Distillation

Current State

• Date: Sep 8, 2026. Two repository threads remain relevant:
  • Publish PR #9339 is complete locally and pushed:
    • Worktree: /home/byk/Code/getsentry/publish-workspace-acceptance
    • Branch: feat/workspace-acceptance
    • Remote/PR head: fd1e1156ae878a12a276af401a15a656bfff8127 (fd1e115 fix: address publish workspace review feedback)
    • PR: https://github.com/getsentry/publish/pull/9339, open/non-draft into main, still REVIEW_REQUIRED as of Sep 8 13:02.
    • Final replacement read-only audit completed with MERGE, no findings, at Sep 8 04:14–04:15. All repair/verification/audit tasks completed.
    • Commit fd1e115 was pushed Sep 8 13:01, advancing remote feat/workspace-acceptance from a81ab03.
    • Six GitHub review threads remain unresolved administratively, though all six were addressed by fd1e115; next GitHub actions are reply/resolve threads and obtain updated review. At Sep 8 13:02, most checks were in progress; only Dependency Review and Socket Project Report had completed successfully.
  • Craft PR #872 is the active task:
    • Worktree: /home/byk/Code/getsentry/craft-workspace-action-propagation
    • Branch: feat/workspace-action-propagation
    • Current pushed PR head: f174ceafa57355e71617f32ba1b0a030953be0a2 (f174cea test: describe workspace paths accurately)
    • PR: https://github.com/getsentry/craft/pull/872, now non-draft/ready for review into master; mergeable: MERGEABLE, but mergeStateStatus: BLOCKED and reviewDecision: REVIEW_REQUIRED.
    • The original review terminology correction was committed/pushed Sep 8 16:03. It changed only src/__tests__/config.test.ts, renaming allows legacy workspace names to allows multi-segment workspace paths, while retaining the valid cli/v2 behavior.
    • All original review threads were resolved at Sep 8 17:00, including the outdated “legacy workspace names” request. A fresh approval remains required; existing reviews are two COMMENTED reviews by BYK, not approvals.
    • Independent read-only audit against origin/master/merge base 21270a1d12a60b461c51fba93bd076b90d9cf4af completed Sep 8 16:59 with verdict MERGE, no MUST-FIX or CONCERN findings.
    • All CI/security checks completed successfully, including Build & Test (Node 22, Node 24, Build, Build Docs), Changelog Preview/Semver Impact, CodeQL, Dependency Review, Docs Preview, license compliance, Lint, Secret Scan, Warden/security review, image, Socket Security, and Semgrep. Seer Code Review completed successfully at Sep 8 17:03:57Z with no findings.
    • New active blocker: Cursor Bugbot completed Sep 8 17:06:43Z as NEUTRAL but opened one valid medium-severity review finding, bug ID 294d500e-a01e-4627-af9f-b3d497c9b290, discussion https://github.com/getsentry/craft/pull/872#discussion_r3960382720. It identifies that getWorkspaceGlobMatches() calls realpathSync() on each glob candidate before checking whether it is a directory; a broken symlink matched by packages/* throws ENOENT instead of being ignored.
    • Current in-progress fix: add a regression test adjacent to does not expand workspace globs through symlinked directories in src/__tests__/config.test.ts, reproduce the failure, then narrowly reorder/guard candidate resolution so disappeared/broken entries are skipped without weakening lexical/physical containment checks. A test-file modification was applied at Sep 8 17:10, but its exact content and test result have not yet been inspected/verified. Do not claim the Bugbot issue is fixed, commit, pushed, or resolved yet.
    • Merge gate is closed pending Bugbot finding repair, verification, push of a new head, new check/bot results, resolution of the new thread, another independent review as appropriate, and a fresh approval. Do not merge.
• User directives:
  • Always load repo-setup before situation skills.
  • Action publish titles always carry the full concrete workspace path.
  • .sentryclirc resolution must always check global locations as fallback after walking upward from cwd.
  • Workspace/CLI parsing must never interpret flags such as --workspace --dry-run as a workspace name.
  • For CLI scanning, excluded directories such as node_modules must never be opened; default walks must not re-enter directories, including via symlinks when following them.
• Background tasks:
  • ses_f7ecc9434ffeledouaoJSXmmtQ, started Sep 8 13:28 for CLI discovery inspection, completed Sep 8 13:49 with no directly reusable findings.
  • ses_f7e3cf790ffean2YR8MT3hLull, started Sep 8 16:04 for independent Craft audit, completed Sep 8 16:59 with MERGE.
  • Several short scheduled follow-ups checked Craft bot status between Sep 8 17:01–17:08. They are superseded by the current Bugbot finding/fix work.
• Outpost/Jared project operating context:
  • Root AGENTS.md directs autonomous GitHub coding work in /workspace/repo, pipeline: triage → explore → plan → implement → review → ship; worker is a deprecated alias of implement.
  • For target repos, read their AGENTS.md / CONTRIBUTING.md first; long-term Outpost knowledge is in .lore.md if present.
  • Outpost operator-chat turns skip triage and should treat the request as the task/conversation response.
  • Skills are .agents/skills/, generated from canonical skills/ by scripts/sync-skills.mjs.
  • Model tiers: heavy triage/plan/review = Jared / Claude Opus 4.8; light = Jared / xAI Grok 4.3; explore = OpenAI gpt-5-mini; implement = Moonshot kimi-k2.7-code; ship = xAI Grok grok-build-0.1.

Key Decisions

• Craft concrete workspace contract
  • Canonical Craft title identity is path-only: publish: getsentry/<checkout-repository>/<full-concrete-workspace-path>@<version>.
  • Legacy JSON-qualified workspace-title syntax was removed. getsentry/ remains optional only for parsing existing issues.
  • cli/v2 is a valid concrete multi-segment workspace directory path, not legacy compatibility syntax. Removing support would violate the full-path title/selection contract and break valid paths such as packages/CLI.
  • Test terminology was corrected rather than behavior removed: use “allows multi-segment workspace paths.”
  • Safe repository/path token policy is ASCII [A-Za-z0-9_.-]+, excluding ., .., __proto__, and segments beginning -; versions are Craft-compatible semantic versions and may contain + build metadata.
  • Semantic token/semver validation remains in src/modules/publish-issue-validation.js; Peggy remains syntactic, and poller/controller validation remains required.
  • After exact revision checkout, matching is exact and case-sensitive: root "." remains root; only exact ./<workspace> discovery matches are workspaces; otherwise suffix remains safe checkout path.
• Craft configuration/workspace discovery
  • Top-level workspaces: keys may be literal concrete paths or glob patterns. Patterns expand to concrete directories relative to .craft.yml; selected release runs require one concrete path through --workspace <path> or CRAFT_WORKSPACE.
  • craft workspace list outputs concrete workspace paths as a JSON array for automation.
  • Workspace path constraints: nonempty ASCII path segments containing letters, digits, ., _, and -; no ., .., __proto__, leading -, backslashes, absolute paths, unsafe glob syntax, or matching files. Overlapping workspace keys/patterns are rejected.
  • Workspace configuration cannot use github.projectPath; workflows cannot provide both path and a workspace.
  • Explicit workspace root is threaded through remote config loading; prepare --config-from resolves relative config against git rev-parse --show-toplevel.
  • Workspace glob support includes *, ?, character classes/negated classes, globstar, finite balanced braces; extglob is rejected.
  • Nested-brace expansion fails closed; existing matching requires lexical and physical realpath containment, directory-only behavior, node_modules exclusion, sorted POSIX paths, and ambiguity rejection before dedupe.
  • Pending Bugbot remediation decision: broken/racy glob candidates must be skipped rather than causing realpathSync failures, but the fix must preserve the existing fail-closed behavior for unsafe patterns and all lexical/realpath containment guarantees. The intended narrow approach is to inspect directory status before resolving candidate realpath and/or catch only candidate disappearance/broken-link errors.
  • CLI’s scan walker is not a reusable replacement for Craft workspace expansion. Craft resolver is synchronous, deterministic, glob/config-oriented, and stricter regarding exact paths and release safety. Adopting CLI async walking would require async propagation through config loading, while preserving sorted output, exact error behavior, and symlink containment.
  • Do not add parallel scanning without profiling evidence. CLI parallel walking is suited to broad content scans, has completion-order/channel complexity and about 7 ms per-file overhead, and is beneficial only for large exhaustive scans. Bounded concurrency/cancellation concepts may be borrowed only if workspace expansion becomes proven bottleneck.
• GitHub target/release workspace behavior
  • Workspace config example requires minVersion: 2.29.0, global GitHub { owner: getsentry, repo: toolkit }, packages/* configured with releaseBranchPrefix: release/cli and GitHub tagPrefix: "cli@", and tools/mcp with releaseBranchPrefix: release/mcp and GitHub tagPrefix: "mcp@".
  • If one release unit has multiple GitHub targets with differing tagPrefix values, Craft uses the first prefix for read-path operations and logs a warning. Independent products should use separate release workspaces.
  • GitHub’s Latest badge/release is repository-wide rather than tag-prefix-scoped. isLatestRelease uses the repository current Latest, so Latest may move between monorepo products; tags, changelogs, release branches, and version detection remain per-product.
• Release/publish workflow security
  • Required order: title parse/validate → issue-body revision authority parse → exact authoritative revision checkout → optional root .craft.yml workspace discovery → full-suffix classification → craft publish <version> --rev <revision>.
  • Craft state stays outside target checkout in $GITHUB_WORKSPACE/.craft-state/craft; state identity uses physical container cwd SHA-1, lossless base64url workspace identity, and conditional lossless version identity to avoid case/build-metadata collisions.
  • CRAFT_PUBLISH_STATE_GITHUB_REPO identifies checkout repository, never workspace release-repository override.
• Intentional latest Craft image
  • Rejected image pinning: controller uses getsentry/craft:latest because it must understand formats in the exact checked-out revision. CI-approved SHA plus craft publish --rev bind the actual release revision; a fixed image cannot safely support all historical/configured workspace formats.
  • Tests intentionally require latest and reject getsentry/craft:2.31.0.
  • Craft release remains an intentional deployment prerequisite for Publish: it must release with both workspace list and --rev; when root .craft.yml exists, discovery failure remains fail-closed because compact fallback could silently misroute a workspace request.
• Workflow JSON handoffs
  • @actions/core.setOutput() cannot safely transmit plain objects to fromJSON(): object outputs must use JSON.stringify.
  • PUBLISH_ARGS absent/empty parses as "{}"; workspace-list input as "[]". Required repo and path checks provide contextual errors instead of raw JSON.parse syntax errors.
  • resolve-release-revision.js missing repo error: Publish input must define a repository.
  • discover-location.js missing path error: Publish input must define a path.
• Peggy revision and merge-target authority
  • src/modules/publish-issue-title.peggy is canonical for PublishIssueTitle, ReleaseRevision, and CheckRunsLinkCount; generated parser start rules are exactly ["PublishIssueTitle", "ReleaseRevision", "CheckRunsLinkCount"].
  • ReleaseRevision requires canonical body-start header: requester, required Merge target, Quick links, View changes, then one repository-bound checks URL.
  • Parser returns { repo, mergeTarget, revision }; details-from-context.js gets Merge target solely through getReleaseRevisionDetails(), not arbitrary body regex scanning.
  • (default) becomes empty Craft merge_target; appended/decoy Merge target: fields cannot override canonical header.
  • Canonical Merge target grammar is constrained to (default) or documented branch-token characters: letters, digits, _, ., /, and -; unrestricted arbitrary non-newline values such as main; not-a-branch are rejected.
  • CheckRunsLinkCount counts all literal - [View check runs]( occurrences across body to reject inline/blockquote/trailing decoys.
  • Exact retained errors:
    • Count mismatch: Expected exactly one View check runs link in Quick links for getsentry/${repo}.
    • Header/repository parse failure: Expected a View check runs link for getsentry/${repo} in the publish issue body.
    • Invalid replacement SHA: Release revision must be a lowercase 40-character SHA.
• Revision/body preservation
  • updateReleaseRevision() accepts only /^[0-9a-f]{40}$/, then replaces parser-recorded [start,end) SHA offsets only.
  • CI-poller cannot use Bash command substitution for body transfer because it strips trailing newlines. It uses jq -jr/jq -ejr file-backed body input/output and gh issue edit --body-file.
  • Branch-move rewrite fails closed: resolver must succeed; .issueBody must be a nonempty string; only then can the body file be submitted to gh issue edit. Invalid/malformed JSON, top-level non-object/scalar values, missing property, non-string (null, boolean, number), empty string, JSON failure, and resolver failure skip without edit.
  • Each per-issue poller iteration is a cleanup subshell with an EXIT trap for body_file, resolver_output_file, and updated_body_file; failure/skip paths use exit 0 inside the subshell rather than invalid continue, so cleanup occurs before outer while advances.
• Generated documentation
  • Generator extracts grammar only between // BEGIN TITLE GRAMMAR / // END TITLE GRAMMAR; docs use <!-- BEGIN GENERATED TITLE GRAMMAR --> / <!-- END GENERATED TITLE GRAMMAR -->.
  • Generator fails closed for missing, duplicate, or malformed marker-like documentation fragments—not merely exact duplicate complete pairs—to ensure one unambiguous generated grammar region.
  • Docs explicitly state Merge target is required and its restricted branch-token contract.
• Checkout scope
  • Scoped controller/target checkouts in .github/workflows/publish.yml and controller checkout in .github/workflows/ci-poller.yml use actions/checkout@v7.
  • Do not upgrade unrelated .github/workflows/test.yml or .github/workflows/auto-approve.yml in this PR; that is unrelated scope expansion.
• Sentry CLI operational context
  • Before working in CLI code, read packages/cli/AGENTS.md and .cursor/rules/ultracite.mdc.
  • CLI lives in packages/cli of a pnpm workspace; it is Node.js/pnpm/Stricli, with docs at apps/cli-docs.
  • It has no runtime dependencies: packages must be added with pnpm add -D <package> and remain in devDependencies; CI enforces this with pnpm run check:deps.
  • Use Node APIs, not Bun: no Bun.*, bun:test, or Bun CLI. Use node:fs/promises read/write APIs, node:fs existsSync, child-process spawn/execFile/execSync, src/lib/which.ts, src/lib/scan/, and node:timers/promises.
  • Create directories with mkdirSync(dir, { recursive: true, mode: 0o700 }); prefer array-argument execFileSync for user-controlled values to avoid shell injection.
  • Use direct @sentry/api API-response types rather than redundant Valibot schemas in src/types/sentry.ts.
  • Command conventions: import buildCommand from ../../lib/command.js, use async *func() generators, yield new CommandOutput(data), return { hint }, and let shared output rendering serialize the same data. Do not add custom JSON flags, write stdout manually, branch on flags.json, or write stderr from command files; use logger diagnostics and formatter modules.
  • Route groups import buildRouteMap from ../../lib/route-map.js, which supplies aliases such as list→ls, view→show, delete→remove/rm, and create→new.
  • .sentryclirc resolution already walks upward from cwd then applies global fallback locations afterward, using getGlobalPaths(), applyGlobalFallbacks(), tryApplyFile(), walkUpFrom(cwd), and loadSentryCliRc(). Global paths are cached in globalPaths, and tests reset it when SENTRY_CONFIG_DIR changes.
  • packages/cli/src/lib/walk-up.ts provides async function* walkUpFrom(startDir: string), resolving the start path, yielding absolute ancestors, and using realpath() plus a seen set to stop on broken/denied paths or symlink cycles.
  • packages/cli/src/lib/scan/walker.ts is a streaming DFS file scanner, not workspace discovery. It applies IgnoreMatcher before descent, ignores node_modules-like directories without opening them, emits sorted POSIX-normalized regular files only, skips symlinks unless enabled, and seeds visited inodes with root when following symlinks to prevent subtree re-entry. It supports deterministic serial walking and bounded parallel exhaustive scanning.

Technical Changes

Craft worktree: /home/byk/Code/getsentry/craft-workspace-action-propagation

• Completed/pushed workspace implementation:
  • Branch feat/workspace-action-propagation
  • Commit d48b906 feat: support concrete release workspaces
  • Created Sep 5, 2026 03:34; pushed Sep 5 03:43, range 4862056..d48b906
  • 9 files, 684 insertions / 44 deletions:
    • action.yml
    • docs/src/content/docs/targets/github.md
    • src/__tests__/action.test.ts
    • src/__tests__/config.test.ts
    • src/commands/prepare.ts
    • src/config.ts
    • src/schemas/project_config.ts
    • src/utils/__tests__/publishState.test.ts
    • src/utils/publishState.ts
• Terminology correction:
  • Commit f174cea test: describe workspace paths accurately
  • Committed/pushed Sep 8 16:03; remote advanced d48b906..f174cea.
  • Exact remote head: f174ceafa57355e71617f32ba1b0a030953be0a2.
  • Changed src/__tests__/config.test.ts only: one insertion/one deletion, rename from allows legacy workspace names to allows multi-segment workspace paths.
  • Retained test behavior: validateConfiguration({ workspaces: { 'cli/v2': {} } }) does not throw.
• Uncommitted/current Bugbot repair work
  • Cursor Bugbot finding at src/config.ts#L249-L260: candidate filter calls realpathSync(resolvedMatch) at line 252 before lstatSync(resolvedMatch).isDirectory() at line 259.
  • A broken symlink candidate from a workspace pattern such as packages/* consequently throws ENOENT, failing workspace listing/config resolution instead of being skipped.
  • Planned regression belongs beside existing does not expand workspace globs through symlinked directories test in src/__tests__/config.test.ts.
  • Tool reported modification of src/__tests__/config.test.ts at Sep 8 17:10, but the new content/result has not yet been reviewed. Production src/config.ts was not yet confirmed modified.
• Important Craft implementation:
  • loadConfigurationFromString(configContent, workspaceDirectory = process.cwd()); config-from resolves against Git top-level.
  • src/config.ts:210-229: a concrete workspace matching multiple configured patterns throws ConfigurationError: Workspace "${workspaceName}" matches multiple workspace patterns: ${matchingKeys.join(', ')}.
  • src/config.ts:231-263: getWorkspaceGlobMatches() validates glob safety, uses globSync(... { absolute: false, cwd: root, dot: true, ignore: ['**/node_modules/**'], posix: true }), and currently admits sorted safe lexical/realpath-contained directories—but has the newly identified broken-symlink ordering bug.
  • src/config.ts:269-390 contains path/glob safety and balanced-brace helpers duplicating analogous project_config.ts helpers. isWorkspacePattern() uses hasMagic(... { magicalBraces: true }).
  • src/config.ts:392-409: isVersionGteMinVersion() is a pure config-resolution-safe check and returns false for absent/unparseable versions.
  • src/schemas/project_config.ts:208-215: WorkspaceSchema accepts release-unit fields and partial GitHub config but rejects workspace github.projectPath with Workspace github.projectPath is not supported.
  • src/schemas/project_config.ts:219-334: workspace glob safety rejects unsafe empty/dot/parent/prototype/leading-dash segments; supports safe glob magic and finite balanced brace alternatives; unsafe paths raise Workspace paths must use safe ASCII segments.
  • src/schemas/project_config.ts:322-334: literal multi-segment paths are accepted without normalization.
  • src/commands/prepare.ts:806-812 resolves remote config workspace globs relative to Git top-level; src/config.ts:597-606 accepts the explicit root for string config.
  • action.yml:74-92: validate before side effects; :191-224: clear inherited CRAFT_WORKSPACE; :245-275: emit complete exact titles.
  • src/utils/publishState.ts:51-105: preserve workspace/version identities losslessly.
• Craft schema details:
  • CalVerConfigSchema: optional offset: z.number() (default documented as 14) and optional format: z.string() (default %y.%-m; supports %y, %m, %-m).
  • VersioningConfigSchema: optional policy of auto, manual, or calver, plus optional calver.
  • ChangelogConfigSchema: string or object with optional filePath, policy (auto, simple, none), and scopeGrouping.
  • releaseUnitFields: optional github, targets, preReleaseCommand, postReleaseCommand, releaseBranchPrefix, changelog, changelogPolicy, requireNames, statusProvider, artifactProvider, versioning, and noMerge; noMerge defaults to true for compiled GitHub Actions with dist/.
  • WorkspaceSchema uses all optional release-unit fields, with partial workspace GitHub settings that inherit missing top-level values.
  • WorkspaceNameSchema errors:
    • Workspace name "__proto__" is not supported.
    • Workspace names cannot be "." or "..".
    • Workspace paths must use safe ASCII segments.
  • CraftProjectConfigSchema.superRefine() rejects top-level github.projectPath when workspaces exist with Workspace configurations cannot use github.projectPath..
• Craft verification:
  • Pre-commit verification Sep 4 22:52: full Vitest 61 files / 1197 pass / 1 skipped / 1198 total; lint 0 errors with 7 established unused-variable warnings; tsc --noEmit, format, build, and git diff --check passed.
  • Sep 8 13:57 focused command vitest run -- src/__tests__/config.test.ts actually ran the full suite: 61 test files passed, 1,197 tests passed, 1 skipped (1,198 total), duration 62.99s.
  • This run emitted established Vite/esbuild SSR warnings in src/targets/__tests__/symbolCollector.test.ts:58-60,68-70 that assignments to imported checkExecutableIsPresent will throw; it also logged remote-ref/branch fetch failures that used cached refs.
  • Independent audit Sep 8 16:59 ran: pnpm exec tsc --noEmit --incremental false; Prettier on every changed file; focused Vitest across 5 files with 141 passing; full Vitest across 61 files with 1,197 passing / 1 skipped; ESLint 0 errors. Five unchanged no-unused-vars warnings in publish.ts also exist on origin/master.
  • Audit noted one nonblocking coverage gap: no direct prepareMain mock assertion that --config-from passes git rev-parse --show-toplevel into workspace resolution; existing loadConfigurationFromString coverage verifies equivalent root contract.
• Craft PR #872 reviews:
  • Resolved directory-pattern request: docs/src/content/docs/targets/github.md:89, original line 87, comment PRRC_kwDOCDHbwM7pfr4E, created Sep 2 18:33:13 UTC.
  • Resolved outdated terminology request: src/__tests__/config.test.ts:164, original line 163, comment PRRC_kwDOCDHbwM7pftIQ, created Sep 2 18:33:53 UTC. Reply/resolve occurred Sep 8 17:00 at https://github.com/getsentry/craft/pull/872#discussion_r3960329900.
  • New unresolved Bugbot finding: src/config.ts#L249-L260, bug ID 294d500e-a01e-4627-af9f-b3d497c9b290, discussion https://github.com/getsentry/craft/pull/872#discussion_r3960382720.
• Other discovered Craft worktrees at Sep 8 13:15:
  • /home/byk/Code/getsentry/craft: b06435e4f20ff8cb0470de98ee113051978b3d63, byk/fix/commit-on-repo
  • /home/byk/.local/share/opencode/worktree/55fa901aca64a01fa4b5c2abce1c85c1c27475e7/calm-circuit: 5d533c854ad481c31162c4e003cabe23ac5e900a, feat/ci-ready-signal
  • .../calm-squid: 347ade0345dc9f46bce480600ca2beef66100c8f, fix/postcss-security-alert
  • .../stellar-falcon: fc4c1d00d721eb76d9ccc46f841cb2b4b03ed665, byk/fix/dependabot-alerts-865
  • .../swift-squid: 752a693b6ddc3d9b855ddb921e3f91d6e3a847b8, fix/flaky-zip-test
  • /home/byk/Code/getsentry/craft-vercel-prebuilt-output: 3f701f5458f5dee92c730b9c7352d1e5b6ef2b56, fix/vercel-prebuilt-output
  • /home/byk/Code/getsentry/craft-vercel-project-config: 3cceffbf4d6e697c535ec11f83652bcb11800a06, fix/vercel-project-config
  • /home/byk/Code/getsentry/craft-workspaces-schema: ab635721cdaee8a3fe5ec853505e68ff76f8b9c5, feat/workspaces-schema
  • /tmp/opencode/pr865: 51cab289873990824bcfc9c17e7309c430ea2059, byk/pr865-fixes; marked prunable because its gitdir points to a nonexistent location.
• GitHub reported 9 vulnerabilities on Craft’s default branch Sep 8 16:03: 7 high, 1 moderate, 1 low; https://github.com/getsentry/craft/security/dependabot.

Publish worktree: /home/byk/Code/getsentry/publish-workspace-acceptance

• Baseline PR/branch history:
  • PR #9339, feat/workspace-acceptance
  • Earlier commits: b658ffa fix: validate publish workspace JSON, 52ef600 feat: resolve compact workspace publish requests, a81ab03 feat: resolve workspace publish paths.
  • Baseline a81ab03 was pushed Sep 5 03:46 (52ef600..a81ab03), with 13 files / 308 insertions / 539 deletions and new src/modules/publish-issue-validation.js.
• Final review-fix commit:
  • fd1e115 fix: address publish workspace review feedback
  • Committed and pushed Sep 8 13:01; remote moved a81ab03..fd1e115.
  • Changed 21 files: 1,509 insertions / 96 deletions.
  • New files:
    • src/modules/__tests__/ci-poller-workflow.js
    • src/modules/__tests__/generate-publish-issue-title-parser.js
    • src/publish/__tests__/discover-location.js
    • src/publish/__tests__/resolve-location.js
    • src/publish/__tests__/resolve-release-revision.js
    • src/publish/discover-location.js
  • Other committed modified files:
    • .github/workflows/ci-poller.yml
    • .github/workflows/publish.yml
    • docs/publish-issue-format.md
    • scripts/generate-publish-issue-title-parser.js
    • src/modules/__tests__/details-from-context.js
    • src/modules/__tests__/publish-workflow.js
    • src/modules/__tests__/release-revision.js
    • src/modules/details-from-context.js
    • src/modules/publish-issue-title.js
    • src/modules/publish-issue-title.peggy
    • src/modules/release-revision.js
    • src/publish/inputs.js
    • src/publish/resolve-ci-poller-input.js
    • src/publish/resolve-location.js
    • src/publish/resolve-release-revision.js
• Existing/preserved functionality:
  • src/modules/publish-location.js validates safe paths/workspace names; discovery-invalid error: Craft workspace discovery returned an invalid workspace list. Exact matching is case-sensitive.
  • details-from-context.js and ci-poller-input.js validate title fields before state, checkout, Craft, network, or cross-repository API work.
  • Publish remains gated by fresh ci-ready, accepted + ci-ready, open issue, no pending/failed labels, 90-minute timeout.
  • Exact target checkout remains ref: ${{ steps.release-revision.outputs.revision }}, path __repo__, Release Bot token, fetch-depth: 0; craft publish ... --rev and state behavior remain preserved.
  • workflow_dispatch remains in ci-poller.yml, optional internal attempt default "0".
• Workflow input/discovery changes:
  • src/publish/inputs.js: core.setOutput("result", JSON.stringify(result)).
  • src/publish/resolve-location.js: parses PUBLISH_ARGS || "{}" and CRAFT_WORKSPACE_NAMES || "[]", serializes location output.
  • src/publish/resolve-release-revision.js: parses PUBLISH_ARGS || "{}" and requires repo.
  • New src/publish/discover-location.js exports getWorkspaceNames({ repositoryDirectory, exists = existsSync, execFile = execFileSync }) and discoverLocation(...); missing root .craft.yml returns []; root config invokes Docker/Craft workspace list; blank/malformed/non-array/unsafe lists fail closed; serialized output.
  • .github/workflows/publish.yml invokes node .__publish__/src/publish/discover-location.js with PUBLISH_ARGS and PUBLISH_REPOSITORY_DIRECTORY: __repo__.
  • .github/workflows/publish.yml:120 and :159, plus .github/workflows/ci-poller.yml:52, use actions/checkout@v7; unrelated test.yml:19 and auto-approve.yml:16 remain unchanged.
• Peggy/parser/revision implementation:
  • src/modules/publish-issue-title.peggy:7-34 contains title grammar markers; :36-85 contains canonical strict release header/merge-target parsing.
  • Header requires requester, Merge target, Quick links, View changes, and repository-bound checks URL with a lowercase SHA; supports LF/CRLF and optional terminal /checks/ slash; starts at body byte zero.
  • Sep 8 02:48 parser shape bug (NonNewline yielded merge-target character arrays) was fixed via string capture conversion; parser regenerated.
  • src/modules/release-revision.js:7-45 uses generated parser, globally counts duplicate check-runs link prefixes, validates repository binding, and indexed-replaces only canonical SHA offsets.
  • src/modules/details-from-context.js:54-75 draws Merge target only from canonical parser output.
• CI-poller exact-body/failure-safety:
  • src/publish/resolve-ci-poller-input.js reads UTF-8 PUBLISH_ISSUE_BODY_FILE when set, otherwise PUBLISH_ISSUE_BODY || "".
  • .github/workflows/ci-poller.yml:157-162 rejects invalid rewrite shapes and requires a nonempty string .issueBody.
  • src/modules/__tests__/ci-poller-workflow.js executes extracted actual workflow shell with fake node, mktemp, and gh.
  • Following the Sep 8 04:02 DO-NOT-MERGE audit finding, the harness was expanded to cover malformed resolver JSON and non-object/scalar rewrite responses, in addition to missing, non-string, and empty .issueBody, resolver failure, exact valid-body preservation, no issue edit on failures, and temporary-file cleanup. It covers six error/body-preservation paths.
• Generator/docs:
  • scripts/generate-publish-issue-title-parser.js:26-49 rejects missing, duplicate, and malformed marker-like generated documentation regions.
  • Parser/docs title grammar parity is in src/modules/publish-issue-title.peggy:7-34 and docs/publish-issue-format.md:12-41.
• Final verification/audits:
  • Sep 8 03:56: lint, generated check, full suite 14 files/92 tests, and git diff --check passed.
  • Sep 8 04:02 read-only audit found coverage gap for non-string/non-object/malformed resolver output; direct audit checks passed (git diff --check a81ab03, generated check, lint), but full test was intentionally not run under read-only constraint.
  • Sep 8 04:03: focused yarn vitest run src/modules/__tests__/ci-poller-workflow.js passed 1 file/6 tests in 704 ms. Full verification then passed: ESLint, generated check, Vitest 14 files/94 tests in 3.86s, and git diff --check.
  • Sep 8 04:14–04:15 final read-only audit returned MERGE with no CRITICAL/MAJOR/MINOR findings. It verified canonical body header/authoritative merge target, SHA parsing and duplicate prevention, byte-preserving rewrite, fail-closed poller updates/cleanup, parser/doc generation validation, JSON handoffs, scoped v7 checkouts, CI gating/manual dispatch/exact-SHA checkout/discovery/latest Craft, and diff hygiene.
  • That final read-only review deliberately did not execute full Vitest because src/modules/__tests__/ci-poller-workflow.js:40-49,146-150 creates/deletes temp files, contrary to read-only audit constraints.
  • No CocoaPods files/configuration changes are in the final diff.
• Tooling:
  • Publish uses Volta Node 24.0.0, Yarn 1.22.22.
  • Scripts: generate, check:generated, test = yarn check:generated && vitest run, lint = eslint src .github --ignore-pattern '!.github'.
  • Worktree is not jj: Error: There is no jj repo in "."; use Git.
  • GitHub reported 22 default-branch dependency vulnerabilities on Publish: 12 high, 8 moderate, 2 low; https://github.com/getsentry/publish/security/dependabot.
• PR #9339 checks at Sep 8 13:02:
  • In progress: CodeQL Analyze (actions), run 34229471266 job 102071692353; CodeQL Analyze (javascript), same run job 102071692687; Secret Scan run 34229476340 job 102071704595; Test/unit tests run 34229476353 job 102071704707; Warden run 34229476597 job 102071706138; Cursor Bugbot; Seer Code Review; Socket Security Pull Request Alerts; semgrep-cloud-platform/scan.
  • Completed success: Dependency Review, run 34229476334 job 102071704447 (13:01:47–13:01:57); Socket Security Project Report (13:01:48–13:01:55), SBOM 04da4c5d-3d7e-41d4-b361-42d238cc300f.

Session Timeline

• Sep 3–5, 2026:
  • Implemented concrete Craft workspace behavior and Publish canonical path-only title/location behavior.
  • Craft commit d48b906 feat: support concrete release workspaces created Sep 5 03:34, pushed 03:43.
  • Publish commit a81ab03 feat: resolve workspace publish paths created Sep 5 03:40, pushed 03:46.
  • Sep 5 02:05 evidence audit returned MERGE, no findings.
• Sep 5 13:10–Sep 7 19:02:
  • Reviewed PR #9339 feedback: output serialization/fallbacks, checkout v7, discovery Node script, docs/grammar source of truth, Peggy revision consolidation, and fail-closed contracts.
• Sep 7 23:56–Sep 8 04:15:
  • Implemented, audited, fixed, verified, and completed final MERGE audit for Publish PR #9339 review repairs.
• Sep 8 12:56–13:02:
  • User asked status of unresolved PR #9339 review comments.
  • Confirmed six unresolved GitHub threads were addressed locally, but PR still pointed to a81ab03 and required review.
  • User requested push at 13:01. Committed review fixes as fd1e115 (21 files, +1,509/-96) and pushed successfully.
  • Confirmed PR #9339 head at exact fd1e1156ae878a12a276af401a15a656bfff8127; review decision remained REVIEW_REQUIRED, with CI beginning.
• Sep 8 13:12–13:33:
  • User redirected active work to Craft PR #872’s unaddressed review comment and requested consideration of CLI directory-walking reuse.
  • Inspected Craft worktrees/PR state and identified resolved directory-pattern request plus unresolved legacy-workspace-name removal request.
  • User issued directive to load repo-setup before situation skills; Outpost AGENTS.md instructions were read.
  • Background CLI discovery inspection began at 13:28.
• Sep 8 13:34–13:53:
  • User clarified that Action titles carry full concrete workspace paths and provided workspace configuration, constraints, compatibility, list-output, tag-prefix ambiguity, and GitHub Latest limitations.
  • Established that cli/v2 is a valid concrete path, not legacy syntax; user explicitly requested test renaming instead of removal.
  • Inspected CLI guidance, .sentryclirc upward/global resolution, walk-up.ts, and scan walker.
  • Concluded CLI scan walker is not a safe direct reuse for Craft workspace discovery due to synchronous deterministic Craft config requirements and stronger glob/containment contracts.
• Sep 8 13:54–13:58:
  • First patch failed because it expected it(...); actual test used test('allows legacy workspace names', ...).
  • Renamed label to allows multi-segment workspace paths.
  • Full Craft suite passed: 61 files, 1,197 pass, 1 skipped, 1,198 total.
• Sep 8 15:30–15:31:
  • User asked whether CLI walker features, including parallel async scanning, could be reused.
  • Compared CLI serial/parallel walker semantics with Craft globSync discovery; recommended against introducing async walker complexity unless profiling proves a workspace-expansion bottleneck.
• Sep 8 15:51–16:03:
  • User stated work could be ready if bot and independent reviews found no issues.
  • Committed/pushed terminology fix f174cea at 16:03; exact PR head became f174ceafa57355e71617f32ba1b0a030953be0a2.
  • PR initially remained draft, blocked, review-required; CI began on exact head. Independent read-only audit task began at 16:04.
• Sep 8 16:59–17:00:
  • Independent audit returned MERGE with no findings; all reported CI/security checks passed.
  • Replied to and resolved the outdated terminology review thread.
  • Marked Craft PR #872 ready for review/non-draft. It remained blocked and review-required because a fresh approval was required.
• Sep 8 17:00–17:07:
  • Cursor Bugbot and Seer Code Review started. Seer completed successfully at 17:03:57Z with no findings.
  • All PR review threads were resolved and all other checks green; the only pending external process was Cursor Bugbot, plus required fresh approval.
• Sep 8 17:06–17:10:
  • Cursor Bugbot completed at 17:06:43Z with NEUTRAL and opened a valid medium-severity finding: broken symlink workspace glob candidates throw from realpathSync before directory filtering.
  • Assistant accepted the finding, planned a regression-first narrow repair, inspected the faulty filter ordering in src/config.ts:249-260, and selected placement for the regression test beside symlinked-directory glob tests.
  • Tool reported a modification to src/__tests__/config.test.ts at 17:10; inspect its contents, reproduce current failure, complete minimal production fix, and rerun verification before any readiness claim.