Distillation

Date: Aug 27, 2026

• 🟡 (15:55) Background correctness review ses_fbc205116ffesmEG8SWfAbIqaj completed with DO-NOT-MERGE findings. Critical: .github/workflows/publish.yml:64 and .github/workflows/ci-poller.yml:92 authorize against the issue-title snapshot at the accepted label event but the poller later reads the current title; an approver can approve repo A, change the title to repo B, and cause repo B to release without authorization for repo B.
• 🟡 (15:55) Correctness review MUST-FIX High: .github/workflows/publish.yml:63 and .github/workflows/auto-approve.yml:28 use the internal-app token to add accepted; therefore the labeled-event actor is the app rather than getsantry[bot], causing the gate either to reject valid allowlisted bot approvals or authorize according to the internal app’s target-repository role.
• 🟡 (15:55) Correctness review MUST-FIX High: src/modules/approval-authorizer.js:21-31 lets non-allowlisted getsantry[bot] fall through to permission lookup and authorize if GitHub reports write, maintain, or admin; bot approvals must instead be rejected unless their release path exactly matches the allowlist.
• 🟡 (15:55) Correctness review MUST-FIX High: authorization grammar in src/modules/approval-authorizer.js:4 diverges from Publish grammar in src/modules/details-from-context.js:25; e.g., allowlisted publish: getsentry/relay/py@bad version can authorize but Publish then throws. The review requires authorization to share Publish’s title grammar and fail closed for unsupported titles.
• 🟡 (15:55) Correctness review MUST-FIX Medium: .github/workflows/publish.yml:35-45,67 can have checkout or internal-app-token failures before its sole rejection/label-removal step; GitHub skips that step after an earlier failure, leaving accepted attached and violating cleanup requirements for failed checks.
• 🟡 (15:55) Correctness review concern: src/modules/__tests__/approval-authorizer.js:26-45 tests non-allowlisted getsantry[bot] only with role_name: "none" and misses the write-role bypass, parser divergence, post-approval title mutation, the auto-approve app-label actor, and pre-authorization cleanup failures.
• 🟡 (15:55) Correctness review PASS: permission API failures after authorization starts fail closed and route to accepted label removal through src/publish/authorize-approval.js:29-35 and .github/workflows/publish.yml:58-80.
• 🟡 (15:55) Correctness review validation: yarn test passed with 33 tests; yarn lint failed only on unchanged .github/workflows/cocoapods-keepalive.yml:1.
• 🟡 (15:55) Assistant stated it would reconcile the five correctness-review must-fix paths with the still-running security review, then repair the approval gate and add adversarial regression tests.