Dashboard › publish › Distillation
61a1fb13-df8d-4dad-9434-3399427c177c["lore_tm_v1_on59lvnrDXk6-30rzv1NTCeaKKkDRcM59HGPHwTPs4A","lore_tm_v1_q36TwvQtRKsUTOrF33ma5xfc-0RKcGBS-Lm-k_Ux0BI","lore_tm_v1_rZkcJ83pqeeIa7uOlIlNgnQY4q_uKGnG6kCgDd0ild4","lore_tm_v1_RRk_6VMGkqU47aX8_R2JPTMcEwRtqEtA_eq_ahl6kXo","lore_tm_v1_kIBRYExsxMHaGgMu1l9xw-4D4tzScy6UwFges9UDNU0"]
Date: Sep 8, 2026
workflow_dispatch refs never access secrets or influence privileged behavior; manual recovery remains always available; the default-branch trusted poller executes the privileged path; repository_dispatch attempts are strict base-10 bounded before arithmetic; self-dispatch works; actions and Craft are immutable; and approval attestations enforce automation proof, direct-bot rejection, human self-approval separation, request/state/event binding, ci-ready and pre-Craft fences, and cleanup.MUST-FIX/CONCERN/PASS, compact test evidence, current file:line citations, and final line exactly MERGE or DO-NOT-MERGE; if blocked, state the exact cause and end DO-NOT-MERGE.jj) never fails on conflict; after rebase/new/squash, conflicts are recorded in the resulting commit and must be checked with jj st.workflow_dispatch.workflow_dispatch relay.ci-ready..jj/ repository in the current directory; it appears to be a Git repository, and jj git init would create a jj repo backed by it..github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js..github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js.83d210b29553ea6f4d97508821724a834c43856e; parent/base shown is 5268a23b118ec834325823deeb325ac7931463e1 with message build(deps): bump js-yaml from 4.3.0 to 4.3.1 (#9174)..github/workflows/auto-approve.yml changes: adds issues: write; pins actions/checkout to 11d5960a326750d5838078e36cf38b85af677262 and actions/create-github-app-token to bcd2ba49218906704ab6c1aa796996da409d3eb1; records an automated approval attestation using node src/publish/record-auto-approval-attestation.js; posts that attestation as a github.token issue comment; and gates the existing auto-approval label operation on successful attestation generation..github/workflows/ci-poller.yml changes trigger architecture from schedule plus direct workflow_dispatch to schedule, repository_dispatch type ci-poller, and workflow_run for completed workflow Run CI Status Poller; check-ci now runs when vars.CI_POLLER_HAS_PENDING == 'true', github.event_name == 'workflow_run', or github.event_name == 'repository_dispatch'..github/workflows/ci-poller.yml validates repository_dispatch client_payload.attempt before arithmetic using ^(0|[1-5][0-9])$; rejects values outside integer 0 through 59; stores the validated value as steps.dispatch-attempt.outputs.value; and self-dispatch increments with attempt=$((10#$ATTEMPT + 1)), preventing octal interpretation..github/workflows/ci-poller.yml checks out trusted default-branch code before privileged operations using pinned actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, ref: ${{ github.event.repository.default_branch }}, and persist-credentials: false; comment states workflow_dispatch can target any ref and trusted code must always run..github/workflows/ci-poller.yml pins all actions/create-github-app-token calls to bcd2ba49218906704ab6c1aa796996da409d3eb1; uses the internal-app token for local label changes and the release-bot token with owner: getsentry for cross-repository CI APIs..github/workflows/ci-poller.yml only polls open issues carrying both ci-pending and accepted, with limit 200; it binds each poll cycle to src/publish/current-accepted-event.js, then validates an approval attestation via src/publish/validate-approval-attestation.js with APPROVAL_ATTESTATION_AUTHOR="github-actions[bot]", issue number/repository/title, and expected accepted actor/event ID..github/workflows/ci-poller.yml removes ci-pending and accepted and comments an invalid-approval retry message whenever accepted-event binding or attestation validation fails; it revalidates both after CI passes and immediately before adding ci-ready..github/workflows/ci-poller.yml replaces independent shell title parsing with parsePublishTitle imported from ./src/modules/details-from-context.js; constructs target repository as getsentry/ plus parsed .repo and takes parsed .version, ensuring CI and publishing target the same parsed release..github/workflows/ci-poller.yml records a CI-ready attestation using src/publish/record-ci-ready-attestation.js, posts it using github.token, verifies output begins ci_ready_attestation=, and removes approval labels if proof creation or proof posting fails..github/workflows/ci-poller.yml determines CI readiness only after at least one check run or commit status exists; accepts status success or zero statuses, requires zero pending checks and zero unsuccessful completed checks; treats success, neutral, and skipped conclusions as passing; changes successful issues from ci-pending to ci-ready; changes failed issues from ci-pending to ci-failed and removes accepted..github/workflows/ci-poller.yml cleanup runs with if: always(), counts remaining open issues with both ci-pending and accepted, and synchronizes CI_POLLER_HAS_PENDING to "false" when count is 0 or "true" otherwise using the dedicated poller-app token..github/workflows/ci-poller.yml self-dispatches remaining work through POST repos/$GITHUB_REPOSITORY/dispatches with {event_type: "ci-poller", client_payload: {attempt: $attempt}}; caps self-dispatch at 60 attempts and relies on cron afterward..github/workflows/publish.yml waiting-for-ci job now first checks out publish code with pinned actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 and persist-credentials: false; its existing accepted-label gate requires an open issue whose title starts publish: ..github/workflows/publish.yml authorizes an approval via src/publish/authorize-approval.js using a release-bot token and the triggering actor, issue number, repository, and title; records the generated attestation as an issue comment; validates it using src/publish/validate-approval-attestation.js as authored by github-actions[bot]; and rejects invalid authorization, attestation, or validation by removing accepted, commenting a retry message, and failing..github/workflows/publish.yml resets accepted issues to a fresh CI state by removing ci-failed and ci-ready and adding ci-pending; it enables CI_POLLER_HAS_PENDING with a best-effort dedicated poller-app token and immediately triggers the poller through POST repos/$GITHUB_REPOSITORY/dispatches -f event_type=ci-poller..github/workflows/publish.yml publish job remains limited to open issues whose labeled event is ci-ready, have accepted and ci-ready, and lack ci-pending and ci-failed; it adds initial and immediately pre-Craft approval-attestation validation with REQUIRE_CI_READY_ATTESTATION: "true", removing accepted, commenting, and failing if either fence is invalid..github/workflows/publish.yml pins checkout actions to d23441a48e516b6c34aea4fa41551a30e30af803, actions/setup-node to 249970729cb0ef3589644e2896645e5dc5ba9c38, and Craft from mutable docker://getsentry/craft:latest to immutable docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b..github/workflows/publish.yml writes Craft publish-state outside target repository __repo__/ at $GITHUB_WORKSPACE/.craft-state/craft/publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${version_sanitised}.json; uses SHA-1’s first 12 characters of canonical container cwd, sanitized lowercase owner/repo/version values, and passes XDG_STATE_HOME: /github/workspace/.craft-state to Craft to prevent repository contents from pre-populating publish state..github/workflows/test.yml pins actions/checkout to d23441a48e516b6c34aea4fa41551a30e30af803, actions/setup-node to 249970729cb0ef3589644e2896645e5dc5ba9c38, and actions/cache to 0057852bfaa89a56745cba8c7296529d2fc39830; Node version remains 24, cache key remains ${{ runner.os }}-node_modules-${{ hashFiles('package.json', 'yarn.lock') }}, dependency installation remains yarn install --frozen-lockfile, and tests remain yarn test.