Dashboard › publish › Distillation
64b6ac00-dd0d-4a9c-93a2-7be6017fd84f["lore_tm_v1_pBlUh7ui5B1M_DpaYaBz2bw1tFyYQwar_s63SnTUuwI"]
.github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, docs/key_rotation_vault_changes.md, docs/rfc.md, package.json, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, src/publish/update-issue.js, and yarn.lock.docs/publish-issue-format.md, scripts/generate-publish-issue-title-parser.js, src/modules/__tests__/ci-poller-input.js, src/modules/__tests__/ci-poller-workflow.js, src/modules/__tests__/generate-publish-issue-title-parser.js, src/modules/__tests__/publish-location.js, src/modules/__tests__/publish-workflow.js, src/modules/__tests__/release-revision.js, src/modules/ci-poller-input.js, src/modules/publish-issue-title.js, src/modules/publish-issue-title.peggy, src/modules/publish-issue-validation.js, src/modules/publish-location.js, src/modules/release-revision.js, src/publish/__tests__/discover-location.js, src/publish/__tests__/resolve-location.js, src/publish/__tests__/resolve-release-revision.js, src/publish/discover-location.js, src/publish/resolve-ci-poller-input.js, src/publish/resolve-location.js, and src/publish/resolve-release-revision.js..github/workflows/ci-poller-dispatch.yml relay is the trusted workflow_dispatch entry point, while .github/workflows/ci-poller.yml now reacts to its successful default-branch workflow_run..github/workflows/ci-poller.yml checks out github.event.repository.default_branch using actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 with persist-credentials: false, preventing an arbitrary manually dispatched ref from supplying executable poller code..github/workflows/ci-poller.yml revalidates after final CI checks and again immediately before applying ci-ready..github/workflows/ci-poller.yml replaces direct workflow_dispatch inputs with repository_dispatch type ci-poller and workflow_run completion events for workflow Run CI Status Poller; issues permission changes from read to write.check-ci job gate in .github/workflows/ci-poller.yml runs when vars.CI_POLLER_HAS_PENDING == 'true', for any repository_dispatch, or for a successful workflow_run whose head_branch equals github.event.repository.default_branch; concurrency remains group ci-status-poller with cancel-in-progress: false.^(0|[1-5][0-9])$; invalid values emit repository_dispatch attempt must be an integer from 0 through 59. The validated attempt is exported as steps.dispatch-attempt.outputs.value..github/workflows/ci-poller.yml pins all shown actions/create-github-app-token uses to bcd2ba49218906704ab6c1aa796996da409d3eb1 and replaces the separate checkout at .__publish__ with the trusted default-branch checkout at repository root.ci-pending issue, .github/workflows/ci-poller.yml calls src/publish/current-accepted-event.js using APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY, extracts .actor and .eventId, and validates them through src/publish/validate-approval-attestation.js with APPROVAL_ATTESTATION_AUTHOR="github-actions[bot]", EXPECTED_ACCEPTED_ACTOR, and EXPECTED_ACCEPTED_EVENT_ID.ci-pending and accepted, comments Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue., and continues to the next issue.src/publish/resolve-ci-poller-input.js. It parses the issue title through parsePublishTitle() from src/modules/details-from-context.js, forms repository getsentry/${parsed.repo}, reads .version, and extracts a 40-character lowercase hexadecimal commit SHA from the issue body’s commit/{SHA}/checks link using grep -oP '(?<=commit/)[0-9a-f]{40}(?=/checks)'..github/workflows/ci-poller.yml replaces the old issue SHA directly in the body via updated_body="${body//${issue_sha}/${sha}}" and updates the issue with gh issue edit --body, replacing the deleted canonical-input resolver workflow.continue rather than subshell-local exit 0, allowing later issues in the loop to be processed.src/publish/record-ci-ready-attestation.js, requires output beginning exactly with ci_ready_attestation=, posts the attestation using ${{ github.token }} so its author is github-actions[bot], and revalidates once more before replacing ci-pending with ci-ready..github/workflows/ci-poller.yml to remove ci-pending and accepted, post the standard invalid-approval retry comment, and skip ci-ready.repository_dispatch rather than gh workflow run: it parses attempts with 10#$ATTEMPT, stops at 60 attempts, and posts {"event_type":"ci-poller","client_payload":{"attempt":"..."}} to repos/$GITHUB_REPOSITORY/dispatches. The cron fallback remains after approximately 30 minutes..github/workflows/publish.yml, the approval-handling job checks out publish code using pinned actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 with persist-credentials: false, obtains a release-bot token with continue-on-error: true, and runs src/publish/authorize-approval.js using the issue actor, number, repository, and title..github/workflows/publish.yml posts steps.authorization.outputs.approval_attestation, then validates it through src/publish/validate-approval-attestation.js as authored by github-actions[bot]. Authorization failure, authorized != 'true', comment failure, or validation failure removes accepted, posts the standard invalid-approval retry comment, and exits 1.ci-poller instead of directly running ci-poller.yml.publish job in .github/workflows/publish.yml validates the approval and required CI-ready attestation before setup using REQUIRE_CI_READY_ATTESTATION: "true". Invalid validation removes accepted, posts the standard invalid-approval retry comment, and exits 1.publish job revalidates the same approval and CI-ready proof immediately before invoking Craft. Revocation or invalidation at this final check removes accepted, posts the retry comment, and exits 1..github/workflows/publish.yml are pinned: checkout uses actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, setup-node uses actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with Node 24, app-token creation uses actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1, and Craft uses docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b..github/workflows/publish.yml removes src/publish/resolve-release-revision.js and no longer checks out the target repository at a revision derived from the issue body. The target checkout uses steps.target-repo-branch.outputs.target_repo_branch || '', otherwise defaulting to the repository’s default branch, and craft publish runs without --rev.sentry-migr8/tmp-merge-target; sentry-javascript/v10; sentry-javascript/v9; sentry-javascript/v8; sentry-javascript/v7; sentry-javascript/master; sentry-python/alpha; and sentry-wizard/1.x..github/workflows/publish.yml removes location discovery through src/publish/discover-location.js; CRAFT_PUBLISH_PATH and the Craft working directory now come directly from fromJSON(steps.inputs.outputs.result).path, and CRAFT_WORKSPACE plus CRAFT_PUBLISH_STATE_GITHUB_REPO are removed.. or ./ to /github/workspace/__repo__, strips ./ from relative paths, otherwise appends the supplied path, strips a trailing slash, computes a 12-character SHA-1 cwd hash, and writes .craft-state/craft/publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${version_sanitised}.json. Workspace encoding, base64 version encoding, and the craft-state step output are removed.src/modules/details-from-context.js replaces the generated Peggy parser and separate repository/version/path validators with PUBLISH_TITLE_REGEX = /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/ and exported parsePublishTitle(title), which returns regex groups or null.detailsFromContext() now throws Invalid publish issue title: ${context.payload.issue.title} without quoted interpolation when title parsing fails; it computes path as "." + (titleMatch.path || "").detailsFromContext() replaces getReleaseRevisionDetails() with body parsing via /^Merge target: (?<merge_target>[\w.\-/]+)$/m; missing merge targets produce merge_target: "", and the old special handling of "(default)" is removed.src/modules/update-issue.js changes updateTargets() to accept { octokit, version, publishRepo, issue_number } and read ${process.env.GITHUB_WORKSPACE}/__repo__/.craft-publish-${version}.json; it returns early if that file does not exist.updateIssue({ context, octokit, inputs }) now invokes updateTargets() only when inputs?.version exists. Use of process.env.CRAFT_STATE_FILE_PATH is removed from both src/modules/update-issue.js and the publish failure-update step.