Dashboard › publish › Distillation
4df9af1a-9c12-4882-bf3c-7d1d3ee92f7d["lore_tm_v1_O-6WXzNiOJ1J4FXGhzWAbphFM9NPzOLybBqQiF-QN5M","lore_tm_v1_yfnu0ji-4MJE5UNB4gPWQEvI9rYR5p5JM13-buQsOhc","lore_tm_v1_zxAn5qDq-7PalWWea_3wVn3d8yvaJKm_3YMM3Wdp2Ho","lore_tm_v1_oCM7Pi9HGdhNwU7qFtK-lFUnt7UuWcvfrAWbv8Ry_Jg","lore_tm_v1_cuIcnOl_F9JphHqeO7gg1WRtblromQYd1lL0uT8wdY4","lore_tm_v1_LCqNwFeivWND7Qgl0Do3Uy0u51FAAQHpE7E4U-L6sW4","lore_tm_v1_k5eoUGnzazwQym7DneLDwburkoSpc5_yxNOlcFHVtgk","lore_tm_v1_y57V5ZfiDLG0FyyfqkL7vukoz6RvpXpDNiAJULhr55o","lore_tm_v1_RSUE7U9AmZ-Dnt0bxvWiga6JLQLkZggs-dhmP1K5eFw","lore_tm_v1_Pf8O1Kk6eYTLEfgzLd1JwWuBqnX2GbugRofSfb0ztds","lore_tm_v1_lDSLVbtcvqqHlQ1SE-EAwZuzN1k7Uvneqgw6EtVPrsg","lore_tm_v1_qLqWKjI_A946TUMkwM6RPfF64-1jxCO3gSzdvaiNxY4"]
Date: Sep 10, 2026
/home/byk/Code/getsentry/publish/src/publish/post-result.js: main() injects context = github.context, octokit = github.getOctokit(getGitHubToken()), report = processEndState, and status = process.argv.slice(2)[0]; parses process.env.PUBLISH_ARGS as JSON, warns "Could not parse publish inputs; reporting without them" on failure, calls report({ context, octokit, inputs, status }), sets process.exitCode = 1 for uncaught errors, and exports { main }./home/byk/Code/getsentry/publish/src/publish/post-workflow-details.js: gets github.context and an Octokit client using getGitHubToken(), then calls postWorkflowDetails({ context, octokit })./home/byk/Code/getsentry/publish/src/publish/update-issue.js: main() gets GitHub context and Octokit, parses process.env.PUBLISH_ARGS, warns "Could not parse publish inputs; skipping target update" on malformed JSON, calls updateIssue({ context, octokit, inputs }), sets process.exitCode = 1 for uncaught errors, and exports { main }./home/byk/Code/getsentry/publish/src/libs/github.js: getGitHubToken() returns process.env.GITHUB_TOKEN or throws No "GITHUB_TOKEN" environment variable found. Please ensure the workflow is configured correctly; module exports getGitHubToken./home/byk/Code/getsentry/publish/src/modules/__tests__/approval-attestation.js, containing Vitest coverage for createApprovalAttestation, createCiReadyAttestation, currentAcceptedEvent, hasApprovalAttestation, hasCiReadyAttestation, parseApprovalAttestation, and requestDigest.currentAcceptedEvent() selects the latest accepted labeling event, normalizes numeric GitHub event ID 29503999078 to string "29503999078", returns null after a newer accepted unlabeled event, and fails closed for malformed event ID "not-an-event-id".<!-- publish-approval not-base64 -->, stale attestations, mismatched issues, and a later switch to the dry-run label are rejected.sentry-internal-app[bot] succeeds for accepted event { actor: "contractor", eventId: "200" }, while accepted event ID "201" or CI-ready actor "contractor" fails./home/byk/Code/getsentry/publish/src/modules/__tests__/approval-authorizer.js: authorizeApproval() directly rejects getsantry[bot] and sentry-release-bot[bot] without permission lookup even when getsentry/sentry-javascript is auto-approved; getsantry[bot] is also rejected when the release repository is outside the allowlist.authorizeApproval() tests allow target-repository collaborator roles "write", "maintain", and "admin" and reject "none", "read", "triage", "Elevated Bot", and undefined; permission lookup receives { owner: "getsentry", repository: "sentry-javascript", username: "contractor" }.authorizeApproval() resolves unqualified title publish: sentry-javascript/packages/core@10.0.0 against getsentry/sentry-javascript; malformed titles publish: @1.0.0 and publish: getsentry/sentry-javascript return { authorized: false, repository: null } without querying GitHub, while permission lookup error "Not Found" is propagated./home/byk/Code/getsentry/publish/src/modules/__tests__/ci-poller-input.js: getCiPollerInput() parses both publish: getsentry/toolkit/cli@1.2.3 and publish: toolkit/packages/cli/v2@1.2.3 into repo: "getsentry/toolkit", revision: "7e5ca7ed5581552de066e2a8bc295b8306be38ac", version: "1.2.3", and a requestDigest derived from the issue body, labels, and title./home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml via join(__dirname, "../../../.github/workflows/ci-poller.yml") and requires name: Get publish code, path: .__publish__, and node .__publish__/src/publish/resolve-ci-poller-input.js; it forbids the old grep -oP '(?<=commit/ parsing.getCiPollerInput() validation tests reject unsafe repository identities -toolkit, ., .., and __proto__ with "Invalid publish issue repository"; invalid versions --config and 1.2 with "Invalid publish issue version"; malformed identities in publish: getsentry/@1.2.3 and publish: getsentry/toolkit$@1.2.3 with "Invalid publish issue title"; and unsafe paths containing ../other, ./other, __proto__/other, or --config with "Invalid publish issue path", all before CI API calls.../../../.github/workflows/ci-poller.yml, mocked current-accepted-event.js, CI-ready recording modes including "failure" and "malformed", state/log files, and cases including "revokes approval when the rewrite response has no body" and "CI-ready proof output is malformed"./home/byk/Code/getsentry/publish/src/modules/__tests__/details-from-context.js: detailsFromContext() parses issue publish: getsentry/sentry@21.3.1 into { dry_run: "", merge_target: "custom-branch", path: ".", repo: "sentry", targets: ["github", "npm[@sentry/node]", "docker[latest]"], version: "21.3.1" }.detailsFromContext() tests accept version "4.2.6+sentry1", treat merge target (default) as merge_target: "", use only the canonical request-header merge target despite a trailing Merge target: decoy, and retain concrete checkout suffix ./packages/cli for publish: getsentry/toolkit/packages/cli@1.2.3.parsePublishTitle() tests map publish: getsentry/sentry-javascript/packages/core@10.0.0 to { path: "/packages/core", repo: "sentry-javascript", version: "10.0.0" } and legacy publish: sentry-javascript@10.0.0 to { path: "", repo: "sentry-javascript", version: "10.0.0" }.detailsFromContext() validation tests reject title publish: getsentry/toolkit @1.2.3 and version path syntax publish: getsentry/toolkit@1.2.3/other with "Invalid publish issue title"; paths containing ../other or ./other with "Invalid publish issue path"; repositories -toolkit, ., .., and __proto__ with "Invalid publish issue repository"; versions --config and 1.2 with "Invalid publish issue version"; and missing issue payload with "Issue context is not defined"./home/byk/Code/getsentry/publish/src/modules/__tests__/process-end-state.js: for status "failure", processEndState() creates exactly 1 comment linking to run 1234 with ?check_suite_focus=true#step:8 and a branch-deletion link for version 21.3.1; for "cancelled", it creates exactly 1 analogous "Publish workflow cancelled." comment.processEndState() success tests require exactly 1 comment with Published successfully: [run#1234](https://github.com/getsentry/sentry/actions/runs/1234) and exactly 1 issue update to { issue_number: "211", owner: "getsentry", repo: "publish", state: "closed" }; issue closure must occur before workflow lookup and commenting, including when getWorkflowRun later throws "unavailable".processEndState() rejects an undefined status with "Unknown status: 'undefined'" and performs 0 comment creations and 0 issue updates./home/byk/Code/getsentry/publish/src/modules/__tests__/publish-location.js./home/byk/Code/getsentry/publish/src/modules/__tests__/publish-location.js tests resolvePublishLocation(): exact case-sensitive workspace path ./packages/CLI among ["packages/cli", "packages/CLI"] resolves to { path: ".", workspace: "packages/CLI" }; non-exact suffixes ./packages and ./packages/cli remain checkout paths; root "." remains { path: "." }.resolvePublishLocation() tests reject unsafe publish paths "./.", "./..", and "./packages/../other" with "Invalid publish path."; invalid discovery workspace "cli-日本語"; and unsafe workspace names ., .., packages/./cli, packages/../cli, packages/__proto__/cli, packages/-cli, packages/foo], packages/foo!, and packages/foo^ with "Craft workspace discovery returned an invalid workspace list."./home/byk/Code/getsentry/publish/src/modules/__tests__/release-revision.js: getReleaseRevision() extracts lowercase 40-character SHA 7e5ca7ed5581552de066e2a8bc295b8306be38ac from the canonical request-header View check runs URL for getsentry/toolkit, accepting CRLF bodies and a URL without a trailing slash.getReleaseRevision() tests reject a URL lacking /checks, a link for getsentry/other, decoy or embedded check-runs links outside the request header, a complete Quick links block outside the request header, and a complete request header not at the start of the issue; errors are "Expected a View check runs link for getsentry/toolkit" or "Expected exactly one View check runs link in Quick links" as applicable.updateReleaseRevision() replaces only the canonical request-header SHA while preserving CRLF and trailing content; replacement SHA "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" succeeds, while uppercase 40-character, 39-character, and 41-character values are rejected with "Release revision must be a lowercase 40-character SHA.".