Dashboard › publish › Distillation
5bcecfa8-52f8-4eb1-b0b1-808aa39bcdc9["lore_tm_v1_ohvk3msjbULjfD8RDWGzVdRFmVYEm4hEXBamdvt39Vs","lore_tm_v1_XRrL7jK-GRji68VO8trQo92BmRkVWgYr--htBp-Qi6s","lore_tm_v1_ikv2ww9OyIMoBVho9THOi64WoLyXgtp1nLZ9yC-HKEU","lore_tm_v1_EfPdXTXmQ1XY7s_nhiggePE5KoDSGppb6yB0yDz8RO8","lore_tm_v1_rxbm4z8QdspLHz0l-d8V3Msf2CinlPY3XFFZ1NziWqo","lore_tm_v1_I07_hFPH_5vdb9ASfNJELvDcqCLUxqVFdKudKduHc6M","lore_tm_v1_DwCg2t7-PSC4G2A-KGLk2VWADhgUg56IJC5mQCVGXlA","lore_tm_v1_Dl8d1JqmlB-dA6g28pZrGP-YQ6Mhz2UPFKbszdzVmug","lore_tm_v1_s-k-NbxDT8lyVQ-7K6u3eYhJw4I9JoYtPAz_nZymaCE","lore_tm_v1_oExtn4b1oBVfCBGmejkK2QU2cCnyG7f16V1WfuH11ek","lore_tm_v1_6uXTfJ1Vnee8kIlB-y8BREPzTk35Ezxcg8WtYx8CAyg","lore_tm_v1_FlVOr4q4wDpU9p4qprNElBBS-wCGLGZFJwTP_FX4WTU"]
Date: Aug 29, 2026
src/publish/validate-approval-attestation.js (140 lines). validateApprovalAttestation() concurrently fetches the issue, all issue events, and all comments; approval requires the fetched title to equal issueTitle, a live accepted label, a current accepted-label event, and hasApprovalAttestation(). With requireCiReadyAttestation: true, it additionally requires a current ci-ready event, a live ci-ready label, and hasCiReadyAttestation({ acceptedEvent: event, attestationAuthor, comments, ciReadyEvent, title }).validate-approval-attestation.js uses APPROVAL_TOKEN against https://api.github.com/ with Accept: "application/vnd.github+json" and "X-GitHub-Api-Version": "2026-03-10"; getAllPages() requests 100 records per page. Its CLI requires APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and APPROVAL_ATTESTATION_AUTHOR; REQUIRE_CI_READY_ATTESTATION === "true" enables CI-ready validation.src/publish/record-ci-ready-attestation.js (96 lines). getAuthenticatedLogin() calls GitHub API endpoint "user" using getGitHubResponse() and requires a string login, otherwise throws Could not retrieve the authenticated user: GitHub returned ${response.status} or GitHub returned no authenticated user login.recordCiReadyAttestation() concurrently retrieves issue metadata, all issue events, and authenticated login; it rejects if fetched title differs from issueTitle, live labels lack accepted, or currentAcceptedEvent(events) is absent, throwing "The approval changed before CI could be marked ready". On success it returns createCiReadyAttestation({ acceptedEvent, ciReadyActor, title }).record-ci-ready-attestation.js CLI requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, and APPROVAL_ISSUE_TITLE; it appends ci_ready_attestation=${attestation}\n to GITHUB_OUTPUT. It exports getAuthenticatedLogin, main, and recordCiReadyAttestation.ci-poller.yml references relevant to CI-ready proof/transition: node src/publish/record-ci-ready-attestation.js at line 260, --body "$ci_ready_attestation" at line 274, and echo " CI passed! Adding ci-ready label." at line 301.ci-ready..github/workflows/ci-poller.yml lines 205–339. After CI is passing, it revalidates approval using APPROVAL_TOKEN="$GH_TOKEN" and APPROVAL_ATTESTATION_AUTHOR="github-actions[bot]"; invalid approval removes ci-pending and accepted, comments the standard retry message, then continues.ci-poller.yml records a CI-ready proof to a temporary attestation_output using GITHUB_OUTPUT="$attestation_output", APPROVAL_TOKEN="$GH_TOKEN", issue number/repository/title, and node src/publish/record-ci-ready-attestation.js. Recorder failure removes ci-pending and accepted, comments the retry message, and continues.source "$attestation_output" and then deleted via rm -f "$attestation_output"; it posted the proof comment using GH_TOKEN="${{ github.token }}" gh issue comment ... --body "$ci_ready_attestation".ci-poller.yml revalidates approval immediately before the transition. If changed, it removes ci-pending and accepted, comments the retry message, and continues; otherwise it removes ci-pending, adds ci-ready, and comments CI checks passed for ${repo}@${version}. Publishing is starting now.ci-pending and accepted, add ci-failed, and comment failed check names plus https://github.com/${repo}/commit/${sha}/checks/; a failed combined commit status with no pending/unsuccessful check runs performs the same label changes and comments failed status contexts.source "$attestation_output" could treat the CI-ready attestation output as shell code. It stated it would replace this with a literal data read, then run full suite and lint..github/workflows/ci-poller.yml.ci-ready match, and then run full validation..github/workflows/ci-poller.yml.accepted-label event and issue title..github/workflows/ci-poller.yml lines 1–210. It runs every 5 minutes (cron: "*/5 * * * *") and supports workflow_dispatch with optional attempt input defaulting to "0". Permissions are contents: read and issues: write.ci-poller.yml job check-ci runs on ubuntu-latest in production; it runs when vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch', preserving manual recovery. Concurrency group is ci-status-poller with cancel-in-progress: false.actions/checkout@v6 with persist-credentials: false; creates sentry-internal-app token via actions/create-github-app-token@v3 from vars.SENTRY_INTERNAL_APP_ID and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY; and creates cross-repository sentry-release-bot token using vars.SENTRY_RELEASE_BOT_CLIENT_ID, secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY, and owner: getsentry.GH_TOKEN to the sentry-internal-app token for issue-label changes that trigger publish.yml, and RELEASE_TOKEN to sentry-release-bot for cross-repository API calls. Helper gh_api_release() runs GH_TOKEN="$RELEASE_TOKEN" gh api, captures stdout/stderr, emits ::warning::gh api failed: $output on failure, and returns the API exit code.ci-pending and accepted labels, requesting number,title,labels,body; it exits if none. For each issue, it validates the approval proof before parsing/checking CI, parses title via parsePublishTitle() from ./src/modules/details-from-context.js, and requires repository and version./commit/{SHA}/checks issue-body URL. It uses release-bot access to obtain the original commit’s first check suite head_branch, then resolves the branch HEAD via repos/${repo}/git/ref/heads/${branch}; it falls back to issue SHA on missing/failing lookups and updates all matching issue-body SHA instances if branch HEAD changed.gh_api_release; it skips an issue if either API call fails. It counts all check runs, non-completed runs, and completed runs whose conclusion is not "success", "neutral", or "skipped".