Distillation

Date: September 10, 2026

• 🔴 (02:10) User directed that .github/workflows/ci-poller.yml must always allow workflow_dispatch for manual recovery; the check-ci job condition is vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'.
• 🔴 (02:10) User stated the CI poller always adds the ci-ready label after checking CI, including when ci-ready was previously present because waiting-for-ci removes it first so a fresh labeled event fires.
• 🟡 (02:10) User supplied an upstream .github/workflows/ci-poller.yml diff that adds a Check out publish controller step using actions/checkout@v7 with path: .__publish__.
• 🟡 (02:10) The supplied workflow diff upgrades the publish job’s repository checkout from actions/checkout@v6 to actions/checkout@v7, retaining path: .__publish__.
• 🟡 (02:10) The supplied workflow diff includes a publish-path containment failure: ::error::Publish path must remain inside the target checkout.
• 🟡 (02:10) The supplied workflow diff sets CRAFT_PUBLISH_STATE_GITHUB_REPO: getsentry/${{ fromJSON(steps.inputs.outputs.result).repo }}.
• 🟡 (02:10) The supplied workflow diff adds tests titled skips an issue without editing it when the poller resolver fails and skips an issue without editing it when the rewrite response body is empty.
• 🟡 (02:10) Assistant identified four required upstream workflow additions: 1. canonical poller input resolution, 2. CI-approved revision checkout, 3. repository-contained location discovery, and 4. workspace-aware state naming.
• 🟡 (02:10) Assistant began mapping the four upstream additions into the hardened workflow step order while preserving attestation checks before and after every mutable issue update and immediately before publication.