Distillation

Date: Sep 8, 2026

• 🟡 (01:36) Working-tree status showed modified files: .github/workflows/ci-poller.yml, .github/workflows/publish.yml, docs/publish-issue-format.md, scripts/generate-publish-issue-title-parser.js, src/modules/__tests__/publish-workflow.js, src/modules/publish-issue-title.js, src/modules/publish-issue-title.peggy, src/modules/release-revision.js, src/publish/inputs.js, src/publish/resolve-location.js, and src/publish/resolve-release-revision.js; untracked paths: src/publish/__tests__/ and src/publish/discover-location.js.
• 🟡 (01:37) Tool output for an attempted JSON parse was Unexpected end of JSON input.
• 🟡 (01:37) Assistant audit finding — MUST-FIX: src/modules/publish-issue-title.peggy:46 uses "/checks/"?, making the entire /checks/ suffix optional; generated src/modules/publish-issue-title.js:911-924 therefore accepts a bare commit URL and rejects /checks without a trailing slash, regressing the intended /checks/? contract. Existing coverage in src/modules/__tests__/release-revision.js:19-22 tests only /checks/.
• 🟡 (01:37) Assistant audit finding — MUST-FIX: “global” check-runs link counting in src/modules/publish-issue-title.peggy:58-61, generated src/modules/publish-issue-title.js:304-307, and src/modules/release-revision.js:3-10 only recognizes lines beginning - [View check runs](. Thus, an inline or blockquoted second check-runs link bypasses counting; a body containing two such links was accepted and returned the header SHA. Existing decoy coverage in src/modules/__tests__/release-revision.js:56-71 tests only a line-start duplicate.
• 🟡 (01:37) Assistant audit finding — MUST-FIX: scripts/generate-publish-issue-title-parser.js:50-59 documentation-generation validation permits removal of the generated documentation block entirely: replace() leaves markerless documentation unchanged and the equality branch then skips verifying marker presence. Consequently, check:generated could pass when documentation lacks the canonical grammar.
• 🟡 (01:37) Assistant audit finding — MAJOR: src/publish/discover-location.js:33-36 parses empty Craft workspace output with raw JSON parsing and throws Unexpected end of JSON input, rather than the required contextual discovery error. src/publish/__tests__/discover-location.js:37-47 covers invalid output {} only, not empty output.
• 🟡 (01:37) Assistant audit finding — MAJOR: docs/publish-issue-format.md:93-94 documents Merge target as optional, while the canonical release-revision grammar in src/modules/publish-issue-title.peggy:42-46 requires a non-empty Merge target: line; src/modules/details-from-context.js:54-59 also extracts it as optional/defaults to "". An issue accepted by the documentation can therefore fail during release-revision resolution.
• 🟡 (01:37) Assistant verified that generated-artifact checking passed; canonical full-path parsing and both LF and CRLF parsing worked; exact-SHA checkout occurs before discovery; root-config fallback and fail-closed discovery are implemented; Craft intentionally uses latest; and .github/workflows/ci-poller.yml uses checkout v7 while retaining workflow_dispatch.
• 🟡 (01:37) Assistant reported the diff was scoped and whitespace-clean, made no file changes during the audit, and concluded DO-NOT-MERGE due to the 3 MUST-FIX and 2 MAJOR findings.