Dashboard › publish › Distillation
3948e55d-09cf-492e-8ebf-f2e120619768["lore_tm_v1_CP8QqemW3ZlG7sI-tLzqyXDMRMcRut1uOi7EXkzLYmo","lore_tm_v1_UHPvj3Ob89SJMwbFI2-CLRuTan9cpYIlfi8FHnlaQwg","lore_tm_v1_8uicv2NsU_mUDvRlURba8h8t4mudQjejmZkKOwDCpnE","lore_tm_v1_lbFzSWYgvuW-oUczmWG7HJ4Q_qoSO7tvLuI9WHTxGWY","lore_tm_v1_ja8Jhof4ZMOMJrZZvTZUyMX376GbQs-BweHRYfhB98U","lore_tm_v1_Dk-DaHmEEqY021B16vWDy_s8bpQGRZolqtPpytC7TPc"]
Date: Aug 28, 2026
/home/byk/Code/getsentry/publish; instructed not to modify files. Requested examination of authorization bypasses, mutable issue title/repository binding, acceptance-label event binding, bot provenance, token privilege boundaries, workflow step failure/cleanup behavior, label-event races, and external-input injection.PASS, CONCERN, or MUST-FIX, conclude exactly with MERGE or DO-NOT-MERGE, and never return an empty report./home/byk/Code/getsentry/publish contains 15 top-level entries: .eslintrc.js, .git/, .github/, .gitignore, .lore.md, AGENTS.md, auto-approve-repos.txt, docs/, LICENSE, node_modules/, package.json, README.md, src/, vitest.config.js, and yarn.lock..github/workflows/ci-poller.yml, .github/workflows/publish.yml, AGENTS.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/details-from-context.js, src/publish/post-result.js, and additional elided files; untracked content includes src/publish/__tests__/ and additional elided paths.ci-ready after either approval-bound value changes.ci-ready.ci-ready and that this is guaranteed to trigger on the happy path.ci-poller.yml diff adds calls to src/publish/validate-approval-attestation.js, passing APPROVAL_TOKEN="$GH_TOKEN" and approval issue context including APPROVAL_ISSUE_REPOSITORY="$GITHUB_REPOSITORY"; invalid/unverifiable approval handling removes accepted and posts: “Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue.”publish.yml approval validation runs node .__publish__/src/publish/validate-approval-attestation.js using APPROVAL_TOKEN: ${{ github.token }}; its checkout uses persist-credentials: false.publish.yml contains a comment that GitHub App token-generated workflow_dispatch events are used because GITHUB_TOKEN-generated workflow_dispatch events are suppressed..github/workflows/publish.yml:351-380 supplies the publishing step with GITHUB_API_TOKEN: ${{ steps.token.outputs.token }}, DOCKER_GHCR_IO_PASSWORD: ${{ secrets.GITHUB_TOKEN }}, and numerous publishing/deployment credentials, including CLOUDFLARE_API_TOKEN, COCOAPODS_TRUNK_TOKEN, CRAFT_GCS_TARGET_CREDS_JSON, CRAFT_GCS_STORE_CREDS_JSON, CRATES_IO_TOKEN, DOCKER_PASSWORD, HEX_API_KEY, TWINE_PASSWORD, NPM_TOKEN, GEM_HOST_API_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, NUGET_API_TOKEN, POWERSHELL_API_KEY, GPG_PRIVATE_KEY, GPG_PASSPHRASE, OSSRH_USERNAME, OSSRH_PASSWORD, PUBDEV_ACCESS_TOKEN, PUBDEV_REFRESH_TOKEN, and VERCEL_TOKEN..github/workflows/publish.yml:382-387 runs node .__publish__/src/publish/update-issue.js with PUBLISH_ARGS: ${{ steps.inputs.outputs.result }} and GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} when ${{ cancelled() || failure() }}..github/workflows/publish.yml:389-401 calls node .__publish__/src/publish/post-result.js cancelled when cancelled and node .__publish__/src/publish/post-result.js failure when failed; both receive PUBLISH_ARGS: ${{ steps.inputs.outputs.result }} and GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}..github/workflows/publish.yml:403-408 closes on success by running node .__publish__/src/publish/post-result.js success with PUBLISH_ARGS: ${{ steps.inputs.outputs.result }} and GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}.workflow_dispatch must always be allowed for manual recovery..github/workflows/ci-poller.yml defines workflow_dispatch and documents that its concurrency state is set to "true" by ci-pending.yml and reset to "false" when done; the workflow comment says manual workflow_dispatch is always allowed for recovery.ci-poller.yml creates GitHub App tokens using actions/create-github-app-token@v3; one token is configured with owner: getsentry to access all getsentry repositories, and a later poller token uses CI_POLLER_APP_PRIVATE_KEY.ci-poller.yml polls only issues bearing both ci-pending and accepted labels. Before CI state transition, it invokes src/publish/validate-approval-attestation.js with approval issue title/repository context; invalid attestation removes ci-pending and accepted and prevents transition.ci-poller.yml parses an issue-body commit SHA using grep -oP '(?<=commit/)[0-9a-f]{40}(?=/checks)', compares it to the resolved SHA, and does not proceed when "$sha" != "$issue_sha".ci-poller.yml treats completed check conclusions other than success, neutral, or skipped as unsuccessful; it obtains failing check names with jq -rs '[.[] | select(.status == "completed" and .conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped") | .name] | join(", ")'.ci-poller.yml swaps ci-pending to ci-failed and removes accepted to stop further polling; on no remaining matching issues it disables the poller. The workflow notes GitHub cron */5 can drift to 30–40 minutes under load.