Distillation

Date: Aug 25, 2026

• 🔴 (17:05) User/project directive: the CI poller always adds the ci-ready label after checking CI; when ci-ready was already present, waiting-for-ci removes it first so a fresh ci-ready labeled event triggers.
• 🟡 (17:05) .github/workflows/publish.yml publish job is gated to run only for open issues whose triggering label is ci-ready, which also have accepted and ci-ready labels and do not have ci-pending or ci-failed; this replaces acceptance-event publishing to avoid racing with waiting-for-ci.
• 🟡 (17:05) .github/workflows/publish.yml publish job uses ubuntu-latest, environment: production, name: Publish a new version, timeout-minutes: 90, and SENTRY_DSN: "https://303a687befb64dc2b40ce4c96de507c5@o1.ingest.sentry.io/6183838". It checks out the publish repository with actions/checkout@v6 into .__publish__, then uses actions/setup-node@v6 with Node 24, Yarn caching, and cache-dependency-path: .__publish__/yarn.lock.
• 🟡 (17:05) Publish workflow target-repository checkout uses actions/checkout@v6, path __repo__, repository: getsentry/${{ fromJSON(steps.inputs.outputs.result).repo }}, ref: ${{ steps.target-repo-branch.outputs.target_repo_branch || ''}}, app-token authentication via ${{ steps.token.outputs.token }}, and fetch-depth: 0.
• 🟡 (17:05) Publish workflow computes container_cwd as realpath -m "/github/workspace/__repo__/$CRAFT_PUBLISH_PATH" to support publish paths under the checked-out target repository, including monorepo subdirectories.
• 🟡 (17:05) src/modules/details-from-context.js title parser was hardened and extended from ^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$ to ^publish: (?:getsentry\/)?(?<repo>[A-Za-z0-9_.-]+)(?<path>\/[\w./-]+)?(?: \[workspace: (?<workspace>"(?:[^"\\]|\\.)*")\] )?@(?<version>[\w.+-]+)$, allowing an optional JSON-quoted workspace segment such as [workspace: "..."] before @version.
• 🟡 (17:05) src/modules/details-from-context.js now safely handles malformed publish titles: it checks titleMatch and titleMatch.groups, then throws new Error(\Invalid publish issue title: '${context.payload.issue.title}'`)rather than dereferencing.groups` on a null match.
• 🟡 (17:05) src/modules/details-from-context.js extracts workspaceJson from parsed title groups, parses it with JSON.parse(workspaceJson), defaults workspace to "", and rejects empty workspace names or names containing Unicode control characters, line separators, or paragraph separators via /[\p{Cc}\p{Zl}\p{Zp}]/u, throwing "Workspace names must be nonempty and cannot contain control characters".
• 🟡 (17:05) src/modules/details-from-context.js now constructs path from titleDetails.path rather than all parser groups and rejects traversal when path.split("/").includes(".."), throwing new Error(\Invalid publish issue path: '${path}'`)`.
• 🟡 (17:05) src/modules/details-from-context.js changed Craft state reading from fs.promises.readFile(CRAFT_STATE_FILE_PATH, { encoding: "utf-8" }) to fs.promises.readFile(stateFilePath, { encoding: "utf-8" }), then parses the contents as JSON.
• 🟡 (17:05) src/modules/__tests__/details-from-context.js adds coverage for a legacy publish title containing an unexpected space before its version: rejects a legacy title with an unexpected space before its version.
• 🟡 (17:05) Existing publish-context test fixtures use issue number "223", title "publish: getsentry/sentry@21.3.1", requester @BYK, labels including "accepted", and targets including checked github and docker[latest], unchecked pypi and docker[release]; a default-target fixture references getsentry/sentry comparison 21.3.0...refs/heads/releases/21.3.1 and commit 7e5ca7ed5581552de066e2a8bc295b8306be38ac.