__tests__/update-issue.js for one file; yarn test -t "pattern" for a name pattern; yarn test src/modules/__tests__/update-issue.js -t "specific test name" for file plus pattern; yarn lint for linting; and yarn prettier for formatting.src/libs/ for shared utilities, src/modules/ for reusable core business logic, and src/publish/ for GitHub Actions entry points; test files live in __tests__/ subdirectories.details-from-context.js and update-issue.js; camelCase variables/functions such as detailsFromContext and publishRepo; and UPPER_SNAKE_CASE constants/regex patterns such as TARGETS_SECTION_PARSER_REGEX.require/module.exports) for source files and ES Modules (import/export) for test files; named CommonJS exports are preferred when exporting multiple values.fs and path; 2. external packages such as @actions/github and @actions/core; 3. relative local modules.yarn prettier before committing.throw new Error(\Unknown status: '${status}'`)`.fs.existsSync(CRAFT_STATE_FILE_PATH) before reading it.v4.0.0 with globals enabled and mocks auto-cleared between tests. External dependencies should be mocked before requiring the module under test; documented patterns include vi.mock("@actions/github"), an fs mock exposing existsSync: vi.fn() and readFileSync: vi.fn(), and toMatchInlineSnapshot() for complex output.@actions/core for GitHub Actions inputs, outputs, and logging; @actions/github for GitHub API access; and @sentry/node for Sentry error reporting.Promise.all([operation1(), operation2()]) for parallel async work, destructuring such as const { repo, owner, issueNumber } = context, object spread such as { ...publishRepo, additionalProp: value }, template literals, and regular expressions with named groups.src/publish/ use @actions/core, @actions/github, and issue-based workflows triggered by labels and comments. All repository code is owned by @getsentry/releng..lore.md through lore (https://github.com/BYK/loreai).publish.yml Craft-state isolation decision: use $GITHUB_WORKSPACE/.craft-state outside checked-out __repo__/, pass it via XDG_STATE_HOME, and derive a collision-resistant filename from sanitized owner/repo/version plus the first 12 SHA-1 characters of Craft’s canonical container cwd. Storing state in the target repository was rejected because target-repository contents could pre-populate or influence privileged publishing state.{title, body, dryRun} request in both approval and CI-ready proofs, recomputed at every validation with fail-closed mismatch handling. Workflow-state labels are excluded from the digest; any request-content mutation, including the poller’s SHA rewrite, requires renewed approval.src/publish/update-issue.js to parse publish inputs only when present, catch malformed JSON and skip target restoration, and always call updateIssue() so accepted is removed. Cleanup must remain runnable after every failure or cancellation stage.ci-ready label after CI passes, even when that label is already present. An idempotence check must not skip relabeling because re-adding emits a fresh label event, resolves the waiting-for-CI race, and starts publishing for accepted releases; skipping it can strand releases.workflow_dispatch wherever operators need manual recovery. Privileged recovery must use a no-secret relay protected by a main-only environment and a successful default-branch workflow_run handoff rather than direct secret-bearing dispatch, because the dispatcher selects workflow YAML before jobs, guards, or checkout run. Workflows should be identified by checked-in filename such as ci-poller.yml, not placeholders or numeric IDs.github-actions[bot] proof before sentry-internal-app[bot] adds accepted; generic app identity is insufficient.accepted event is replaced never to reach ci-ready. The captured event and request digest must be validated before CI, after CI, while recording the CI-ready proof, immediately before adding ci-ready, and immediately before Craft. Repeated live fencing was chosen over initial-only validation because issue state can change during CI or setup.accepted, moving an issue to ci-ready, or publishing, validate the live canonical issue, current label events, actor provenance, and matching attestations; reject renamed, closed, changed, re-approved, self-approved, or unverifiable requests.ci-ready; manual recovery must execute trusted default-branch code before credentials are obtained and must never execute arbitrary dispatched-ref code or expose repository secrets; workflows must use protected environments, least-privilege permissions, and immutable action revisions or publishing-image digests.