Dashboard › publish › Distillation
46615edf-bbaa-40e6-ae64-4a32d966e106["lore_tm_v1_WTWBkjgdYZrXvZej98-N5sXGNhJubWcWU2ZOKzfvHA8","lore_tm_v1_HRRH2xp969o469bvUw2t6-4BCLdYLkW0DWshWebKwOU","lore_tm_v1_L8j83M7-xOiydYsKLIQaMr8u1k7ewbUp0Rbnq4n5uGs","lore_tm_v1_eRxst0ey5XvIMTRS3luqljSXxtm2D9jLTnmyB3HJFq8","lore_tm_v1_dPWcoBt3sI7V20JE4PaOlvJf1XW1yT6iiZASZ3YiKys","lore_tm_v1_yq0IzYKb57M_IGKG6AUcrA-MuNIKVZTx8UljRufkmsI","lore_tm_v1_dhl_c1OIqkDjr-DI8jxHJECl-PIQhNFqc65Z66M-XLo","lore_tm_v1_HXlJubTUhB9ttLUp5SeSe8NfKLexEG3pjVZ8uhnVL9Q"]
2026-09-10
/home/byk/Code/getsentry/publish; scope is release input, revision, target checkout, publish location, Craft invocation, and state-file identity.PASS, CONCERN, or MUST-FIX with exact current file:line evidence and reasoning; every finding must include a concrete exploit/failure sequence and fix.BLOCKED and identify the exact tool/error.MERGE or DO-NOT-MERGE.ci-ready label; workflow comments at the provided excerpt’s lines 181-182 say publishing fires only on ci-ready label events—not accepted—to avoid racing with waiting-for-ci.src/publish/update-issue.js, src/publish/post-result.js, src/publish/resolve-release-revision.js, src/publish/resolve-location.js, src/publish/discover-location.js, src/modules/process-end-state.js, src/modules/details-from-context.js, src/modules/publish-location.js, src/modules/publish-issue-validation.js, src/modules/ci-poller-input.js, and their tests under src/publish/__tests__/ and src/modules/__tests__/.PUBLISH_ARGS; src/publish/update-issue.js:10-12 conditionally parses it, src/publish/post-result.js:7 parses it directly, src/publish/resolve-release-revision.js:5 parses it with fallback "{}", and src/publish/resolve-location.js:5-6 parses both PUBLISH_ARGS and CRAFT_WORKSPACE_NAMES.src/publish/discover-location.js:27-31 maps the resolved repository directory to /github/workspace/__repo__ and uses the container working area/name workspace; lines 36-49 parse Craft workspace output as JSON and fail closed unless it is an array; lines 52-85 implement/export discoverLocation and getWorkspaceNames.src/modules/publish-issue-validation.js: isPublishRepository() at lines 1-8 accepts only /^[A-Za-z0-9_.-]+$/, rejects ., .., __proto__, and leading -; isReleaseVersion() at lines 11-15 uses a case-insensitive semantic-version-like regex supporting optional prerelease/build portions.src/modules/details-from-context.js: lines 27-43 define parsePublishTitle(), parsing the issue title, prepending . to its path, and returning null unless repository, version, and path validation all pass.src/modules/details-from-context.js: lines 46-71 require issue context, parse and validate repository/version/path, and derive dry_run as "1" when the dry-run label exists or "" otherwise.src/modules/details-from-context.js: lines 73-94 derive mergeTarget from getReleaseRevisionDetails(), parse checked targets from the issue body, normalize merge_target === "(default)" to "", and return title details plus dry_run, merge_target, path, and targets.src/modules/details-from-context.js target parsing: TARGETS_SECTION_PARSER_REGEX at lines 12-13 matches a contiguous checkbox-list section; TARGETS_PARSER_REGEX at line 19 captures all target IDs; CHECKED_TARGETS_PARSER_REGEX at line 25 captures checked target IDs case-insensitively.src/modules/publish-location.js: resolvePublishLocation() at lines 1-22 rejects an invalid publish path or any invalid discovered workspace name; "." remains { path: "." }; an exact workspace match converts ./<workspace> into { path: ".", workspace }; otherwise it returns the validated path unchanged.src/modules/publish-location.js: isPublishPath() at lines 24-31 permits only "." or "./" followed by slash-separated safe segments; isWorkspaceName() at lines 33-37 validates slash-separated workspace segments; isSafeWorkspaceSegment() at lines 39-46 accepts /^[A-Za-z0-9_.-]+$/ but rejects ., .., __proto__, and leading -.src/modules/release-revision.js: isRevision() at lines 3-5 accepts exactly 40 lowercase hexadecimal characters.src/modules/release-revision.js: getReleaseRevisionDetails() at lines 7-30 requires exactly one parsed CheckRunsLinkCount, parses ReleaseRevision, requires the parsed repository to equal the requested repository, and otherwise throws errors referring to a View check runs link for getsentry/${repo}.src/modules/release-revision.js: getReleaseRevision() at lines 32-34 returns .revision.value; updateReleaseRevision() at lines 36-49 validates the replacement as a lowercase 40-character SHA and replaces precisely the parsed revision span in the issue body.src/modules/ci-poller-input.js: getCiPollerInput() at lines 13-30 parses the issue title and validates repository, release version, and the "."-prefixed publish path before revision processing.src/modules/ci-poller-input.js: lines 31-42 read currentRevision, optionally produce resolvedIssueBody with updateReleaseRevision(), and return optional updated issueBody, repo: "getsentry/${repo}", a requestDigest computed from resolvedIssueBody, labels, and title, revision: currentRevision, and version.src/publish/__tests__/resolve-release-revision.js, src/publish/__tests__/resolve-location.js, src/publish/__tests__/discover-location.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/ci-poller-input.js, src/modules/__tests__/release-revision.js, src/modules/__tests__/process-end-state.js, src/modules/__tests__/publish-workflow.js, and src/modules/__tests__/update-issue.js.src/modules/__tests__/publish-workflow.js showed helper runSetTargets({ path, repo, version, workspace = "" }) at line 30, environment values CRAFT_PUBLISH_VERSION and CRAFT_PUBLISH_WORKSPACE at lines 42-43, extraction of state_file= at line 53, expected workflow step name Resolve CI-approved release revision at line 66, and checkout ref ${{ steps.release-revision.outputs.revision }} at line 81.