Distillation

Date: Sep 4, 2026

• 🔴 [requested-read-only-audit] (23:51) User requested a final strict READ-ONLY audit of CURRENT uncommitted diffs in two worktrees: Craft at /home/byk/Code/getsentry/craft-workspace-action-propagation and Publish at /home/byk/Code/getsentry/publish-workspace-acceptance. User prohibited edits, formatting, generation, and git-state mutation.
• 🔴 [requested-scope-hygiene] (23:51) User required scope hygiene verification from actual git status --short and git diff --name-only. User asserted prior claim of unrelated .github/workflows/cocoapods-keepalive.yml change is false for the current Publish worktree and directed it not be reported unless current diff proves it exists.
• 🔴 (23:51) User stated getsentry/craft:latest is intentional and required; it must not be reported as a concern.
• 🔴 [requested-release-audit] (23:51) User requested audit coverage of: malformed nested brace globs packages/{cli,{mcp}} and packages/{cli,{{},mcp}} failing closed in schema and runtime without discarded invalid branches; valid nested braces; glob safety before filesystem access; realpath containment; action-input validation and full exact path titles; Publish parser/controller/poller semantic validation before cross-repository API/checkout; exact CI-SHA checkout before discovery; exact path matching; discovery fallback/validation; fresh ci-ready gates; external scoped state and --rev; identical lossless Craft/Publish version-state encoding; parser-generated-doc parity; and test coverage.
• 🔴 (23:51) User required severity-ranked findings with exact current file:line citations, each audit area marked PASS, CONCERN, or MUST-FIX; response must end exactly MERGE or DO-NOT-MERGE; if blocked, response must begin BLOCKED with exact tool/error.
• 🔴 (23:51) User preference/directive: Never return empty.
• 🟡 (23:51) Assistant stated it would inspect both worktrees read-only, establish exact changed-file scope first, then trace the release-workspace contract end-to-end.
• 🟢 (23:53) Craft worktree directory listing confirmed repository contains .craft.yml, .git, .github/, action.yml, docs/, src/, package.json, pnpm-lock.yaml, node_modules/, dist/, vitest.config.mts, and 33 total entries.
• 🟢 (23:54) Publish worktree directory listing confirmed repository contains .git, .github/, docs/, src/, scripts/, package.json, yarn.lock, node_modules/, vitest.config.js, and 15 total entries.
• 🟡 (23:56) Current Craft git status --short / git diff --name-only showed exactly 9 modified files: action.yml; docs/src/content/docs/targets/github.md; src/__tests__/action.test.ts; src/__tests__/config.test.ts; src/commands/prepare.ts; src/config.ts; src/schemas/project_config.ts; src/utils/__tests__/publishState.test.ts; src/utils/publishState.ts.
• 🟡 (23:56) Current Publish git status --short / git diff --name-only showed modified files .github/workflows/publish.yml, docs/publish-issue-format.md, src/modules/__tests__/ci-poller-input.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/publish-location.js, src/modules/__tests__/publish-workflow.js, src/modules/ci-poller-input.js, src/modules/details-from-context.js, src/modules/publish-issue-title.js, src/modules/publish-issue-title.peggy, src/modules/publish-location.js, src/publish/resolve-location.js; and one untracked file src/modules/publish-issue-validation.js. .github/workflows/cocoapods-keepalive.yml was absent from this current scope.
• 🔴 (23:57) User preference/directive: always carry the full concrete path/value.
• 🟡 (23:57) Craft diff stat: 9 files changed, 684 insertions and 44 deletions.
• 🟡 (23:57) Craft action.yml changes: sets LC_ALL: C; validates PATH_INPUT as . or slash-separated safe ASCII segments [A-Za-z0-9_.-]+ excluding ., .., __proto__, and segments beginning -; validates nonempty WORKSPACE using the same safe path-segment rules; emits exact errors The path input must use ASCII path segments containing only letters, digits, periods, underscores, and hyphens. and Workspace names must use ASCII path segments containing only letters, digits, periods, underscores, and hyphens.; and runs unset CRAFT_WORKSPACE before root Craft prepare and target-reading commands.
• 🟡 (23:57) Craft docs docs/src/content/docs/targets/github.md now define release-workspace keys as literal paths or glob patterns expanded to concrete directories relative to .craft.yml; --workspace <path> selects a concrete path; configured globs ignore files; overlapping workspace keys are rejected; craft workspace list outputs concrete workspace paths as JSON; and action publish titles carry the full concrete path. Documentation example changed workspace keys from cli / mcp to packages/* / tools/mcp.
• 🟡 (23:57) src/commands/prepare.ts now obtains repository root with git.revparse(['--show-toplevel']) and passes repositoryRoot.trim() as the workspaceDirectory second argument to loadConfigurationFromString(configContent, repositoryRoot.trim()) for --config-from configuration.
• 🟡 (23:57) src/config.ts imports realpathSync from fs and globSync, hasMagic from glob; setActiveWorkspace() now clears _configPathCache; findConfigFile() only reuses _configPathCache if existsSync(_configPathCache).
• 🟡 (23:57) src/config.ts adds glob workspace resolution: getWorkspaceConfig(), workspaceKeyMatches(), getWorkspaceNamesFromConfig(), and getWorkspaceGlobMatches(). Matching glob keys are expanded with globSync(workspaceGlob, { absolute: false, cwd: root, dot: true, ignore: ['**/node_modules/**'], posix: true }), retain only safe directory matches inside both lexical root and realpathSync(root) containment, then sort. Multiple matching keys throw ConfigurationError naming concrete workspace and matching patterns.
• 🟡 (23:57) src/config.ts implements isSafeWorkspacePath(), isSafeWorkspaceGlob(), isSafeWorkspaceGlobSegment(), isSafeWorkspaceGlobPattern(), expandBraceAlternatives(), and splitBraceAlternatives(). Safety rejects absolute paths, backslashes, empty / . / .. / __proto__ segments, segments beginning -, invalid ASCII literals, malformed brace alternatives, and requires brace alternatives to have more than one choice. isWorkspacePattern() uses hasMagic(name, { magicalBraces: true }).
• 🟡 (23:57) src/config.ts changes workspace selection APIs so applyWorkspaceSelection(config, workspaceDirectory) and resolveWorkspaceConfig(base, workspaceName, workspaceDirectory) operate on concrete names; getConfiguration() uses path.dirname(configPath); loadConfigurationFromString(configContent, workspaceDirectory = process.cwd()) accepts a workspace directory; and getWorkspaceNames() expands globs relative to path.dirname(configPath).
• 🟡 (23:57) src/schemas/project_config.ts imports hasMagic from glob and duplicates brace-expansion and safe-glob validation helpers. WorkspaceNameSchema now refines with isSafeWorkspaceGlob and error Workspace paths must use safe ASCII segments.
• 🟡 (23:57) src/utils/publishState.ts adds encodeVersionForFilename(version): it retains sanitiseForFilename(version) only if lossless; otherwise emits version-${Buffer.from(version).toString('base64url')}. getPublishStateFilename() now uses encodeVersionForFilename(version) rather than sanitiseForFilename(version).
• 🟡 (23:59) Craft action tests update the fake craft executable to exit 1 if inherited CRAFT_WORKSPACE is nonempty. Tests accept workspace inputs '', cli-v2, packages/cli, and packages/CLI; reject unsafe path inputs ../outside, /tmp, ./packages/cli, packages//cli, and packages/../cli before git/Craft side effects; reject workspace values cli\nnext, packages/*, ./packages/cli, packages//cli, packages/./cli, packages/../cli, packages/__proto__/cli, and packages/-cli; expect title publish: getsentry/toolkit/packages/cli@1.2.3; and verify unset CRAFT_WORKSPACE permits root commands producing exact calls prepare then targets.
• 🟡 (23:59) Craft config tests add coverage for: packages/* expansion to packages/cli and packages/mcp; remote config glob expansion from explicit repository root; negated classes packages/[!a]* and packages/[^a]*; valid brace glob packages/{cli,mcp}; valid nested brace glob packages/{cli,{mcp,api}}; ?, [cm]*, and **/cli globs; symlink exclusion via realpath containment; rejection of unsafe brace alternatives {../outside/*,packages/*} and {/tmp/*,packages/*}; rejection of malformed globs packages/{cli, packages/{cli}, packages/{cli,{mcp}}, and packages/{cli,{{},mcp}}; unsafe literals; and multiple matching globs packages/* plus packages/cli*.
• 🟡 (23:59) Craft publish-state tests verify versions 4.2.6+sentry1 and 4.2.6+Sentry1 produce distinct filenames containing respectively -version-NC4yLjYrc2VudHJ5MQ.json and -version-NC4yLjYrU2VudHJ5MQ.json.