Distillation

Date: Sep 8, 2026

• 🔴 (10:27) User reiterated release-workflow security requirements embedded in the ci-poller.yml changes: “Always run trusted code.” workflow_dispatch can target any ref, therefore the poller must check out ${{ github.event.repository.default_branch }} with persist-credentials: false.
• 🔴 (10:27) User reiterated the release-authorization invariant: “Never move a release to ci-ready after it changes.” Each CI poll cycle must bind to the current accepted-label event before inspecting CI.
• 🔴 (10:27) User asserted that a renamed or re-approved issue “never reaches ci-ready”; ci-poller.yml revalidates the approval after CI checks complete because checks can take hours.
• 🟡 (10:27) .github/workflows/auto-approve.yml:1-35 runs only on opened issues, with contents: read; auto-approve runs on ubuntu-latest only when github.actor is sentry-release-bot[bot] or getsantry[bot] and the title starts publish: . It uses actions/checkout@v4 with sparse checkout of auto-approve-repos.txt, creates an internal-app token via actions/create-github-app-token@v3, extracts REPO using sed -n 's/^publish: \(.*\)@.*/\1/p', and adds accepted with gh issue edit "$ISSUE_URL" --add-label accepted only for exact allowlist matches.
• 🟡 (10:27) src/publish/__tests__/authorize-approval.js:43-51 tests that getAutoApprovedRepositories() preserves exact allowlist paths, specifically getsentry/sentry-javascript and getsentry/objectstore/clients.
• 🟡 (10:27) src/publish/__tests__/authorize-approval.js:53-90 successful human authorization test uses actor contractor, title publish: getsentry/sentry-javascript@10.0.0, requester requester, current accepted event ID "100", and confirms the target permission endpoint is https://api.github.com/repos/getsentry/sentry-javascript/collaborators/contractor/permission with Authorization: Bearer release-bot-token; output must match authorized=true\napproval_attestation=<!-- publish-approval .+ -->\n.
• 🟡 (10:27) src/publish/__tests__/authorize-approval.js:92-119 verifies requester/approver separation: when requester login and approver actor are both contractor, authorization writes exactly authorized=false\n, even though contractor has write permission and added the current accepted label.
• 🟡 (10:27) src/publish/__tests__/authorize-approval.js:121-141 verifies closed failure when GitHub permission lookup returns HTTP 404: main() rejects with Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404, writes no output, and does not log an error.
• 🟡 (10:27) src/modules/__tests__/approval-authorizer.js:8-42 tests that getsantry[bot] is authorized for exact allowlisted getsentry/sentry-javascript without calling getPermission, but is rejected outside the allowlist even if a hypothetical target permission lookup would return write.
• 🟡 (10:27) src/modules/__tests__/approval-authorizer.js:44-103 tests that human contractor is authorized only for target-repository roles write, maintain, or admin; roles none, read, triage, Elevated Bot, and undefined are rejected. Permission lookup is scoped to { owner: "getsentry", repository: "sentry-javascript", username: "contractor" }.
• 🟡 (10:27) src/modules/__tests__/approval-authorizer.js:68-87 confirms legacy/unqualified title publish: sentry-javascript/packages/core@10.0.0 resolves to repository getsentry/sentry-javascript for authorization.
• 🟡 (10:27) src/modules/__tests__/approval-authorizer.js:105-143 verifies malformed titles publish: @1.0.0 and publish: getsentry/sentry-javascript return { authorized: false, repository: null } without GitHub lookup; GitHub lookup failures, such as Error("Not Found"), propagate.
• 🟡 (10:27) src/modules/details-from-context.js:18-23 centralizes publish-title parsing in exported PUBLISH_TITLE_REGEX and parsePublishTitle(title), where the regex accepts optional getsentry/, captures repo, optional path matching /[\w./-]+, and version matching [\w.+-]+; parsing returns named groups or null.
• 🟡 (10:27) src/modules/details-from-context.js:25-65 now fails explicitly with Invalid publish issue title: ${context.payload.issue.title} when title parsing returns null; otherwise it derives dry_run from a dry-run label, path as "." + (titleMatch.path || ""), merge_target from Merge target: <[\w.\-/]+>, and checked target IDs from the Targets section.
• 🟡 (10:27) .github/workflows/ci-poller.yml diff changes workflow permissions from issues: read to issues: write, then checks out trusted default-branch code using actions/checkout@v6, ${{ github.event.repository.default_branch }}, and persist-credentials: false before requesting app tokens.
• 🟡 (10:27) .github/workflows/ci-poller.yml diff replaces separate shell sed parsing of repository/version with parsePublishTitle from ./src/modules/details-from-context.js; it constructs repo as "getsentry/" + .repo and version as .version, preventing CI targeting from diverging from Publish title semantics.
• 🟡 (10:27) .github/workflows/ci-poller.yml diff binds accepted_actor and accepted_event_id via node src/publish/current-accepted-event.js; if binding fails, it removes ci-pending and accepted, comments Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue., and continues.
• 🟡 (10:27) .github/workflows/ci-poller.yml diff validates approval attestation three times for a bound accepted event—before CI inspection, after successful final CI status evaluation, and immediately after posting CI-ready proof—using node src/publish/validate-approval-attestation.js, APPROVAL_ATTESTATION_AUTHOR="github-actions[bot]", EXPECTED_ACCEPTED_ACTOR, and EXPECTED_ACCEPTED_EVENT_ID; any failure removes ci-pending and accepted, posts the invalid-approval comment, and continues.
• 🟡 (10:27) .github/workflows/ci-poller.yml diff records a CI-ready proof before adding ci-ready: node src/publish/record-ci-ready-attestation.js writes ci_ready_attestation=... to a mktemp output file; malformed/missing output or proof-generation failure removes ci-pending and accepted; valid proof is posted as an issue comment with GH_TOKEN="${{ github.token }}".
• 🟡 (10:27) .github/workflows/publish.yml diff adds a Get publish code step to waiting-for-ci using actions/checkout@v6 and persist-credentials: false, allowing subsequent authorization scripts to run from checked-out Publish code.
• 🟡 (10:27) .github/workflows/publish.yml diff adds best-effort Get release bot auth token using actions/create-github-app-token@v3, SENTRY_RELEASE_BOT_CLIENT_ID, SENTRY_RELEASE_BOT_PRIVATE_KEY, and owner: getsentry; it is used by Authorize approval to query the approver’s current effective target-repository role without exposing RBAC data.
• 🟡 (10:27) .github/workflows/publish.yml diff authorizes the accepted label actor using node src/publish/authorize-approval.js, then posts its approval attestation with gh issue comment under ${{ github.token }}, then validates it under github-actions[bot]. If authorization, attestation posting, or validation fails, Reject invalid approval removes accepted, posts Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue., and exits 1.
• 🟡 (10:27) .github/workflows/publish.yml diff adds publish-job validation of approval and CI-ready attestations before Node setup and release operations: node .__publish__/src/publish/validate-approval-attestation.js with REQUIRE_CI_READY_ATTESTATION: "true"; failure removes accepted, posts the invalid-approval comment, and exits 1.
• 🟡 (10:27) .github/workflows/publish.yml:327-381 Craft publishing uses docker://getsentry/craft:latest, runs craft publish ${{ fromJSON(steps.inputs.outputs.result).version }} from __repo__/${{ fromJSON(steps.inputs.outputs.result).path }}, pins XDG_STATE_HOME to /github/workspace/.craft-state outside __repo__/, and supplies release credentials through named environment variables without revealing their values.
• 🟡 (10:27) src/modules/__tests__/details-from-context.js adds coverage that parsePublishTitle("publish: getsentry/sentry-javascript/packages/core@10.0.0") returns { path: "/packages/core", repo: "sentry-javascript", version: "10.0.0" }, while legacy publish: sentry-javascript@10.0.0 returns { path: undefined, repo: "sentry-javascript", version: "10.0.0" }.
• 🟡 (10:27) src/modules/update-issue.js changes updateIssue() so updateTargets() executes only when inputs?.version exists, while octokit.rest.issues.removeLabel({ ...publishRepo, issue_number, name: "accepted" }) always executes. New test verifies undefined parsed inputs neither check Craft state nor fetch/update issue body, but remove accepted from issue "211" in getsentry/publish.
• 🟡 (10:27) src/publish/update-issue.js now defines async main(), parses PUBLISH_ARGS only if present, catches JSON parse errors to warn Could not parse publish inputs; skipping target update, awaits updateIssue({ context, octokit, inputs }), invokes main() only when run directly, sets process.exitCode = 1 on errors, and exports { main }.
• 🟡 (10:27) Nonfunctional formatting changes were made in AGENTS.md, src/libs/github.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, and src/publish/post-workflow-details.js; AGENTS.md additionally points long-term lore-managed project knowledge to .lore.md.
• 🟡 (10:27) src/modules/__tests__/approval-attestation.js:22-69 verifies the latest accepted event is selected by ID ("200" over "100"), and numeric GitHub issue-event ID 29503999078 normalizes to string "29503999078".
• 🟡 (10:27) src/modules/__tests__/approval-attestation.js:71-114 verifies a CI-ready attestation binds accepted actor/event contractor/"200" and expected CI-ready actor sentry-internal-app[bot]; it fails if either accepted event changes or the eventual ci-ready label actor differs.
• 🟡 (10:27) src/modules/__tests__/approval-attestation.js:116-173 verifies malformed/stale approval attestations are rejected, including wrong comment author, changed event ID/title, invalid base64 payload <!-- publish-approval not-base64 -->, and any change in dry-run label state after attestation.
• 🟡 (10:28) src/publish/__tests__/ci-poller-workflow.js:6-16 asserts .github/workflows/ci-poller.yml contains default-branch actions/checkout@v6 trusted-code checkout and that Get publish code occurs before Get auth token.
• 🟡 (10:28) src/publish/__tests__/current-accepted-event.js:5-38 verifies getCurrentAcceptedEvent() returns newest accepted event { actor: "contractor", eventId: "200" } and rejects absent valid accepted events with The issue has no current accepted label event.
• 🟡 (10:28) src/publish/__tests__/record-ci-ready-attestation.js:10-45 verifies recordCiReadyAttestation() binds the current accepted event contractor/"100" to authenticated CI-ready actor sentry-internal-app[bot], retaining the current issue digest and title publish: getsentry/sentry-javascript@10.0.0.
• 🟡 (10:28) src/publish/__tests__/record-ci-ready-attestation.js:47-91 verifies CI-ready attestation recording rejects a changed title or absent accepted event, and rejects a re-approval whose event ID "200" differs from poller-observed expected event "100", with The approval changed before CI could be marked ready.