Distillation

Date: Sep 10, 2026

• 🔴 (03:13) User stated the previous review returned an empty result and that an empty audit result is invalid.
• 🔴 (03:13) User requires the CI poller to always re-add ci-ready after CI passes.
• 🔴 [requested-review] (03:13) User requested a resumed read-only adversarial audit of the exact unchanged tree at /home/byk/Code/getsentry/publish, scoped only to failure, cancellation, success, stale-label cleanup, issue updates, comments, and CI-poller lifecycle/retry transitions; every relevant changed file and test must be inspected.
• 🔴 (03:13) User required each audited area to be classified PASS, CONCERN, or MUST-FIX, with exact current file:line evidence and reasoning.
• 🔴 (03:13) User required every audit finding to include a concrete failure sequence and fix.
• 🔴 (03:13) User required a non-empty result; if tool access blocks the audit, the response must begin BLOCKED and name the exact tool/error; no files may be edited; the final response must end exactly MERGE or DO-NOT-MERGE.
• 🟡 (03:13) Audit investigation confirmed a shell-control bug in the CI poller: every continue is inside a subshell, so Bash ignores it outside the active parent-loop context and proceeds into the supposedly fenced code following it. The tree remained read-only while remaining files and tests were being inspected.
• 🔴 (03:13) src/modules/__tests__/ci-poller-input.js tests getCiPollerInput() with revision 7e5ca7ed5581552de066e2a8bc295b8306be38ac: root title publish: getsentry/toolkit/cli@1.2.3 and path title publish: toolkit/packages/cli/v2@1.2.3 both resolve to repo getsentry/toolkit, version 1.2.3, the revision, and a requestDigest() derived from issue body, labels, and title.
• 🔴 (03:13) src/modules/__tests__/ci-poller-input.js:49-61 verifies .github/workflows/ci-poller.yml checks out publish code under .__publish__, runs node .__publish__/src/publish/resolve-ci-poller-input.js, and no longer uses grep -oP '(?<=commit/.
• 🔴 (03:13) src/modules/__tests__/ci-poller-input.js:63-105 rejects unsafe repositories -toolkit, ., .., and __proto__ with Invalid publish issue repository; invalid versions --config and 1.2 with Invalid publish issue version; malformed titles publish: getsentry/@1.2.3 and publish: getsentry/toolkit$@1.2.3 with Invalid publish issue title; and unsafe paths containing ../other, ./other, __proto__/other, or --config with Invalid publish issue path, all before CI API calls.
• 🔴 (03:13) src/modules/__tests__/release-revision.js verifies getReleaseRevision() reads the CI-approved lowercase 40-character SHA from the canonical request-header View check runs URL, accepts CRLF bodies and a URL without a trailing slash, and rejects a missing /checks path or a link targeting another repository.
• 🔴 (03:13) src/modules/__tests__/release-revision.js:76-127 rejects a decoy check-runs link, an embedded check-runs link, a complete Quick links block, or a complete request header outside the canonical issue-body header; duplicate/decoy links produce Expected exactly one View check runs link in Quick links, while misplaced headers produce Expected a View check runs link for getsentry/toolkit.
• 🔴 (03:13) src/modules/__tests__/release-revision.js:129-151 verifies updateReleaseRevision() updates only the canonical request-header revision while preserving CRLF and trailing content, and rejects uppercase, 39-character, or 41-character replacement SHAs with Release revision must be a lowercase 40-character SHA.
• 🔴 (03:13) src/modules/__tests__/details-from-context.js verifies detailsFromContext() parses repo sentry, version 21.3.1, path ., merge target custom-branch, and checked targets in order github, npm[@sentry/node], docker[latest]; it also supports version 4.2.6+sentry1.
• 🔴 (03:13) src/modules/__tests__/details-from-context.js:74-89 verifies qualified title publish: getsentry/sentry-javascript/packages/core@10.0.0 parses to repo sentry-javascript, path /packages/core, version 10.0.0, while legacy publish: sentry-javascript@10.0.0 parses with an empty path.
• 🔴 (03:13) src/modules/__tests__/details-from-context.js:116-169 verifies Merge target: (default) becomes an empty merge_target, a later decoy Merge target does not override the canonical header, and title publish: getsentry/toolkit/packages/cli@1.2.3 retains workspace path ./packages/cli.
• 🔴 (03:13) src/modules/__tests__/details-from-context.js:171-279 rejects an unexpected space before @, escaping .. and current-directory . path segments, unsafe repository identities -toolkit, ., .., and __proto__, invalid versions --config and 1.2, version path syntax 1.2.3/other, and missing issue context with their specific validation errors.
• 🔴 (03:13) src/libs/github.js:7-15 defines getGitHubToken(): it returns process.env.GITHUB_TOKEN when set and otherwise throws No "GITHUB_TOKEN" environment variable found. Please ensure the workflow is configured correctly; src/libs/__tests__/github.js:7-18 tests both cases using token value Example Token.
• 🔴 (03:13) src/publish/resolve-release-revision.js:4-17 parses process.env.PUBLISH_ARGS || "{}", requires a truthy repo or throws Publish input must define a repository., resolves the revision from PUBLISH_ISSUE_BODY || "" through getReleaseRevision(), and writes the revision output with @actions/core.
• 🔴 (03:13) src/publish/__tests__/resolve-release-revision.js:7-20 spawns resolve-release-revision.js with empty PUBLISH_ARGS and PUBLISH_ISSUE_BODY, verifies a nonzero exit and Publish input must define a repository., and verifies stderr does not contain Unexpected end of JSON input.