Distillation

Date: Aug 29, 2026

• 🟢 (13:10) Repository directory /home/byk/Code/getsentry/publish contains .eslintrc.js, .git/, .github/, .gitignore, .lore.md, AGENTS.md, auto-approve-repos.txt, docs/, LICENSE, node_modules/, package.json, README.md, src/, vitest.config.js, and yarn.lock (15 entries).
• 🟢 (13:10) Relevant release-approval files found: src/publish/current-accepted-event.js, src/publish/record-ci-ready-attestation.js, src/publish/validate-approval-attestation.js, src/publish/authorize-approval.js, src/modules/approval-attestation.js; tests: src/publish/__tests__/current-accepted-event.js, src/publish/__tests__/record-ci-ready-attestation.js, src/publish/__tests__/validate-approval-attestation.js, src/publish/__tests__/authorize-approval.js, src/modules/__tests__/approval-attestation.js, and src/modules/__tests__/approval-authorizer.js.
• 🔴 (13:10) User stated .github/workflows/publish.yml uses the issue title (example: "publish: getsentry/foo@1.2.3") to handle duplicate approval events; its poller always adds ci-ready.
• 🔴 (13:10) User stated .github/workflows/ci-poller.yml must always allow workflow_dispatch for manual recovery.
• 🔴 (13:10) User stated a release must never move to ci-ready after it changes while CI is being inspected.
• 🔴 (13:10) User stated a renamed or re-approved issue never reaches ci-ready.
• 🟡 (13:10) src/modules/approval-attestation.js defines prefixes <!-- publish-approval and <!-- publish-ci-ready , suffix -->, and creates base64url-encoded JSON attestations via createAttestation(prefix, value).
• 🟡 (13:10) createApprovalAttestation({ actor, eventId, title }) records { actor, eventId: String(eventId), title }; createCiReadyAttestation({ acceptedEvent, ciReadyActor, title }) records { acceptedActor: acceptedEvent.actor, acceptedEventId: String(acceptedEvent.eventId), ciReadyActor, title }.
• 🟡 (13:10) parseAttestation(body, prefix) locates the first prefix/suffix pair, base64url-decodes and JSON-parses it, returning null for absent/malformed content. parseApprovalAttestation(body) requires string actor, eventId, and title; parseCiReadyAttestation(body) requires string acceptedActor, acceptedEventId, ciReadyActor, and title.
• 🟡 (13:10) compareEventIds(left, right) strips leading zeroes, requires decimal-only IDs or throws Error("Invalid issue event ID"), compares normalized length first then localeCompare.
• 🟡 (13:10) currentLabeledEvent(events, labelName) filters labeled events with matching event.label?.name, string/number event.id, and event.actor?.login; returns the highest numeric event ID as { actor, eventId: String(event.id) }, or null for no candidates/invalid IDs. currentAcceptedEvent(events) and currentCiReadyEvent(events) call it for "accepted" and "ci-ready" respectively.
• 🟡 (13:10) hasApprovalAttestation({ comments, event, title, attestationAuthor }) requires a comment authored by attestationAuthor whose approval attestation exactly binds actor, eventId, and title; hasCiReadyAttestation({ comments, acceptedEvent, ciReadyEvent, title, attestationAuthor }) requires a comment by attestationAuthor whose ci-ready attestation exactly binds accepted actor/event ID, ci-ready actor, and title.