Distillation

Date: Aug 26, 2026

• 🟡 (13:17) Read-only review workspace locations confirmed: /home/byk/Code/getsentry/craft, /home/byk/Code/getsentry/craft-workspace-action-propagation, and /home/byk/Code/getsentry/publish-workspace-acceptance.
• 🟡 (13:17) Craft worktree feat/workspace-action-propagation is based at 21270a1 (feat(config): add release workspaces); uncommitted changes: .github/workflows/release.yml, action.yml, src/commands/__tests__/publish.test.ts, src/commands/publish.ts, plus untracked src/__tests__/action.test.ts. Reported stat for tracked files: 119 insertions and 5 deletions across 4 files.
• 🟡 (13:17) Publish worktree feat/workspace-acceptance is based at 83d210b (build(deps): bump js-yaml from 4.3.0 to 4.3.1 (#9174)); uncommitted changes: .github/workflows/publish.yml, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, and src/modules/update-issue.js. Reported stat: 244 insertions and 40 deletions across 5 files.
• 🔴 (13:17) Craft repository package-management convention: always use pnpm; never use npm or yarn.
• 🟡 (13:17) Craft repository uses Volta-managed Node.js v22.12.0; dependencies install with pnpm install --frozen-lockfile.
• 🟡 (13:17) Craft development commands: pnpm build outputs dist/craft; pnpm test runs Vitest tests; pnpm lint runs ESLint; pnpm fix auto-fixes lint; manual testing is pnpm build && ./dist/craft.
• 🟡 (13:17) Craft code conventions: TypeScript throughout; Prettier 3.x configured for single quotes and no arrow parentheses in .prettierrc.yml; ESLint 9.x flat configuration in eslint.config.mjs using typescript-eslint; unused variables prefixed _ are permitted.
• 🟡 (13:17) Craft dry-run architecture requires destructive git operations through getGitClient() from src/utils/git.ts or createGitClient(directory); GitHub API through getGitHubClient() from src/utils/githubApi.ts; file writes through safeFs from src/utils/dryRun.ts; and other actions through safeExec()/safeExecSync() from src/utils/dryRun.ts. Direct simple-git imports and new Octokit() are lint-restricted except wrapper modules with explicit ESLint disable.
• 🟡 (13:17) Publish repository is a GitHub Actions-based multi-project Sentry release-approval system using Craft; it is pure CommonJS JavaScript on Node.js 24.0.0, with source under src/libs/, src/modules/, and src/publish/.
• 🟡 (13:17) Publish repository package manager is Yarn classic v1.22.22, Volta-pinned in package.json; npm must not be used. Commands: yarn install, yarn test, yarn test:watch, yarn test src/modules/__tests__/update-issue.js, yarn test -t "pattern", yarn lint, and yarn prettier.
• 🟡 (13:17) Publish code conventions: kebab-case filenames such as details-from-context.js and update-issue.js; camelCase variables/functions such as detailsFromContext and publishRepo; UPPER_SNAKE_CASE constants such as TARGETS_SECTION_PARSER_REGEX; CommonJS require/module.exports source modules and ES Modules test files; Prettier default formatting with double-quoted strings and required semicolons.
• 🔴 (13:17) Publish error-handling convention: always throw for unexpected values, including a default switch branch such as throw new Error(\Unknown status: '${status}'`)`.
• 🟡 (13:17) Publish error handling also requires descriptive early guard-clause errors and checking file existence before reads, e.g. if (!fs.existsSync(CRAFT_STATE_FILE_PATH)) { return; }.
• 🟡 (13:17) Publish tests use Vitest v4.0.0 with globals enabled and auto-cleared mocks; recommended mocking uses vi.mock(), including mocking dependencies before requiring the module under test.
• 🟡 (13:17) Craft .github/workflows/release.yml change adds optional workspace inputs to both workflow_dispatch (“Named Craft release workspace to prepare and publish”) and workflow_call; the Request publish step now exports WORKSPACE: ${{ inputs.workspace }} alongside CHANGELOG_FILE, TARGETS, RESOLVED_VERSION, RELEASE_BRANCH, RELEASE_SHA, RELEASE_PREVIOUS_TAG, SUBDIRECTORY, MERGE_TARGET, and PUBLISH_REPO.
• 🟡 (13:17) Craft src/commands/publish.ts change adds a security migration warning for legacy cwd state file .craft-publish-${newVersion}.json: Craft no longer reads it because repository contents can be PR-attacker-influenced and could prepopulate the “already published” set; publish state is now stored at publishStateFile under $XDG_STATE_HOME/craft/, and workflows pre-seeding targets must write to the new location.
• 🟡 (13:17) Craft src/commands/publish.ts imports existsSync, mkdirSync, and readFileSync from fs; its shown PublishOptions includes remote, optional rev, optional mergeTarget, optional target, newVersion, noMerge, keepDownloads, noStatusCheck, keepBranch, and noGitChecks.
• 🟡 (13:17) Craft history shown includes 4da4a25 chore: replace deprecated trimRight() with trimEnd() (#9012).