Distillation

Date: Sep 8, 2026

• 🟡 (20:25) src/modules/approval-attestation.js defines three HTML-comment/base64url attestation formats: approval prefix <!-- publish-approval , auto-approval prefix <!-- publish-auto-approval , and CI-ready prefix <!-- publish-ci-ready ; all terminate with -->.
• 🟡 (20:25) createAttestation(prefix, value) serializes value with JSON.stringify, encodes it with Buffer.from(...).toString("base64url"), and embeds it between the supplied prefix and ATTESTATION_SUFFIX.
• 🟡 (20:25) requestDigest({ body, labels, title }) rejects a non-string body or non-array labels with Error("Invalid publish request"); otherwise it returns a SHA-256 hex digest of JSON containing body, title, and dryRun, where dryRun is true exactly when labels.some((label) => label.name === "dry-run").
• 🟡 (20:25) createApprovalAttestation({ actor, eventId, issue }) creates an approval attestation carrying actor, eventId: String(eventId), requestDigest: requestDigest(issue), and title: issue.title.
• 🟡 (20:25) createAutoApprovalAttestation({ autoApprover, issue }) creates an auto-approval attestation carrying autoApprover, requestDigest: requestDigest(issue), and title: issue.title.
• 🟡 (20:25) createCiReadyAttestation({ acceptedEvent, ciReadyActor, issue }) creates a CI-ready attestation carrying acceptedActor: acceptedEvent.actor, acceptedEventId: String(acceptedEvent.eventId), ciReadyActor, requestDigest: requestDigest(issue), and title: issue.title.
• 🟡 (20:25) parseAttestation(body, prefix) finds the first prefix and following -->, base64url-decodes and JSON-parses the enclosed data, and returns null for an absent prefix/suffix or decoding/parsing failure.
• 🟡 (20:25) Typed parsers validate attestation payload fields: parseApprovalAttestation() requires string actor, eventId, requestDigest, and title; parseAutoApprovalAttestation() requires string autoApprover, requestDigest, and title; parseCiReadyAttestation() requires string acceptedActor, acceptedEventId, ciReadyActor, requestDigest, and title; each returns null when validation fails.
• 🟡 (20:25) compareEventIds(left, right) strips leading zeroes (using "0" for an all-zero ID), requires both normalized IDs to be decimal digits or throws Error("Invalid issue event ID"), then compares first by normalized length and then with localeCompare; this avoids numeric conversion for GitHub issue event IDs.
• 🟡 (20:25) currentLabeledEvent(events, labelName) filters to labeled events whose event.label?.name equals labelName, whose id is a string or number, and whose actor has login; it selects the greatest ID via compareEventIds() and returns { actor: event.actor.login, eventId: String(event.id) }, or null when no qualifying event exists or ID comparison throws. currentAcceptedEvent(events) and currentCiReadyEvent(events) specialize this for "accepted" and "ci-ready".
• 🟡 (20:25) hasApprovalAttestation({ comments, event, issue, attestationAuthor }) requires a comment authored by attestationAuthor containing an approval attestation whose actor, eventId, request digest, and title exactly match the current event and issue.
• 🟡 (20:25) hasAutoApprovalAttestation({ autoApprover, attestationAuthor, comments, issue }) requires a comment authored by attestationAuthor containing an auto-approval attestation whose autoApprover, request digest, and title exactly match.
• 🟡 (20:25) hasCiReadyAttestation({ comments, acceptedEvent, ciReadyEvent, issue, attestationAuthor }) requires a comment authored by attestationAuthor containing a CI-ready attestation whose accepted actor/event ID, CI-ready actor, request digest, and title exactly match the accepted event, CI-ready event, and issue.
• 🟡 (20:25) src/modules/approval-attestation.js exports: compareEventIds, createApprovalAttestation, createAutoApprovalAttestation, createCiReadyAttestation, currentAcceptedEvent, currentCiReadyEvent, currentLabeledEvent, hasApprovalAttestation, hasAutoApprovalAttestation, hasCiReadyAttestation, parseApprovalAttestation, parseAutoApprovalAttestation, parseCiReadyAttestation, and requestDigest.