Dashboard › publish › Distillation
32e75594-f76c-4861-b5e9-a103de42d087["lore_tm_v1_C9KRpc1wCdZPsRuQDIScoEWM5DOyXhL67DUaOUoAc2Y","lore_tm_v1_I9M7PVJ716viX83PIbjwl-NIzLg3E8u0m-dLidC--6A","lore_tm_v1_2b2imohNJHWywwgrgT-XjAaYaN7HlfQzEgVRuWREblU","lore_tm_v1_UV4T7DGb_6NbbRjETzzk_eRGEi6yb2RxxRmXAlEAEI4","lore_tm_v1_9qf3ZWlfr1htmVqwxM3zzUZJAAArOw4X-VXyFaG3_c0","lore_tm_v1_Zi8QnqqqtFXKhygDY6QTGftb_-_AGapyFFUKXzgKtUE","lore_tm_v1_2Sz3iUAKExrdDPlsZ6ovrRrXdep5ucHH8E_kuW8Yl6k"]
fix/root-location-bootstrap at 4f4b00f, origin/main at 7c60ddb (feat: accept workspace publish requests), feature branch feat/workspace-acceptance ending at fd1e115, and local main/opencode/tidy-orchid at 83d210b29553ea6f4d97508821724a834c43856e, one commit behind origin/main.7c60ddb7f43040fe8fbfea70efc833f689c04e75 changed 32 files with 3,257 insertions and 115 deletions, originally adding workspace publish request parsing, validation, location discovery, CI-poller input resolution, release-revision resolution, tests, documentation, and Peggy-generated parsing..github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, corresponding tests, and publish entry points src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js..github/workflows/auto-approve.yml runs for newly opened issues only when github.actor is sentry-release-bot[bot] or getsantry[bot] and the title starts with publish: ; the job uses the protected production environment with contents: read and issues: write..github/workflows/auto-approve.yml checks out only auto-approve-repos.txt using actions/checkout@11d5960a326750d5838078e36cf38b85af677262, with sparse-checkout-cone-mode: false.actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1, using vars.SENTRY_INTERNAL_APP_ID and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY.accepted, .github/workflows/auto-approve.yml runs node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and AUTO_APPROVER, then posts steps.attestation.outputs.auto_approval_attestation as a comment using ${{ github.token }}.REPO using sed -n 's/^publish: \(.*\)@.*/\1/p' and adds accepted only when the exact extracted value matches a complete line in auto-approve-repos.txt via grep -qxF.src/publish/__tests__/authorize-approval.js verifies that getAutoApprovedRepositories() preserves exact allowlist paths such as getsentry/sentry-javascript and getsentry/objectstore/clients.src/publish/authorize-approval.js authorization tests use APPROVAL_TOKEN="release-bot-token", issue 123 in getsentry/publish, and require a successful authorization to write authorized=true plus an approval_attestation matching <!-- publish-approval ... --> to GITHUB_OUTPUT.https://api.github.com/repos/getsentry/sentry-javascript/collaborators/contractor/permission; a write role can authorize, but a requester cannot approve their own release.getsantry[bot] may be approved by sentry-internal-app[bot] without a collaborator lookup only when a matching auto-approval attestation authored by github-actions[bot] exists.sentry-release-bot[bot] is rejected without making any GitHub request.Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404 and must not write authorization output.src/modules/__tests__/approval-attestation.js verifies that approval attestations bind to the latest accepted label event’s actor and event ID, including conversion of numeric GitHub event ID 29503999078 to string "29503999078".sentry-internal-app[bot]; changing accepted event ID from "200" to "201" or CI-ready actor to contractor invalidates the proof.<!-- publish-approval not-base64 -->, and a request whose dry-run label state changed after attestation.src/modules/__tests__/approval-authorizer.js requires direct approvals by getsantry[bot] and sentry-release-bot[bot] to be rejected without a target-repository permission lookup; getsantry[bot] is also rejected when the release is outside the auto-approval allowlist.write, maintain, and admin are authorized; roles none, read, triage, Elevated Bot, and undefined are rejected.publish: sentry-javascript/packages/core@10.0.0 resolves authorization against checkout repository getsentry/sentry-javascript, using owner getsentry and repository sentry-javascript, not the workspace/path suffix.publish: @1.0.0 and publish: getsentry/sentry-javascript are rejected with { authorized: false, repository: null } without querying GitHub; GitHub permission lookup failures such as Not Found propagate.src/publish/__tests__/null and failed with error: Could not access 'src/publish/__tests__/null'.src/modules/update-issue.js reads Craft state from ${process.env.GITHUB_WORKSPACE}/__repo__/.craft-publish-${version}.json; if absent, updateTargets() returns without fetching or updating the issue.transformIssueBody() preserves declared target order, marks each target checked when craftState.published[targetId] is truthy, and appends previously unlisted keys from craftState.published with corresponding checkbox state.updateIssue() runs target updating and removal of the accepted label concurrently via Promise.all; target updating occurs only when inputs?.version is present.production environment, permitting only main deployments and disallowing administrator bypass to protect environment-scoped credentials from arbitrary workflow refs.SENTRY_INTERNAL_APP_PRIVATE_KEY and SENTRY_RELEASE_BOT_PRIVATE_KEY are organization-level secrets whose availability to other repositories is an organization-wide security concern; Security must manage that boundary separately.package.json simplifies test to vitest run, removes generate and check:generated, and removes dev dependency peggy version 5.1.0; yarn.lock consequently removes peggy@5.1.0, @peggyjs/from-mem@3.1.3, commander@14.0.3, semver@7.7.4, and source-map-generator@2.0.6.getsentry/ remains optional only when parsing existing issues..craft.yml always means checkout-path behavior..craft.yml allows craft workspace list to supply exact concrete workspace paths; an exact suffix match is a workspace, every other suffix remains a checkout path, and discovery errors with a root configuration fail the release.