Dashboard › publish › Distillation
6737bdff-b36c-486a-8da2-0d1aafacc373["lore_tm_v1_j2S2go19nHkLt7iGFtwm9J6XMejew4dnqwGDaNgstGU","lore_tm_v1_qYgr2z3udyHD8-V1hUgtUeEdpUnyMn8WYFKDJaGa1sA","lore_tm_v1_vxgkIbh_vsuhDBpp20VXea6jA8oUPUwOJFFgdpmWtUU","lore_tm_v1_6qloJ2XttRut7bGoJIddsqQnRFKnP02sdNwVc7apNqc","lore_tm_v1_S0xtpWVgaUoynVcJZF8q4C9WI2k42jM0VX5DOd1YvvU","lore_tm_v1_DMf_PQkAjFD1yXYrkfZ95F0QPi-CMRrE1mOsz5iuIRM","lore_tm_v1_amYAfQ8uvC0Ai6RctJtvhYHmICg4SpJkhKI_aGcfTrA","lore_tm_v1_awtq4UZKGl7CDlFYfdPOVYODcOFr5ej4HIocnrhGfy4"]
b2b489b4e6427c0dece46fd79a25de419ecdc868, 17d5e91f956f3b5d8018d11d1a5f07499941b02d, 781bd0850f4ea15ae89417acabdd353fc98b6bd0, 9ff9a9d55b07734dcbb33e7d3f4fa69178edb39c, 096024af8c999595952a6f029cdb06794be23e11, d64534399a1a23a4d5578e2fc1c7d6f98c17c0f7, 69f70a434528fa2adf1333d5045ad6b473304118, baa0ef86bfc0d7fc0db974197cc7a227833eb271, and 5c0baa5457a54f9c444de3cd1bf1b473c065f9b7; it also showed checksum 58b43354ebad6c25f3a689f9e6672a60632c9461d537dd9229c85a03bfc44ef4 -..github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, docs/key_rotation_vault_changes.md, docs/rfc.md, package.json, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, src/publish/update-issue.js, and yarn.lock.docs/publish-issue-format.md, scripts/generate-publish-issue-title-parser.js, src/modules/__tests__/ci-poller-input.js, src/modules/__tests__/ci-poller-workflow.js, src/modules/__tests__/generate-publish-issue-title-parser.js, src/modules/__tests__/publish-location.js, src/modules/__tests__/publish-workflow.js, src/modules/__tests__/release-revision.js, src/modules/ci-poller-input.js, src/modules/publish-issue-title.js, src/modules/publish-issue-title.peggy, src/modules/publish-issue-validation.js, src/modules/publish-location.js, src/modules/release-revision.js, src/publish/__tests__/discover-location.js, src/publish/__tests__/resolve-location.js, src/publish/__tests__/resolve-release-revision.js, src/publish/discover-location.js, src/publish/resolve-ci-poller-input.js, src/publish/resolve-location.js, and src/publish/resolve-release-revision.js..github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, the src/publish/__tests__/ tree, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js./home/byk/Code/getsentry/publish/src/publish/authorize-approval.js is 241 lines and imports createApprovalAttestation, currentAcceptedEvent, and hasAutoApprovalAttestation from ../modules/approval-attestation.js, plus AUTO_APPROVAL_LABELER, AUTO_APPROVERS, authorizeApproval, and isAutoApprovedRepository from ../modules/approval-authorizer.js.getAutoApprovedRepositories() in src/publish/authorize-approval.js reads auto-approve-repos.txt as UTF-8, splits on /\r?\n/, removes empty lines, and returns a Set.getGitHubResponse(path) calls https://api.github.com/${path} with Accept: application/vnd.github+json, bearer token process.env.APPROVAL_TOKEN, and X-GitHub-Api-Version: 2026-03-10.getPermission({ owner, repository, username }) queries repos/{owner}/{repository}/collaborators/{username}/permission; getIssue() queries repos/{repository}/issues/{issueNumber}. Both throw errors containing the returned HTTP status when the response is not OK.getIssueEvents() and getIssueComments() paginate their respective GitHub issue endpoints with per_page=100&page=${page}, append each page, and stop when a page contains fewer than 100 records.main() in src/publish/authorize-approval.js requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY; missing values throw explicit errors.actor === AUTO_APPROVAL_LABELER, authorization requires all of: the live issue is open; its title equals APPROVAL_ISSUE_TITLE; the requester is a string and belongs to AUTO_APPROVERS; isAutoApprovedRepository() accepts the requester, title, and auto-approve-repos.txt set; the current accepted event actor equals the labeler; and hasAutoApprovalAttestation() verifies a comment authored by github-actions[bot].src/publish/authorize-approval.js delegates to authorizeApproval({ actor, issueTitle, getPermission, autoApprovedRepositories }).src/publish/authorize-approval.js rejects authorization unless the live issue remains open, its title still matches, its requester is a string, a non-auto-labeler actor is not also the requester (case-insensitive), a current accepted event exists, and that event’s actor equals the approval actor.createApprovalAttestation({ actor: event.actor, eventId: event.eventId, issue }) and appends authorized=true plus approval_attestation=${attestation} to GITHUB_OUTPUT; rejected authorization appends authorized=false.src/publish/authorize-approval.js runs main() only when invoked directly, logs caught errors, sets process.exitCode = 1, and exports getAutoApprovedRepositories, getGitHubResponse, getIssue, getIssueComments, getIssueEvents, getPermission, and main.No files found; the search criteria were not shown..github/workflows/auto-approve.yml defines workflow auto-approve non-sdks, triggered only for newly opened issues, with contents: read and issues: write; its job runs on ubuntu-latest in the production environment.github.actor is sentry-release-bot[bot] or getsantry[bot] and the issue title starts with publish: ..github/workflows/auto-approve.yml checks out only auto-approve-repos.txt using actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with sparse-checkout-cone-mode: false, then obtains an app token using actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1, vars.SENTRY_INTERNAL_APP_ID, and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY.node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and AUTO_APPROVER; on success it posts ${{ steps.attestation.outputs.auto_approval_attestation }} as an issue comment using github.token..github/workflows/auto-approve.yml extracts the repository from the issue title with sed -n 's/^publish: \(.*\)@.*/\1/p' and adds the accepted label only if the extracted repository exactly matches a line in auto-approve-repos.txt.main behind origin/main by exactly 1 commit, with the modified and untracked worktree files listed above.origin/main, with no file edits..github/workflows/ci-poller.yml is 463 lines and defines CI Status Poller, triggered by cron */5 * * * *, repository_dispatch type ci-poller, and completed workflow_run events from workflow Run CI Status Poller.check-ci job runs on ubuntu-latest in the production environment with contents: read and issues: write, and runs only when vars.CI_POLLER_HAS_PENDING == 'true', the event is repository_dispatch, or a successful workflow_run came from the repository default branch.ci-status-poller with cancel-in-progress: false.^(0|[1-5][0-9])$, i.e. an integer from 0 through 59; invalid attempts emit an error and exit 1.${{ github.event.repository.default_branch }} with actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 and persist-credentials: false.actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1: a sentry-internal-app token from vars.SENTRY_INTERNAL_APP_ID/secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY for label changes, and a release-bot token from vars.SENTRY_RELEASE_BOT_CLIENT_ID/secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY with owner: getsentry for cross-repository check-suite, status, and check-run API access.sentry-xbox, sentry-playstation, sentry-switch, and service-registry.gh_api_release() shell helper runs gh api in a subshell with GH_TOKEN="$RELEASE_TOKEN", captures stderr/stdout, emits a GitHub warning on any nonzero exit including 404, returns the original exit code, and avoids leaking the token override to other calls.ci-pending and accepted, requesting number,title,labels,body; it exits successfully when the count is 0.src/publish/current-accepted-event.js, capturing .actor and .eventId.ci-pending and accepted, comments Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue., and skips that issue.src/publish/validate-approval-attestation.js with APPROVAL_ATTESTATION_AUTHOR="github-actions[bot]", the issue number/repository/title, and the expected accepted actor/event ID; failed validation removes ci-pending and accepted, posts the invalid-approval retry comment, and skips the issue.parsePublishTitle from src/modules/details-from-context.js; the repository is prefixed with getsentry/. Unparseable issue titles produce a warning and are skipped.https://github.com/{owner}/{repo}/commit/{SHA}/checks/ link using grep -oP '(?<=commit/)[0-9a-f]{40}(?=/checks)'; issues without such a SHA are skipped..check_suites[0].head_branch for the original issue SHA, then resolves repos/${repo}/git/ref/heads/${branch} to .object.sha; failures are nonfatal and fall back to the issue SHA.repos/${repo}/commits/${sha}/status; check runs are fetched with pagination from repos/${repo}/commits/${sha}/check-runs using per-page filter .check_runs[]. Either API failure skips the issue rather than deriving state from partial data..status != "completed" and unsuccessful checks as completed runs whose conclusion is not success, neutral, or skipped; unsuccessful conclusions therefore include failure, cancelled, timed_out, action_required, stale, and startup_failure.total_checks == 0 and total_statuses == 0.success or no commit statuses exist, all check runs are completed, and no check runs have an unsuccessful conclusion.ci-pending and accepted, posts the invalid-approval retry comment, and skips advancement.src/publish/record-ci-ready-attestation.js using a temporary GITHUB_OUTPUT; output must begin with ci_ready_attestation=. Failure or malformed proof removes ci-pending and accepted and posts the invalid-approval retry comment.${{ github.token }} rather than the label-changing app token; inability to post it removes ci-pending and accepted.ci-pending and accepted instead.ci-pending, adds ci-ready, and comments CI checks passed for ${repo}@${version}. Publishing is starting now.ci-pending and accepted, adds ci-failed, identifies failed check names, posts a blocked-publishing comment with the short SHA and check-runs link, and instructs the author to re-add accepted after fixing CI.failure, the poller removes ci-pending and accepted, adds ci-failed, lists status contexts in states failure or error with links where available, and instructs the author to re-add accepted.if: always(), checks for one remaining open issue with both ci-pending and accepted, obtains a poller app token from vars.CI_POLLER_APP_CLIENT_ID and secrets.CI_POLLER_APP_PRIVATE_KEY, and sets repository variable CI_POLLER_HAS_PENDING to exactly false when none remain or true otherwise.{"event_type":"ci-poller","client_payload":{"attempt":"..."}} to repos/$GITHUB_REPOSITORY/dispatches; comments document approximately 30–60 seconds between checks, a maximum chain of approximately 30 minutes, cron fallback, and concurrency limiting accumulation to 1 running plus 1 queued run.