Dashboard › publish › Distillation
3ede5f68-b63a-4d4f-ad4b-969d074f4b45["lore_tm_v1_SwDqH19VzNjQ9YA_AP2_fOyA355aml_832rXN-4DChI","lore_tm_v1_G49AmaBSSKAZzHGpoZmvU2rn_sMmPM0y55louUHrFpo","lore_tm_v1_hOXAAZ0CR-5EDe5khmDvU7xHyutH9cYVYUV7v62ahQw","lore_tm_v1_8rTUHmHvaQToaPBpt9-k98tIO2L3GR96hCMayukfubs","lore_tm_v1_7bThicqbRMhDJBIo4CxDzrC4tsp_s0Iktf0DZS5sjS4","lore_tm_v1_s2fqSLC5wIhRnRP1f73G-bBD3cS64If6XzTWNMiHQqA","lore_tm_v1_efIYAAdxJG-PVGPW4g0eJb4fW07ysfj2hqrP4O4GAWE","lore_tm_v1_5ScF7LxF0GlLWuXrwyx60jL6v6aaT-JTkwKOE978tWI","lore_tm_v1_65URK508_PfWtlhENGGrswkD2WdqZapCfwkg_44HAm0","lore_tm_v1_qkfHHaTpnG8psjOaSfBjYT4EKbFBcgc3u39F83cOyI8"]
Date: Sep 10, 2026
/home/byk/Code/getsentry/publish/src/modules/__tests__/update-issue.js, which tests updateIssue() and transformIssueBody().updateIssue() tests use GITHUB_WORKSPACE="." and secure workflow output CRAFT_STATE_FILE_PATH=".craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json"; when that exact file exists, its JSON state { published: { lol: true, hey: false, github: true } } updates issue getsentry/publish#211 so targets contain - [x] github, - [ ] pypi, - [x] lol, and - [ ] hey; when absent, the issue body is not updated.updateIssue() tests require removal of label "accepted" from { owner: "getsentry", repo: "publish", issue_number: "211" } whether or not the state file exists; when CRAFT_STATE_FILE_PATH is absent, no state-file existence check, issue retrieval, or issue update occurs, but "accepted" is still removed even without parsed publish inputs.updateIssue() tolerates removeLabel failing with HTTP 404 "Not Found" and still restores target state, including changing - [ ] github to - [x] github.transformIssueBody() replaces the canonical ### Targets list according to published state: "npm[@sentry/node]": true → - [x] npm[@sentry/node], "aws-lambda": true → - [x] aws-lambda, github: false → - [ ] github, and new target foo: true → - [x] foo, while preserving the request header, Quick links, approval text, and explanatory footer./home/byk/Code/getsentry/publish/src/modules/__tests__/publish-workflow.js, which reads /home/byk/Code/getsentry/publish/.github/workflows/publish.yml, extracts the shell script between Set targets and Revalidate approval attestation, and executes it through bash -e -c in temporary directories.publish-workflow.js requires workflow step ordering: Resolve CI-approved release revision → Inform start → Check out target repo → Resolve publish location → Set targets → Publish using Craft; checkout uses ref: ${{ steps.release-revision.outputs.revision }} and pinned actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 exactly 2 times.node .__publish__/src/publish/discover-location.js, PUBLISH_REPOSITORY_DIRECTORY: __repo__, image docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b, CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.location.outputs.result).path }}, CRAFT_PUBLISH_WORKSPACE: ${{ fromJSON(steps.location.outputs.result).workspace || '' }}, and craft publish ${{ fromJSON(steps.inputs.outputs.result).version }} --rev ${{ steps.release-revision.outputs.revision }}."ci-ready" label event and simultaneous presence of "accepted" and "ci-ready" labels, with neither "ci-pending" nor "ci-failed" present.repo: "sentry", path: ".", version: "21.3.1" uses Craft legacy filename suffix .craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json and state { published: { github: true } }../packages/cli with workspace packages/cli, repository toolkit, and version 1.2.3 uses state filename suffix .craft-state/craft/publish-state-getsentry-toolkit-c232c383e26f-workspace-cGFja2FnZXMvY2xp-1.2.3.json and state { published: { github: true } }.4.2.6+sentry1 ends in -version-NC4yLjYrc2VudHJ5MQ.json, while 4.2.6+Sentry1 ends in -version-NC4yLjYrU2VudHJ5MQ.json./home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js, covering getAutoApprovedRepositories() and the authorize-approval.js main() entry point.getAutoApprovedRepositories() loads exact release paths into a Set; fixture lines getsentry/sentry-javascript and getsentry/objectstore/clients produce exactly new Set(["getsentry/sentry-javascript", "getsentry/objectstore/clients"])."contractor" and publish: getsentry/sentry-javascript@10.0.0 queries https://api.github.com/repos/getsentry/sentry-javascript/collaborators/contractor/permission with Authorization: "Bearer release-bot-token"; role "write" and a matching live accepted event ID "100" produce authorized=true plus approval_attestation=<!-- publish-approval ... --> in /tmp/github-output.authorized=false\n.publish: getsentry/relay@1.2.3 opened by "getsantry[bot]" can be approved by "sentry-internal-app[bot]" without a collaborator-permission call only when a request-bound createAutoApprovalAttestation() proof authored by "github-actions[bot]" is present; without that proof, authorization is false."sentry-release-bot[bot]" is rejected before any fetch call; failure to retrieve "contractor" permission due to GitHub HTTP 404 rejects with Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404, without writing output or logging through console.error.validateApprovalAttestation test file; visible cases cover rejection after issue-body changes, rejection after "accepted" is re-added, validation against expectedRequestDigest, and CI-ready attestations tied to accepted-event actor/event ID and attestation author "github-actions[bot]"./home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js: recordCiReadyAttestation() binds live approval { acceptedActor: "contractor", acceptedEventId: "100" } to authenticated CI-ready actor "sentry-internal-app[bot]", the request digest, and title publish: getsentry/sentry-javascript@10.0.0.recordCiReadyAttestation() rejects with "The approval changed before CI could be marked ready" when the live title differs (sentry-python versus sentry-javascript), the current accepted event changes from expected ID "100" to "200", or the live request snapshot changes from body "old revision"/labels ["accepted"] to body "new revision"/labels ["accepted", "dry-run"]./home/byk/Code/getsentry/publish/src/publish/__tests__/record-auto-approval-attestation.js: recordAutoApprovalAttestation() binds auto-approver "getsantry[bot]" to the live issue author, request digest, and title publish: getsentry/sentry-javascript@10.0.0.recordAutoApprovalAttestation() rejects with "The automated approval request changed before approval" when the live author changes from "getsantry[bot]" to "contractor", or when the expected snapshot body "old request"/no labels differs from live body "changed request" with label "dry-run"./home/byk/Code/getsentry/publish/src/publish/__tests__/current-accepted-event.js: getCurrentAcceptedEvent() selects the latest of accepted labeling events IDs "100" and "200", returning { actor: "contractor", eventId: "200" }; an empty event list rejects with "The issue has no current accepted label event"./home/byk/Code/getsentry/publish/src/publish/__tests__/request-digest-from-event.js: requestDigestFromEvent({ issue }) digests the exact event snapshot, including body "Merge target: main", labels "accepted" and "dry-run", and title publish: getsentry/relay@1.2.3; a missing issue throws "The GitHub event has no issue snapshot", and an issue lacking a title throws "Invalid publish request"./home/byk/Code/getsentry/publish/src/publish/__tests__/auto-approval-workflow.js, which reads .github/workflows/auto-approve.yml; checkout before Record automated approval attestation must not use sparse-checkout:.node src/publish/request-digest-from-event.js, EXPECTED_REQUEST_DIGEST: ${{ steps.request-digest.outputs.request_digest }}, and node src/publish/record-auto-approval-attestation.js; attestation recording must occur before --add-label accepted.GH_TOKEN: ${{ github.token }} before the internal app adds "accepted", while the subsequent labeling flow uses GH_TOKEN: ${{ steps.token.outputs.token }}./home/byk/Code/getsentry/publish/src/publish/__tests__/ci-poller-workflow.js, which reads .github/workflows/ci-poller.yml and .github/workflows/ci-poller-dispatch.yml.Get publish code to use a 40-character-SHA-pinned actions/checkout with ref: ${{ github.event.repository.default_branch }} before Get auth token.repository_dispatch type [ci-poller] and successful workflow_run events for workflow [Run CI Status Poller] only when github.event.workflow_run.head_branch == github.event.repository.default_branch; the main workflow must not expose workflow_dispatch:..github/workflows/ci-poller-dispatch.yml exposes workflow_dispatch:, uses permissions: {} and environment: production, and must contain neither secrets. nor repository_dispatch:.Get auth token; accepted decimal strings are exactly "0" through "59", while "", "00", "01", "60", "-1", "1x", and "$(id)" are rejected.ATTEMPT: ${{ github.event_name == 'repository_dispatch' && steps.dispatch-attempt.outputs.value || '0' }}, increments with attempt=$((10#$ATTEMPT + 1)), and dispatches through gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input -.request_digest=$(echo "$publish_input" | jq -r '.requestDigest') and contains EXPECTED_REQUEST_DIGEST="$request_digest" exactly 4 times.