Distillation

Date: Aug 26, 2026

• 🔴 (13:53) User directive: Always use pnpm for package management.
• 🔴 (13:53) User directive: Never use npm or yarn.
• 🔴 (13:53) User directive: Always throw for unexpected values.
• 🔴 [requested-read-only-review] (13:53) User requested a fresh, rigorous, read-only adversarial review of CURRENT uncommitted changes in both worktrees; explicitly instructed not to modify files.
• 🔴 (13:53) Craft worktree is /home/byk/Code/getsentry/craft-workspace-action-propagation, on branch feat/workspace-action-propagation, with base 21270a1.
• 🔴 (13:53) Publish worktree is /home/byk/Code/getsentry/publish-workspace-acceptance, on branch feat/workspace-acceptance, with base 83d210b.
• 🔴 (13:53) User stated prior review found a critical invalid action.yml mapping—WORKSPACE outside env—and weak tests; these should now be fixed.
• 🔴 (13:53) User required inspection of actual full diffs, surrounding code, action/workflow YAML structures, and regression tests, with exact file:line evidence.
• 🔴 (13:53) User required review criterion 1: action.yml must remain a valid composite-action manifest; an invalid workspace must be rejected BEFORE every side effect; WORKSPACE wiring must reach Craft Prepare and Read Craft Targets.
• 🔴 (13:53) User required review criterion 2: both ingress paths must reject nonempty Cc, Cf/bidi, Zl, and Zp; legacy empty/no workspace must remain compatible; valid non-control Unicode must be allowed.
• 🔴 (13:53) User required review criterion 3: when workspace GitHub owner/repo differs from checkout/title repo, controller prepopulation and Craft lookup must byte-match; override must change only state identity, not GitHub publishing identity; inspect the executable YAML workflow fixture.
• 🔴 (13:53) User required review criterion 4: option-looking workspace values must not become separate Craft options.
• 🔴 (13:53) User required review criterion 5: no insecure repo-local state fallback, malformed title, path traversal, YAML expression, or test-harness regression.
• 🔴 (13:53) User requested findings first in severity order, PASS/FAIL for all five criteria, exact line citations, and a final MERGE or DO-NOT-MERGE conclusion; instructed not to provide general praise.
• 🟡 (13:53) Craft AGENTS.md specifies Node.js v22.12.0 managed by Volta; dependencies installed with pnpm install --frozen-lockfile; key commands are pnpm build, pnpm test, pnpm lint, and pnpm fix; manual test command is pnpm build && ./dist/craft.
• 🟡 (13:53) Craft codebase uses TypeScript, Prettier 3.x with single quotes and no arrow parens, ESLint 9.x flat config in eslint.config.mjs, and Vitest tests under src/__tests__/ using *.test.ts.
• 🟡 (13:53) Craft project structure includes src/commands/, src/schemas/, src/targets/, src/utils/, src/config.ts, src/index.ts, and bundled executable dist/craft.
• 🟡 (13:53) Craft dry-run guidance: use getGitClient()/createGitClient(directory) for Git, getGitHubClient() for GitHub API, safeFs for writes, and safeExec()/safeExecSync() for other actions; direct simple-git imports and new Octokit() are lint-restricted.
• 🟡 (13:53) Publish AGENTS.md describes a GitHub Actions-based approval system for publishing releases across Sentry projects using Craft; it is a pure JavaScript CommonJS project on Node.js 24.0.0.
• 🟡 (13:53) Publish repository guidance specifies Yarn Classic 1.22.22, Volta version management, and commands yarn install, yarn test, yarn test:watch, yarn test src/modules/__tests__/update-issue.js, yarn test -t "pattern", yarn lint, and yarn prettier.
• 🟡 (13:53) Publish repository structure: src/libs/ for shared utilities, src/modules/ for reusable core business logic, and src/publish/ for GitHub Actions entry points.
• 🟡 (13:53) Publish coding guidance: kebab-case filenames, camelCase variables/functions, UPPER_SNAKE_CASE constants/regexes, CommonJS source (require/module.exports), ES Modules tests, Prettier default formatting with double-quoted strings and semicolons.
• 🟡 (13:53) Publish error-handling guidance requires descriptive early guard-clause errors and a throwing default branch for unknown switch values, e.g. throw new Error(\Unknown status: '${status}'`)`.
• 🟡 (13:53) Publish testing guidance specifies Vitest v4.0.0 with globals, auto-cleared mocks, and mocking external dependencies before requiring the module under test.
• 🟢 (13:53) Craft worktree root contains action.yml, .github/, src/, dist/, package.json, pnpm-lock.yaml, vitest.config.mts, and AGENTS.md.
• 🟢 (13:54) Publish worktree root contains .github/, src/, package.json, yarn.lock, vitest.config.js, and AGENTS.md.
• 🟡 (13:54) Craft current uncommitted changes: modified .github/workflows/release.yml, action.yml, src/commands/__tests__/publish.test.ts, and src/commands/publish.ts; added untracked src/__tests__/action.test.ts. Diffstat: 119 insertions and 5 deletions across 4 tracked files.
• 🟡 (13:54) Publish current uncommitted changes: modified .github/workflows/publish.yml, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, and src/modules/update-issue.js; added untracked src/modules/__tests__/publish-workflow.js. Diffstat: 295 insertions and 40 deletions across 5 tracked files.
• 🟡 (13:54) Partial Craft diff evidence: .github/workflows/release.yml adds optional workspace to workflow_dispatch.inputs with description “Named Craft release workspace to prepare and publish,” and adds WORKSPACE: ${{ inputs.workspace }} under the env of the Request publish step.
• 🟡 (13:54) Partial Craft diff evidence: src/commands/publish.ts adds legacy state-file handling for .craft-publish-${newVersion}.json; if it exists, Craft warns that repo-local legacy state is no longer read because repository contents are attacker-influenceable via PRs, and directs migration to $XDG_STATE_HOME/craft/ via publishStateFile.