Distillation

Date: Sep 8, 2026

• 🔴 (20:08) User supplied Jujutsu (jj) workflow guidance: when .jj/ exists, use jj rather than Git for mutations; never use interactive flags; always use -m "msg" for descriptions/commits; verify squash, abandon, rebase, restore, and commit mutations with jj st and jj log; prefer stable change IDs over rewritten hex commit IDs; do not rebase or describe immutable commits; use jj undo or jj op restore <op-id> for recovery.
• 🔴 (20:08) User stated that in Jujutsu, conflicts are first-class commit state and jj never fails on conflict; after rebase, new, or squash, inspect jj st, resolve conflict markers manually, and do not use interactive jj resolve.
• 🟡 (20:08) Current repository directory /home/byk/Code/getsentry/publish contains .git/, .github/, .gitignore, .lore.md, AGENTS.md, auto-approve-repos.txt, docs/, LICENSE, node_modules/, package.json, README.md, src/, vitest.config.js, and yarn.lock.
• 🟡 (20:08) Current worktree has modified files .github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/publish.yml, AGENTS.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js.
• 🟡 (20:08) Current untracked worktree paths are .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js.
• 🟡 (20:08) Worktree diff stat for 16 tracked files is 419 insertions and 62 deletions; largest listed changes are .github/workflows/ci-poller.yml (+142), .github/workflows/publish.yml (+124), .github/workflows/auto-approve.yml (+18), src/modules/update-issue.js (+42), and src/publish/update-issue.js (+33).
• 🟡 (20:08) Recent repository commits include 83d210b build(deps): bump js-yaml from 4.3.0 to 4.3.1 (#9174), 5268a23 feat: Add Vercel creds, 92eba3f feat: Add CLOUDFLARE_API_TOKEN (#9122), ada6147 build(deps): bump js-yaml from 4.1.1 to 4.3.0 (#8731), a4f961a fix: Add GITHUB_API_TOKEN for commit-on-git target (#9069), bf10f82 build(deps): bump postcss from 8.5.15 to 8.5.23 (#9017), 837edc0 docs: fix possessive apostrophe placement (#9015), 4da4a25 chore: replace deprecated trimRight() with trimEnd() (#9012), 22fd64d docs: fix typo 'acces' -> 'access' (#9011), and 24b9ce3 docs: fix missing article in rfc.md (#9014).
• 🔴 (20:08) User stated that deprecated trimRight() was replaced with trimEnd() in change #9012.
• 🟡 (20:08) .github/workflows/ contains auto-approve.yml, ci-poller.yml, cocoapods-keepalive.yml, publish.yml, and test.yml; .github/ also contains CODEOWNERS.
• 🟡 (20:08) auto-approve.yml runs on newly opened issues, with contents: read and issues: write; its auto-approve job runs only for sentry-release-bot[bot] or getsantry[bot] when the issue title starts publish: .
• 🟡 (20:08) auto-approve.yml checks out only auto-approve-repos.txt, creates a token via actions/create-github-app-token@v3 using vars.SENTRY_INTERNAL_APP_ID and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY, records an automated approval attestation through node src/publish/record-auto-approval-attestation.js, posts it as an issue comment using github.token, and only then adds the accepted label if the parsed repository is exactly listed in auto-approve-repos.txt.
• 🟡 (20:08) ci-poller.yml runs every 5 minutes ("*/5 * * * *") and via workflow_dispatch with optional attempt input defaulting to "0"; it has contents: read and issues: write permissions, uses environment: production, and serializes jobs with concurrency group ci-status-poller and cancel-in-progress: false.
• 🔴 (20:08) User directed that workflow_dispatch must always be allowed for manual recovery; ci-poller.yml gates the job with vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'.
• 🔴 (20:08) User directed that trusted code must always run; for workflow_dispatch, ci-poller.yml checks out actions/checkout@v6 at ${{ github.event.repository.default_branch }} with persist-credentials: false, rather than the manually dispatched ref.
• 🟡 (20:08) ci-poller.yml creates steps.token through actions/create-github-app-token@v3 using SENTRY_INTERNAL_APP_ID/SENTRY_INTERNAL_APP_PRIVATE_KEY for publish-repository label changes, and steps.release-token using SENTRY_RELEASE_BOT_CLIENT_ID/SENTRY_RELEASE_BOT_PRIVATE_KEY, owner: getsentry, for cross-repository check-suite, status, and check-run API access.
• 🟡 (20:08) CI poller lists up to 200 open issues that have both ci-pending and accepted labels. Before CI inspection, it binds to the live accepted label event using src/publish/current-accepted-event.js; it validates the approval attestation using src/publish/validate-approval-attestation.js with attestation author github-actions[bot], live issue title, expected accepted actor, and expected accepted event ID. Invalid or unverifiable approval removes both ci-pending and accepted and posts a retry comment.
• 🔴 (20:08) User directed that a release must never move to ci-ready after it changes; ci-poller.yml revalidates the request-bound approval after CI passes, records CI-ready proof through src/publish/record-ci-ready-attestation.js, posts that proof, then performs a final live validation immediately before replacing ci-pending with ci-ready.
• 🟡 (20:08) CI poller parses issue titles with parsePublishTitle from ./src/modules/details-from-context.js, obtains the repository/version, extracts a 40-character commit SHA from the issue body’s /commit/{SHA}/checks URL, resolves the release branch from check suites and its current head SHA using the release-bot token, and updates the issue body’s check-runs link if the branch has moved.
• 🟡 (20:08) CI readiness criteria: at least one check run or commit status exists; commit status is success or there are zero statuses; all check runs are completed; and no completed check run has a conclusion other than success, neutral, or skipped. Failed check runs or failed/error commit statuses replace ci-pending with ci-failed, remove accepted, and post blocking details plus a check-runs link.
• 🟡 (20:08) CI poller cleanup always checks for remaining open issues with both ci-pending and accepted; using a separate CI_POLLER_APP_CLIENT_ID/CI_POLLER_APP_PRIVATE_KEY token, it sets CI_POLLER_HAS_PENDING to "false" when none remain and "true" otherwise.
• 🟡 (20:08) When pending issues remain, CI poller self-dispatches ci-poller.yml using steps.token.outputs.token, incrementing github.event.inputs.attempt || '0'; it caps self-dispatch at 60 attempts (about 30 minutes), then relies on cron fallback. The stated rationale is GitHub cron may drift to 30–40 minutes under load, while self-dispatch provides approximately 30–60-second checks and concurrency allows one running plus one queued job.