Distillation

Current State

• As of Sep 2, 2026, 16:51, compact Craft Action ↔ Publish controller contract work is implemented, independently reviewed MERGE on Sep 2, 16:02, committed, and pushed to both linked PR branches. Active work is “Commit, push, and monitor linked PRs” (high priority): inspect bot reviews/threads/comments, CI, and merge gates after every update. Low-priority “Document workspace migration” remains pending.
• Linked PR status:
  • Publish/controller PR #9339: https://github.com/getsentry/publish/pull/9339, feat: accept workspace publish requests, OPEN, non-draft, branch feat/workspace-acceptance, base main.
    • Pushed history: 33de3f1 feat: accept workspace publish requests (Aug 26, 14:16), b658ffa fix: validate publish workspace JSON (Aug 27, 09:16), then compact-contract commit 52ef600 feat: resolve compact workspace publish requests (Sep 2, 16:20).
    • Current head: 52ef600d6759911d4b76d7f3108c5a41c3e0ec2a; original base was 83d210b29553ea6f4d97508821724a834c43856e.
    • As of Sep 2, 16:42, mergeStateStatus=BLOCKED, reviewDecision=REVIEW_REQUIRED. Reported checks passed: CodeQL actions/javascript, dependency review, Secret Scan, unit tests, Cursor Bugbot (neutral), Seer Code Review, Socket Security, Semgrep. Warden remained in progress.
    • Cursor Bugbot left one COMMENTED review. Its concern was that discovery requires a Craft version containing workspace list; this is intentional: Publish uses getsentry/craft:latest, and Craft must release first so latest includes both workspace list and --rev. Failing open to path routing after discovery failure is unsafe. A rationale reply was posted Sep 2, 16:50 to inline comment 3916489922; review thread PRRT_kwDOEgGvjc6elzOu was still unresolved then, with Cursor comment 3916354008 and the reply. Resolve/monitor it according to GitHub workflow.
    • Local Publish worktree: /home/byk/Code/getsentry/publish-workspace-acceptance. After committing/pushing, only unrelated unstaged newline/blank-line changes remain in src/modules/post-workflow-details.js and src/publish/inputs.js; do not commit them. pnpm-lock.yaml must never be committed and is no longer present in final intended staging.
  • Craft/action PR #872: https://github.com/getsentry/craft/pull/872, feat: propagate release workspaces, OPEN, draft, branch feat/workspace-action-propagation, base master.
    • Pushed history: 6dae341 feat: propagate release workspaces (Aug 26, 14:18), then compact-contract commit 4862056 feat: support compact release workspaces (Sep 2, 16:23).
    • Current head: 48620564f86d8724982cddb6506c040235fe8954; base 21270a1d12a60b461c51fba93bd076b90d9cf4af.
    • As of Sep 2, 16:37, mergeStateStatus=BLOCKED, reviewDecision=REVIEW_REQUIRED, no reviews. All reported checks passed: Build & Test Node 22/Node 24/Build/Build Docs; Changelog Preview and Semver Impact; CodeQL actions/javascript/CodeQL; Dependency Review; Docs Preview; Enforce License Compliance; Lint fixes; Secret Scan; Warden/security review; image; Socket Security; Semgrep. Preview: https://craft.sentry.dev/pr-preview/pr-872/.
• Deployment ordering remains a hard contract: Craft must release before Publish deploys, because Publish’s intentional getsentry/craft:latest must contain the new craft workspace list command and craft publish --rev support. The previous immutable 2.31.0-pin plan was superseded by the user’s Aug 29, 10:09/Nov 5 directive that Publish always uses the latest Craft version.
  • getsentry/craft:2.30.1 was pulled successfully Aug 29, 09:30, digest sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b, but probe 09:47 established it has no --rev option and cannot safely uphold CI-pinned publish behavior.
  • 2.31.0 did not exist in GHCR or Docker Hub as of Aug 29, 04:01; this no longer requires a semver image pin, but confirms the Craft release must happen before controller rollout.
• Final agreed request contract:
  1. New Craft requests encode an ASCII-safe workspace as one compact trailing title segment: root publish: getsentry/toolkit@1.2.3; workspace publish: getsentry/toolkit/cli@1.2.3.
  2. New Craft requests always include checkout repository identity. Existing issues may omit getsentry/ while parsing.
  3. Parsing handles syntax only. Publish checks out the exact CI-approved revision, then discovers exact raw release-workspace keys using craft workspace list; only a single trailing segment is classified workspace-first.
  4. Exact spelling membership in checked-out root configuration means workspace; otherwise suffix remains checkout path. Names are never normalized.
  5. Missing root .craft.yml is path-only. If root .craft.yml exists and discovery is needed, discovery failures fail closed.
  6. Only unqualified ./<single-safe-segment> routes invoke workspace discovery. Root, multi-segment, and explicit legacy JSON workspace titles bypass discovery.
  7. Legacy JSON-qualified workspace titles remain supported, including legacy raw names such as cli/v2 and safe Unicode; explicit legacy workspace takes precedence semantically, must use root path only, and is never newly generated by Craft.
  8. New compact workspace names are safe ASCII title tokens and reject __proto__, ., .., and leading-dash/option-looking values; Craft rejects workspace plus non-root path before side effects.
  9. One canonical poller-approved revision controls checkout, compact classification, state CWD/path, CRAFT_WORKSPACE, and craft publish --rev; title/body decoys fail closed.
  10. The authoritative check-runs revision is exactly one canonical Action-created request-header link at the start of the issue body: Requested by, Merge target, Quick links, View changes, then View check runs. It must target the title repository with a lowercase 40-hex SHA. Missing, duplicate, wrong-repo, out-of-block, or forged later-header links fail closed.
• Persistent user assertions/directives:
  • CI poller always adds ci-ready after passing CI; waiting-for-ci removes it first to emit a fresh labeled event.
  • workflow_dispatch must always remain enabled in ci-poller.yml for manual recovery. check-ci must run when vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'.
  • Always throw for unexpected values; switch default must throw, e.g. new Error(\Unknown status: '${status}'`)`.
  • Never normalize workspace names before lookup.
  • Separated option tokens such as --workspace --dry-run must never be treated as workspace names.
  • Current-version prerelease relaxation applies only to current Craft version, never configured minVersion.
  • CDN consumers must pin versions rather than latest generally, but user explicitly overrode this for Publish/Craft: Publish always uses latest Craft.
  • Peggy extra-options-file keys use long two-dash spelling without literal dashes; internally dashed options are camelCase.
  • Peggy Unicode matching never matches a lone surrogate.
  • Use pnpm, never npm/yarn, for Craft. Use Yarn Classic, never npm, for Publish.
  • renderTemplateSafe() must restore mustache.Context.prototype.lookup = originalLookup in finally.
  • User stated repeatedly they never used @typescript-eslint/no-unused-vars; warnings must not be attributed to user choice.
• Worktrees:
  • Craft: /home/byk/Code/getsentry/craft-workspace-action-propagation, branch feat/workspace-action-propagation, based on 21270a1; original feature head 6dae341; current pushed compact head 4862056.
  • Publish: /home/byk/Code/getsentry/publish-workspace-acceptance, branch feat/workspace-acceptance, based on 83d210b; original pushed compact predecessor b658ffa; current pushed compact head 52ef600.
• getsentry/publish default branch is main, not master.
• Background tasks:
  • Historic non-overlap tasks: ses_fb83e8505ffeGclFS273c6OjTQ reported running Aug 28, 09:46; ses_fb7953815fferhgAYqqquyoEu9 Aug 28, 12:51.
  • Reviews were restarted/replaced due to stalled work. Final independent audit returned MERGE on Sep 2, 16:02. No review task is currently reported running.

Key Decisions

• Craft workspace hardening / compatibility boundary
  • Craft config allows valid legacy raw workspace keys including cli/v2; this restores existing legacy JSON-title compatibility.
  • New Action-created compact title names remain constrained to safe one-segment ASCII names. Action rejects slash-containing, ./.., __proto__, and leading-dash/option-looking names before Git/Craft/network side effects.
  • Object.hasOwn(workspaces, workspaceName) is required for selection. This rejects inherited constructor, toString, and __proto__ selectors.
  • __proto__ is rejected at schema entry because Zod z.record could silently drop it, allowing a YAML configuration to validate but become invisible to Object.keys.
  • Workspace configs cannot use github.projectPath; nonempty workspace maps also forbid base/root github.projectPath, eliminating compact suffix ambiguity. Empty maps retain legacy compatibility.
  • Workspace GitHub owner/repo overrides remain allowed; merged config only has GitHub config if both owner/repo are present, otherwise global fallback applies.
• Action security
  • First composite Action step remains workspace/path validation before all side effects.
  • Node validation was selected over Bash because locale-sensitive [A-Za-z] admitted é under en_US.utf8.
  • Craft calls use inline --workspace=$WORKSPACE, preventing separated-token option injection.
  • The audit finding that __proto__, -foo, and --config passed the prior regex was fixed Sep 2; safe validation now rejects reserved/leading-dash input before side effects.
• Workspace discovery
  • Existing src/utils/workspaces.ts package-manager workspace handling must not be used for named Craft release workspaces.
  • Final command is craft workspace list, not craft workspaces --json.
  • It returns Object.keys(parsed.workspaces || {}) from raw validated root .craft.yml, applies no active selection, and never normalizes.
  • Discovery is only needed for no-legacy-workspace titles with exactly one safe trailing path segment. This isolates legacy roots, multi-segment paths, and JSON-qualified legacy requests from discovery.
• Title parser / legacy compatibility
  • Peggy 5.1.0 is selected over Nearley/PEG.js: maintained MIT PEG.js successor, build-time CommonJS generation, no runtime parser dependency.
  • Canonical grammar is .peggy; generated CommonJS parser is committed. Generator emits /* eslint-disable */, formats source, and --check fails byte-for-byte drift. yarn test invokes yarn check:generated first.
  • Invalid legacy JSON escape remains reported as Invalid publish workspace JSON in title by deliberately delegating escape semantics to JSON.parse.
  • Legacy JSON-qualified title may contain raw valid legacy workspace names such as cli/v2 and cli-日本語, but it must use root checkout path; A publish workspace must use the repository root path. is thrown otherwise.
  • Direct reinterpretation of all legacy paths was rejected because it changes legacy behavior. Explicit legacy workspace always wins over discovery.
  • Versioned/authenticated body metadata was rejected on Aug 27, 14:59; no new request identity marker/body field.
• Revision authority and poller
  • The former broad “first matching check-runs link anywhere” extraction was rejected after adversarial decoy findings.
  • getReleaseRevision() now recognizes one exact authoritative check-runs link only in the Action-created issue header at the start of body, requiring Requested by, Merge target, Quick links, View changes, then check-runs. It rejects decoy, duplicate, absent, wrong-repo, uppercase-SHA, forged trailing header, and out-of-block links.
  • CI poller uses shared generated title parsing and this canonical revision resolver through resolve-ci-poller-input.js, rather than broad title regex/SHA grep. It parses accepted legacy and compact titles consistently, skips invalid issue inputs safely, preserves manual dispatch, and updates only canonical linked SHA when branch head moves.
  • Exact linked SHA controls checkout, compact classification, state, and craft publish --rev. Craft detached SHA checkout falls back to the SHA when git name-rev --no-undefined cannot resolve a branch, retaining branch checkout when it can.
• Craft image rollout
  • Previous decision to pin getsentry/craft:2.31.0 was superseded. Per user directive, Publish now runs getsentry/craft:latest for discovery and publishing.
  • There is no safe old-image fallback: 2.30.1 lacks --rev. Craft must release first so latest has both workspace list and --rev; then Publish can deploy. Fail-open path fallback after failed required discovery was rejected as unsafe misrouting.
• State identity
  • Workspace release GitHub owner/repo can differ from checkout/title identity. CRAFT_PUBLISH_STATE_GITHUB_REPO=getsentry/<title repo> governs state filename identity only, not publication target.
  • State is external/XDG-only. Publish passes exact secure CRAFT_STATE_FILE_PATH to cancellation/failure update logic; no repo-file fallback.
  • Active workspace state prefix is Base64URL workspace-${Buffer.from(workspace).toString("base64url")}-; sanitization was rejected because it collapses legal names.
  • State fixture was corrected to derive location from actual compact resolution: compact workspace classification uses root CWD hash, not impossible {path:"./cli", workspace:"cli"} input.
• Commit hygiene
  • Explicit allowlist staging was chosen. Publish committed exactly 20 intended files; Craft exactly 12 intended files.
  • Do not commit pnpm-lock.yaml.
  • Publish newline-only changes in src/modules/post-workflow-details.js and src/publish/inputs.js remain intentionally unstaged.
  • The historical CocoaPods scalar quote change could not be reverted because the old quoted form fails YAML lint (yml/plain-scalar); lint-valid plain scalar remains.
• Deferred/unrelated
  • Cloudflare target and monorepo prefixed-tag work are independent future PRs.
  • CalVer Publish-issue changelog mentions must render bold to avoid pings; committed CHANGELOG.md keeps original mentions.
  • Other user branch facts: 3566840 fix: replace extract-zip with node-stream-zip to fix Node 24.16.0 hang; 8484cd8 security(commit-repo): replace execSync tar with node-tar; 4da4a25 chore: replace deprecated trimRight() with trimEnd() (#9012).

Technical Changes

• Merged Craft #848 (feat/workspaces-schema)
  • 086a633 fix(config): address workspace review feedback, pushed Aug 25, 09:31.
  • ab63572 fix(publish): isolate workspace release state, pushed Aug 25, 09:44.
  • Squash merge 21270a1d12a60b461c51fba93bd076b90d9cf4af.
  • Key files: src/config.ts, src/utils/helpers.ts, src/utils/publishState.ts, plus config/helper/publishState tests.
• Craft compact-contract commit 4862056 feat: support compact release workspaces
  • Created Sep 2, 16:23, pushed 16:29 to getsentry/craft branch feat/workspace-action-propagation; 12 files, 438 insertions / 105 deletions.
  • Includes:
    • action.yml
    • docs/src/content/docs/targets/github.md
    • src/__tests__/action.test.ts
    • src/__tests__/config.test.ts
    • src/commands/__tests__/publish.test.ts
    • src/commands/publish.ts
    • src/config.ts
    • src/index.ts
    • src/schemas/project_config.ts
    • new src/commands/workspace.ts
    • new src/commands/workspace_cmds/list.ts
    • new src/commands/workspace_cmds/__tests__/list.test.ts
  • src/commands/workspace.ts registers Manage release workspaces. workspace list command prints formatJson(getWorkspaceNames()); description: List defined release workspaces as a JSON array.
  • src/index.ts invokes setActiveWorkspace(extractWorkspaceSelection(argv)) before yargs command builders and registers workspace alongside prepare, publish, targets, config, artifacts, changelog.
  • src/config.ts:
    • adds getWorkspaceNames() reading root .craft.yml, validating raw config, applying minimal config/version workspace gates, returning raw Object.keys(parsed.workspaces || {}), and bypassing active workspace selection;
    • centralizes checkWorkspacesMinVersion(config);
    • normal selection errors for selected workspace/no workspace, configured workspaces/no selection, and min-version failure.
  • src/schemas/project_config.ts:
    • preserves legacy raw valid workspace names such as cli/v2;
    • rejects __proto__;
    • rejects workspace github.projectPath with Workspace github.projectPath is not supported.;
    • rejects nonempty workspaces plus root github.projectPath with Workspace configurations cannot use github.projectPath.;
    • rejects . and .. workspace keys to prevent traversal/unreleasable compact titles.
  • action.yml:
    • first validation step gets PATH_INPUT and WORKSPACE;
    • rejects nonempty workspace with non-root path: The path and workspace inputs cannot be used together.;
    • rejects unsafe controls/formats/separators/non-ASCII, /, ., .., __proto__, and leading-dash option-like compact input before side effects;
    • retains inline --workspace=$WORKSPACE for Craft Prepare and target discovery;
    • emits publish: ${GITHUB_REPOSITORY}${SUBDIRECTORY}${WORKSPACE:+/$WORKSPACE}@${RESOLVED_VERSION}.
  • src/commands/publish.ts:626-681:
    • with argv.rev, calls getRevisionBranchName(git, rev), uses checkoutTarget = branchName || rev, checks out target, then resolves git.revparse('HEAD').
    • Without --rev, retains release branch checkout and findReleaseBranches() diagnostics.
    • getRevisionBranchName() at lines 933-945 catches git.raw('name-rev', '--name-only', '--no-undefined', revision) failure and returns ''; detached CI-approved SHA is checked out directly.
  • State behavior retained: state identity can be forced with CRAFT_PUBLISH_STATE_GITHUB_REPO, malformed values throw ConfigurationError("CRAFT_PUBLISH_STATE_GITHUB_REPO must be a GitHub owner/repository pair."), state is XDG-only, and active workspace prefix is Base64URL.
• Craft tests / verification
  • Latest final full verification Sep 2, 15:53: vitest run 61 files, 1,158 passed / 1 skipped / 1,159 total, duration 30.18s.
  • Lint: 0 errors / 7 pre-existing warnings. Warnings:
    • _abortError src/commands/publish.ts:482, :499, :527;
    • _statusError :515;
    • _diffError :521;
    • _err src/utils/git.ts:241, :249;
    • reported as @typescript-eslint/no-unused-vars, which user says they never used.
  • Prettier passed; node build.mjs passed; source-map upload skipped because SENTRY_AUTH_TOKEN absent.
  • Docs build previously passed: Astro generated docs/dist/, 29 pages, Pagefind and sitemap; expected output included Entry docs → 404 was not found.
• Publish compact-contract commit 52ef600 feat: resolve compact workspace publish requests
  • Created Sep 2, 16:20, pushed 16:26 to getsentry/publish branch feat/workspace-acceptance; 20 files, 1,601 insertions / 88 deletions.
  • Staged/committed intended changes include:
    • .github/workflows/ci-poller.yml
    • .github/workflows/publish.yml
    • docs/publish-issue-format.md
    • package.json
    • yarn.lock
    • scripts/generate-publish-issue-title-parser.js
    • src/modules/publish-issue-title.peggy
    • generated src/modules/publish-issue-title.js (902 lines)
    • src/modules/details-from-context.js
    • src/modules/publish-location.js
    • src/modules/release-revision.js
    • src/modules/ci-poller-input.js
    • tests: details-from-context.js, publish-location.js, release-revision.js, ci-poller-input.js, publish-workflow.js
    • action entrypoints src/publish/resolve-location.js, resolve-release-revision.js, resolve-ci-poller-input.js.
  • package.json:
    • exact dev dependency "peggy": "5.1.0";
    • "generate": "node scripts/generate-publish-issue-title-parser.js";
    • "check:generated": "node scripts/generate-publish-issue-title-parser.js --check";
    • "test": "yarn check:generated && vitest run".
    • yarn.lock adds Peggy and required packages: @peggyjs/from-mem@3.1.3, commander@14.0.3, semver@7.7.4, source-map-generator@2.0.6.
  • scripts/generate-publish-issue-title-parser.js:
    • reads src/modules/publish-issue-title.peggy;
    • calls peggy.generate(..., { format: "commonjs", grammarSource: "publish-issue-title.peggy", output: "source" });
    • prepends /* eslint-disable */, formats with Prettier according to generated output path, writes parser;
    • --check compares bytes and throws The generated publish issue title parser is stale. Run \yarn generate`.`.
  • src/modules/publish-issue-title.peggy grammar parses publish: , optional getsentry/, ASCII repo and slash-delimited syntax path, optional legacy [workspace: <JsonString>], @, version; parser output { repo, path: path || "", version, ...(workspace ? { workspace } : {}) }.
    • Repository/path segment [A-Za-z0-9_.-], version [A-Za-z0-9_.+-]+.
    • JSON string syntax captures quoted content but delegates JSON escape validation to JSON.parse, preserving the established specific error.
    • Comments explicitly say suffix semantic classification is post-CI-checkout only.
  • src/modules/details-from-context.js now calls parsePublishIssueTitle(), maps parser failure to Invalid publish issue title: '<title>', JSON-decodes legacy qualifier, validates nonempty/no Unicode Cc, Cf, Zl, Zp, rejects path traversal, and rejects explicit workspace with path other than .: A publish workspace must use the repository root path.
    • Retains dry-run, merge-target, and checked-target extraction.
    • Key regexes:
      • TARGETS_SECTION_PARSER_REGEX = /^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m
      • TARGETS_PARSER_REGEX = /^\s*- \[[ x]\] (\S+)/gim
      • CHECKED_TARGETS_PARSER_REGEX = /^\s*- \[x\] (\S+)/gim
  • src/modules/publish-location.js:
    • needsWorkspaceDiscovery({path, workspace}) is true only if no explicit workspace and /^\.\/[A-Za-z0-9_.-]+$/.
    • isWorkspaceName() requires string /^[A-Za-z0-9_.-]+$/, rejects __proto__, ., and ...
    • Explicit workspace requires root path, otherwise same root-path error.
    • Validates discovered list only when discovery is needed; invalid discovery throws Craft workspace discovery returned an invalid workspace list.
    • Exact workspaceNames.includes(segment) classification returns {path: ".", workspace: segment} with exact case; nonmatching/multi-path/root remain path behavior.
  • src/modules/release-revision.js:
    • hardened after multiple adversarial reviews. The authoritative match begins at issue-body start and requires Action request-header order: Requested by: @..., Merge target: ..., Quick links:, View changes line, then View check-runs link for getsentry/<repo>/commit/<40 lowercase hex>/checks.
    • Requires exactly one check-runs list entry (CHECK_RUNS_LINK_COUNT) and exact title repository. Wrong/missing/duplicate/decoy/out-of-header links fail closed.
    • Canonical failure text: Expected exactly one View check runs link in Quick links for getsentry/${repo}.; repository mismatch retains Expected a View check runs link for getsentry/${repo} in the publish issue body.
    • Tests cover valid standard and CRLF headers, wrong repo, missing, uppercase SHA, decoys, duplicate links, forged later complete blocks, and forged-only blocks.
  • src/modules/ci-poller-input.js exports getCiPollerInput({title, issueBody}); it parses title using generated parser and returns {repo: \getsentry/${repo}`, revision: getReleaseRevision({issueBody, repo}), version}`.
  • src/publish/resolve-ci-poller-input.js emits its JSON to stdout. ci-poller.yml checks out controller source, invokes it with PUBLISH_TITLE and PUBLISH_ISSUE_BODY, warns/skips invalid inputs, resolves check suite/branch-head update from canonical original SHA, and replaces only canonical issue SHA. It retains cron */5 * * * *, manual workflow_dispatch attempt default "0", concurrency ci-status-poller, and CI_POLLER_HAS_PENDING manual-recovery condition.
  • .github/workflows/publish.yml:
    • removes mutable protected/default branch selection;
    • parses inputs, then resolves canonical CI-approved revision before Inform start (prevents side effects on malformed/decoy body);
    • checks out getsentry/<parsed repo> into __repo__ at ${{ steps.release-revision.outputs.revision }}, fetch-depth: 0;
    • conditionally runs getsentry/craft:latest workspace list only if needsWorkspaceDiscovery(input) and root .craft.yml exists;
    • resolves canonical location, uses resolved path/workspace in state construction and final Craft invocation;
    • executes docker://getsentry/craft:latest, changes to __repo__/<resolved path>, runs craft publish <version> --rev <approved SHA>;
    • sets CRAFT_PUBLISH_STATE_GITHUB_REPO=getsentry/<input repo>, XDG_STATE_HOME=/github/workspace/.craft-state, resolved workspace, and external state file handling.
    • Set targets retains state parity: container realpath -m, escape rejection, first 12 SHA-1 chars of CWD, lowercase/sanitized owner/repo/version, Base64URL workspace prefix, state external to checkout, and target JSON [{($source[]): true }] | add | {"published": (. // {}) }.
  • Workflow tests:
    • Extract actual Set targets script and verify root state fixture /github/workspace/__repo__ hash c232c383e26f, filename .craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json.
    • Compact location resolves first and uses root CWD state hash for Toolkit workspace cli, yielding .craft-state/craft/publish-state-getsentry-toolkit-c232c383e26f-workspace-Y2xp-1.2.3.json (not the impossible old ./cli workspace pair/hash).
    • Assert checkout → location → state → Publish ordering, exact SHA checkout/ref and --rev, conditional latest-image discovery, absence of 2.31.0, resolved workspace env, and Inform start after release-revision validation.
• Publish verification
  • Final reported validation Sep 2, 15:25: parser freshness passed; yarn check:generated && vitest run: 9 files / 51 passed tests; ESLint passed; Prettier passed.
  • Earlier final review cited 51 tests/lint/parser hygiene; final independent audit Sep 2, 16:02 returned MERGE.
  • Prettier cannot infer a parser for .peggy; supported changed-file format checks pass. Do not treat unsupported .peggy parser error as a formatting defect.
  • Earlier generated-parser lint errors were solved at generator level by prefixing generated output /* eslint-disable */, rather than weakening lint or editing generated code manually.
• Old Publish behavior replaced
  • Prior parser regex:

    /^publish: (?:getsentry\/)?(?<repo>[A-Za-z0-9_.-]+)(?<path>\/[\w./-]+)?(?: \[workspace: (?<workspace>"(?:[^"\\]|\\.)*")\] )?@(?<version>[\w.+-]+)$/
    

  • Prior workflow built state pre-checkout and chose default/protected allowlisted branches (sentry-migr8/tmp-merge-target; sentry-javascript/v10/v9/v8/v7/master; sentry-python/alpha; sentry-wizard/1.x). This competing revision selection was removed.
• Repository constraints
  • Publish: pure CommonJS JS, Node 24.0.0, Yarn Classic 1.22.22 via Volta; source CommonJS/tests ESM Vitest; kebab-case files, camelCase code, UPPER_SNAKE_CASE constants; double quotes/semicolons; mocks before module imports; guard-clause errors; check external state file exists before reading.
  • Craft: @sentry/craft 2.31.0-dev.0, TypeScript/Node, pnpm frozen lockfile; Docker runtime Node 24.18.0; Docker workflow pushes SHA and latest tags on non-PR master/release/test pushes.
• Administrative history
  • Craft PR #848 admin-squash merged Aug 25, 10:04:15Z; Craft PR #844 closed superseded 2026-08-25T10:05:27Z.
  • Four malformed reviewer replies due to Markdown backticks were deleted; corrected replies/descriptions posted Aug 26, 14:26–14:27.
  • Staging checks found absent .lore.md Aug 26/27 and again before commits Sep 2; no index changes.
  • Dependabot reported two high-severity Craft-default-branch vulnerabilities Aug 25. Pushes Sep 2 reported Publish default-branch vulnerabilities: 22 total (12 high, 8 moderate, 2 low); Craft: 3 (2 high, 1 low).

Session Timeline

• Aug 25–27, 2026
  • Merged Craft workspace schema/state hardening #848. Built/pushed original JSON-title contract: Publish 33de3f1, Craft 6dae341; fixed invalid JSON escaping in Publish b658ffa. PRs opened and initially CI-green but review-blocked.
  • Approved compact redesign: syntax-only title parsing; checked-out exact CI revision classification; raw craft workspace list; legacy compatibility; root-only compact workspace constraint; state/revision binding.
• Aug 28, 2026
  • Implemented Craft Action/config guards and raw release workspace discovery. Independent review found/fixed __proto__ Zod drop and locale-sensitive Bash regex. Focused/full Craft tests and docs build passed.
  • Began Publish Peggy parser/controller changes, release-revision resolver, location resolver, post-checkout workflow restructuring. Established old image tags did not yet provide required command.
• Aug 29, 2026, 02:55–08:39
  • Completed initial local Publish exact CI-SHA checkout/discovery/location/state/--rev workflow direction.
  • Added parser/location/revision modules/tests; fixed Peggy generation API (output: "source"), generator formatting/lint disable, Yarn lock, stale-parser test guard, and workflow extraction boundary.
  • Fixed Craft detached-SHA checkout via branchName || rev.
  • Full verification passed: Publish then 43 tests; Craft 1,152 passed/1 skipped; independent adversarial review started.
• Aug 29, 08:52–16:13
  • First review DO-NOT-MERGE: unavailable pinned 2.31.0 blocked legacy workflows; legacy explicit workspace plus non-root path was unsafe; generated parser drift uncovered.
  • User overrode immutable-pin approach: Publish must use Craft latest; Craft releases first. Fixed root-path legacy workspace invariant, parser freshness, and workflow behavior; Publish reached 45 tests.
  • Further reviews identified decoy/duplicate check-runs links, ./.. workspace names, impossible workspace state fixture, broad CI poller parser. Began canonical revision/poller hardening.
• Sep 2, 2026, 10:42–13:18
  • Resumed after stalled review. Added shared ci-poller-input resolver, poller controller checkout/integration, canonical Quick-links revision logic, traversal guards, compact-real state fixture, docs, and regressions.
  • Full validation: Publish 53 tests and Craft 1,156 passed/1 skipped before later review refinements. Preserved workflow_dispatch.
• Sep 2, 13:26–15:25
  • Reviews found/fixed legacy cli/v2 config compatibility, notification-before-validation side effect, forged later Quick-links/header authority, and hygiene churn.
  • Authority matcher anchored to issue-body Action header; tests added for forged trailing/only blocks. Retained lint-valid CocoaPods scalar because reverting caused yml/plain-scalar.
  • Full Publish validation passed 51 tests, lint, parser freshness, and formatting.
• Sep 2, 15:37–16:02
  • Final audit found Action accepted __proto__/leading-dash names; fixed and tested before-side-effect validation.
  • Craft final verification passed 1,158 / 1 skipped, lint 0 errors/7 known warnings, formatting/build. Final independent audit returned MERGE at 16:02.
• Sep 2, 16:03–16:30
  • Inspected allowlisted diffs; excluded Publish newline-only files.
  • Staged 20 Publish files and 12 Craft files; .lore.md absent.
  • Committed Publish 52ef600 16:20, Craft 4862056 16:23; pushed Publish 16:26, Craft 16:29.
• Sep 2, 16:34–16:51
  • Began mandatory post-push PR monitoring.
  • Craft #872: CI clean, draft/review-required/blocked.
  • Publish #9339: most checks green, Warden running; Cursor Bugbot COMMENTED with deployment-order concern. Replied that Craft-first latest release is intentional and fail-closed discovery is required; thread remained unresolved as of 16:50–16:51.