Distillation

Date: Aug 29, 2026

• 🟡 [requested-read-only-review] (12:33) User requested a rigorous, read-only adversarial review of uncommitted compact workspace publish-contract changes in both worktrees: /home/byk/Code/getsentry/craft-workspace-action-propagation on feat/workspace-action-propagation, and /home/byk/Code/getsentry/publish-workspace-acceptance on feat/workspace-acceptance.
• 🔴 (12:33) User directed that the review must not modify files, stage, commit, or run destructive commands.
• 🔴 (12:33) User stated the Publish controller always uses getsentry/craft:latest; this is intentional and must not be reported as a mutable-image concern.
• 🔴 (12:33) User stated Craft must release first so latest contains workspace list and craft publish --rev.
• 🟡 (12:33) User requested assessment of: CI-approved revision extraction from the issue check-runs link; binding checkout/state/location/publish to that same revision; detached-SHA Craft checkout fallback; legacy title compatibility; classifying compact single-path-segment workspace-first only after checkout/discovery; missing-root-config path-only behavior and discovery failure; absence of workspace normalization; ASCII new-workspace boundary; legacy JSON workspace parsing and rejection of workspace plus non-root path; parser grammar/generated-artifact freshness; state filename parity and state GitHub identity; workflow action expressions/YAML/shell injection/traversal; intended latest contract; test quality/regressions; both old and new flows; CI lifecycle breakage; and current untracked/staged status.
• 🔴 (12:33) User stated pnpm-lock.yaml in the Publish worktree is unrelated and must not be committed.
• 🟡 (12:33) User requested an evidence-based review with findings ordered CRITICAL/MAJOR/MINOR, exact file:line citations, practical fixes, clear distinction of intentional behavior, and an explicit MERGE or DO-NOT-MERGE verdict; if no findings, remaining deployment/verification risks must be stated.
• 🟢 (12:33) Tool directory listing showed Craft worktree /home/byk/Code/getsentry/craft-workspace-action-propagation contains, among other items: .craft.yml, .github/, action.yml, AGENTS.md, dist/, node_modules/, package.json, pnpm-lock.yaml, src/, and vitest.config.mts (33 entries total).
• 🟢 (12:33) Tool directory listing showed Publish worktree /home/byk/Code/getsentry/publish-workspace-acceptance contains, among other items: .github/, AGENTS.md, docs/, node_modules/, package.json, pnpm-lock.yaml, scripts/, src/, vitest.config.js, and yarn.lock (16 entries total).
• 🟡 (12:33) Craft worktree status on feat/workspace-action-propagation / origin/feat/workspace-action-propagation: modified action.yml, docs/src/content/docs/targets/github.md, src/__tests__/action.test.ts, src/__tests__/config.test.ts, src/commands/__tests__/publish.test.ts, src/commands/publish.ts, src/config.ts, src/index.ts, and src/schemas/project_config.ts; untracked src/commands/workspace.ts and src/commands/workspace_cmds/.
• 🟡 (12:33) Craft worktree HEAD and origin/feat/workspace-action-propagation were both 6dae341f9bc1378abde7a9022108caded2d22226 (6dae341, message feat: propagate release workspaces); its reported base/merge reference was 21270a1d12a60b461c51fba93bd076b90d9cf4af.
• 🟡 (12:33) Craft committed branch comparison reported 6dae341 changes: .github/workflows/release.yml (+9), action.yml (+35/-5), src/__tests__/action.test.ts (+144), src/commands/__tests__/publish.test.ts (+47), and src/commands/publish.ts (+33), totaling 263 insertions and 5 deletions across 5 files.
• 🟡 (12:33) Craft uncommitted tracked diff reported: action.yml (+18/-3), docs/src/content/docs/targets/github.md (+36/-1), src/__tests__/action.test.ts (+125/-3), src/__tests__/config.test.ts (+130/-22), src/commands/__tests__/publish.test.ts (+27), src/commands/publish.ts (+18/-1), src/config.ts (+48/-4), src/index.ts (+2), and src/schemas/project_config.ts (+63/-63), totaling 370 insertions and 97 deletions across 9 files; untracked workspace files were not included in that tracked diff statistic.
• 🟡 (12:33) Publish worktree status on feat/workspace-acceptance / origin/feat/workspace-acceptance: modified .github/workflows/publish.yml, docs/publish-issue-format.md, package.json, src/modules/__tests__/details-from-context.js, src/modules/__tests__/publish-workflow.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/publish/inputs.js, and yarn.lock; untracked pnpm-lock.yaml, scripts/, src/modules/__tests__/publish-location.js, src/modules/__tests__/release-revision.js, src/modules/publish-issue-title.js, src/modules/publish-issue-title.peggy, src/modules/publish-location.js, src/modules/release-revision.js, src/publish/resolve-location.js, and src/publish/resolve-release-revision.js.
• 🟡 (12:33) A Publish worktree revision-resolution command failed with fatal: Needed a single revision; no valid single base revision was produced by that command.
• 🟡 (12:34) Publish repository remotes were origin https://github.com/getsentry/publish.git for fetch and push. Local main and origin/main were 83d210b29553ea6f4d97508821724a834c43856e; origin/HEAD points to origin/main.
• 🟡 (12:34) Publish branch feat/workspace-acceptance and origin/feat/workspace-acceptance were both b658ffa0299fedf78c9dd9a2121cd740691ca157 (b658ffa, message fix: validate publish workspace JSON); a prior branch commit was 33de3f1 (feat: accept workspace publish requests).
• 🟡 (12:34) Publish committed comparison for 33de3f1 reported modifications to .github/workflows/cocoapods-keepalive.yml (+2/-1), .github/workflows/publish.yml (+27/-1), README.md (+5), docs/publish-issue-format.md (+81), src/modules/__tests__/details-from-context.js (+230/-1), src/modules/__tests__/publish-workflow.js (+82), src/modules/__tests__/update-issue.js (+15/-1), src/modules/details-from-context.js (+33/-1), and src/modules/update-issue.js (+54/-3): 488 insertions and 41 deletions across 9 files.
• 🟡 (12:34) Publish uncommitted tracked diff reported .github/workflows/publish.yml (+59/-59), docs/publish-issue-format.md (+55/-22), package.json (+5), src/modules/__tests__/details-from-context.js (+20), src/modules/__tests__/publish-workflow.js (+36/-1), src/modules/details-from-context.js (+19/-4), src/modules/post-workflow-details.js (+2/-2), src/publish/inputs.js (+2/-2), and yarn.lock (+31): 167 insertions and 62 deletions across 9 files.
• 🟡 (12:34) Craft workspace command files identified: src/commands/workspace.ts, src/commands/workspace_cmds/list.ts, and src/commands/workspace_cmds/__tests__/list.test.ts.
• 🔴 (12:34) User preference/directive: always twine verbose (#8437).
• 🔴 (12:34) User preference/directive: always use pnpm for package management.
• 🔴 (12:34) User preference/directive: never use npm or yarn.
• 🔴 (12:34) User stated Node.js is managed by Volta and is currently v22.12.0.
• 🔴 (12:34) User stated dependencies should be installed with pnpm install --frozen-lockfile.