Dashboard › publish › Distillation
3d8b4141-33cb-4d45-b319-53c6ef5b9bc7["lore_tm_v1_jvXSCVBmg1gVVPlTPMtOu07HuRzVmUFcQ7T3UpTQH70","lore_tm_v1_aE3z1BfH0I3RDh4wuTkzeOHHcN2p8cGtM8Ml2yhXVkM","lore_tm_v1_gJsjpzcDiWny4w0lbagYwVqbYdpNB7CE7xOncjSaZcM","lore_tm_v1_xKvh5_EI2PIc3lPFVQTg2hI_QzAG89Cirnae_cSsGCQ","lore_tm_v1_NWjOYQbf-KzafdgmgmNG5c8MmEhupaThP5mYo6Wgd0g","lore_tm_v1_Jr-EcOMWtHCnkXEUdwq2o6p4kDdDySf5byCP74b-9Pk","lore_tm_v1_6ib4jtCnQLMa1DtQiu_-Alrq4xKux2s4KwU6YmMCYaU","lore_tm_v1_S4UG2LhjF6nzc_4csChLAXdSxwvy8gSwnrb_UPlmN4M"]
Date: Sep 10, 2026
src/publish/__tests__/ci-poller-workflow.js contains 4 workflow-security tests for .github/workflows/ci-poller.yml and .github/workflows/ci-poller-dispatch.yml: 1. trusted default-branch actions/checkout@[a-f0-9]{40} under Get publish code must precede Get auth token; 2. manual recovery uses a protected relay—main workflow has repository_dispatch: type [ci-poller] plus successful default-branch workflow_run: for Run CI Status Poller, while the dispatch workflow has workflow_dispatch:, permissions: {}, environment: production, no secrets., and no repository_dispatch:; 3. repository-dispatch attempt validation must precede token acquisition, accept exactly integers 0 through 59, reject "", "00", "01", "60", "-1", "1x", and "$(id)", set ATTEMPT from steps.dispatch-attempt.outputs.value or "0", increment via attempt=$((10#$ATTEMPT + 1)), and dispatch with gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input -; 4. all 4 poller approval fences must set EXPECTED_REQUEST_DIGEST="$request_digest" derived using jq -r '.requestDigest'.src/publish/__tests__/publish-workflow.js contains 6 workflow regressions for .github/workflows/publish.yml: 1. approval and publication bind to the triggering issue snapshot via node src/publish/request-digest-from-event.js and exactly 4 EXPECTED_REQUEST_DIGEST: ${{ steps.request-digest.outputs.request_digest }} uses; 2. Revalidate approval attestation occurs after Set targets and immediately before Publish using Craft, with REQUIRE_CI_READY_ATTESTATION: "true"; 3. Craft is pinned as docker://getsentry/craft@sha256: followed by exactly 64 lowercase hexadecimal characters; 4. waiting-for-ci orders Mark ci-pending, Trigger CI poller, Comment on issue, Enable cron poller, then Revoke stranded approval, makes the trigger/comment/enable steps continue-on-error: true, and removes ci-pending plus accepted if both trigger and enable outcomes are not successful; 5. post-Craft reconciliation occurs before and after terminal reporting, runs under if: always(), derives cleanup from steps.publish.outcome, removes accepted, ci-pending, and ci-ready, closes the issue, and does not invoke Node; 6. exactly one Report publish result maps Craft outcomes as success → success, cancelled → cancelled, and all others → failure, then calls node .__publish__/src/publish/post-result.js "$status" without using cancelled().src/publish/__tests__/auto-approval-workflow.js contains 3 regressions for .github/workflows/auto-approve.yml: 1. checkout before Record automated approval attestation must not use sparse-checkout:; 2. the workflow derives the request digest with node src/publish/request-digest-from-event.js, passes EXPECTED_REQUEST_DIGEST: ${{ steps.request-digest.outputs.request_digest }}, and runs node src/publish/record-auto-approval-attestation.js before --add-label accepted; 3. Post automated approval attestation uses GH_TOKEN: ${{ github.token }} before labeling, while the subsequent internal-app label operation uses GH_TOKEN: ${{ steps.token.outputs.token }}.src/publish/__tests__/current-accepted-event.js contains 2 tests for getCurrentAcceptedEvent(): it selects the latest accepted labeled event, returning { actor: "contractor", eventId: "200" } rather than earlier event ID "100"; an issue with no valid accepted event rejects with "The issue has no current accepted label event".src/publish/__tests__/record-ci-ready-attestation.js contains 4 tests for recordCiReadyAttestation(): 1. a live publish: getsentry/sentry-javascript@10.0.0 request with body Merge target: main, current accepted event { actor: "contractor", eventId: "100" }, and authenticated login sentry-internal-app[bot] produces an attestation containing acceptedActor, acceptedEventId, ciReadyActor, requestDigest, and title; 2. changing the live title to publish: getsentry/sentry-python@10.0.0 rejects with "The approval changed before CI could be marked ready"; 3. replacing expected accepted event ID "100" with live re-approval event ID "200" yields the same rejection; 4. replacing snapshot body "old revision" with "new revision" and adding dry-run also yields the same rejection.src/publish/__tests__/record-auto-approval-attestation.js contains 3 tests for recordAutoApprovalAttestation(): 1. automated requester getsantry[bot] is bound to the live publish: getsentry/sentry-javascript@10.0.0 request and its requestDigest; 2. changing the live issue author from getsantry[bot] to contractor rejects with "The automated approval request changed before approval"; 3. changing body "old request" to "changed request" and adding dry-run relative to the opened-event snapshot yields the same rejection.src/publish/__tests__/authorize-approval.js contains 8 entry-point tests for authorize-approval.js: 1. getAutoApprovedRepositories() preserves exact allowlisted release paths, producing new Set(["getsentry/sentry-javascript", "getsentry/objectstore/clients"]); 2. collaborator contractor with GitHub role_name: "write" for getsentry/sentry-javascript, a matching open request, and accepted event ID "100" writes authorized=true plus a <!-- publish-approval ... --> attestation to GITHUB_OUTPUT; 3. requester contractor cannot approve their own release and writes authorized=false; 4. a live request changed after acceptance—body changed after accepted plus dry-run—fails snapshot validation and writes authorized=false; 5. an allowlisted publish: getsentry/relay@1.2.3 request opened by getsantry[bot] is authorized when sentry-internal-app[bot] added accepted and a matching createAutoApprovalAttestation() comment was authored by github-actions[bot], without a collaborator-permission lookup; 6. the same automated approval without the request-proof comment writes authorized=false; 7. direct approval by automated opener sentry-release-bot[bot] writes authorized=false without any GitHub fetch; 8. a GitHub permission response with HTTP 404 rejects with "Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404" and writes no output.authorize-approval.js entry-point test harness sets APPROVAL_ACTOR, APPROVAL_ISSUE_NUMBER="123", APPROVAL_ISSUE_REPOSITORY="getsentry/publish", APPROVAL_ISSUE_TITLE, and EXPECTED_REQUEST_DIGEST; authorization output is expected at /tmp/github-output.