Distillation

Date: Sep 8, 2026

• 🟡 (20:24) Current worktree has modified files: .github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js; untracked files/directories: .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js.
• 🟡 (20:24) Reported diff stat for tracked changes: 17 files changed, 446 insertions, 77 deletions.
• 🟡 (20:24) Recent commits shown: 83d210b build(deps): bump js-yaml from 4.3.0 to 4.3.1 (#9174); 5268a23 feat: Add Vercel creds; 92eba3f feat: Add CLOUDFLARE_API_TOKEN (#9122); ada6147 build(deps): bump js-yaml from 4.1.1 to 4.3.0 (#8731); a4f961a fix: Add GITHUB_API_TOKEN for commit-on-git target (#9069); bf10f82 build(deps): bump postcss from 8.5.15 to 8.5.23 (#9017); 837edc0 docs: fix possessive apostrophe placement (#9015); 4da4a25 chore: replace deprecated trimRight() with trimEnd() (#9012); 22fd64d docs: fix typo 'acces' -> 'access' (#9011); 24b9ce3 docs: fix missing article in rfc.md (#9014).
• 🔴 (20:24) User stated deprecated trimRight() was replaced with trimEnd() in commit 4da4a25 / PR #9012.
• 🟡 (20:25) Repository workflows enumerated: .github/workflows/publish.yml, .github/workflows/ci-poller.yml, .github/workflows/auto-approve.yml, .github/workflows/test.yml, and .github/workflows/cocoapods-keepalive.yml.
• 🟡 (20:25) .github/workflows/auto-approve.yml triggers on newly opened issues and runs only when github.actor is sentry-release-bot[bot] or getsantry[bot] and the issue title begins publish: . It uses SHA-pinned actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with sparse checkout of auto-approve-repos.txt, then SHA-pinned actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 using SENTRY_INTERNAL_APP_ID and SENTRY_INTERNAL_APP_PRIVATE_KEY.
• 🟡 (20:25) .github/workflows/auto-approve.yml records an automated approval attestation via node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN=${{ github.token }}, issue number/repository/title, and AUTO_APPROVER=${{ github.actor }}; on success it posts steps.attestation.outputs.auto_approval_attestation as an issue comment, then uses the Internal App token to add accepted only if the parsed publish: REPO@... repository exactly matches a line in auto-approve-repos.txt.
• 🔴 (20:25) User specified that workflow_dispatch must always be allowed for manual recovery.
• 🔴 (20:25) User specified that workflow-dispatch runs must always run trusted code, because workflow_dispatch can target any ref.
• 🔴 (20:25) User specified that a release must never be moved to ci-ready after it changes.
• 🔴 (20:25) User specified that a renamed or re-approved issue never reaches ci-ready.
• 🟡 (20:25) .github/workflows/publish.yml triggers on issues labeled events; concurrency is grouped by github.event.issue.title with cancel-in-progress: false; permissions are contents: read, issues: write, and packages: write.
• 🟡 (20:25) In .github/workflows/publish.yml, waiting-for-ci runs in production only for open publish: issues when the added label is accepted. It checks out publish code before obtaining credentials, with SHA-pinned actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 and persist-credentials: false.
• 🟡 (20:25) .github/workflows/publish.yml waiting-for-ci obtains an Internal App token using SHA-pinned actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1, then best-effort obtains a Release Bot token scoped to owner getsentry. node src/publish/authorize-approval.js receives release-token credentials plus the actor and issue number/repository/title; authorization must succeed and output authorized == 'true'.
• 🟡 (20:25) .github/workflows/publish.yml posts steps.authorization.outputs.approval_attestation as github-actions[bot], then runs node src/publish/validate-approval-attestation.js. If authorization, attestation creation, or attestation validation fails, it removes accepted, comments “Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue.”, and exits 1.
• 🟡 (20:25) .github/workflows/publish.yml resets accepted issues to CI-pending by removing ci-failed and ci-ready and adding ci-pending, using the Internal App token. It comments either “Retrying — CI was previously failed. Checking CI status now.” or “Approved. Checking CI status on the release branch. Publishing will start automatically when CI passes.”
• 🟡 (20:25) .github/workflows/publish.yml enables CI_POLLER_HAS_PENDING=true best-effort using a dedicated poller App token (CI_POLLER_APP_CLIENT_ID / CI_POLLER_APP_PRIVATE_KEY), then immediately triggers ci-poller.yml using the Internal App token because GITHUB_TOKEN workflow_dispatch events are suppressed.
• 🟡 (20:25) .github/workflows/publish.yml publish job runs in production with timeout-minutes: 90 only for open issues on a ci-ready label event where labels include accepted and ci-ready, and exclude ci-pending and ci-failed.
• 🟡 (20:25) .github/workflows/publish.yml checks out trusted publish code to .__publish__ with SHA-pinned actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 and persist-credentials: false, validates the approval attestation with REQUIRE_CI_READY_ATTESTATION: "true" via node .__publish__/src/publish/validate-approval-attestation.js, and removes accepted, comments the invalid-approval message, and exits if validation fails.
• 🟡 (20:25) .github/workflows/publish.yml uses SHA-pinned actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with Node 24, caches Yarn using .__publish__/yarn.lock, installs with yarn install --cwd ".__publish__", and parses inputs with node .__publish__/src/publish/inputs.js.
• 🟡 (20:25) .github/workflows/publish.yml can take the target repository Craft configuration from protected non-default branches for: sentry-migr8/tmp-merge-target; sentry-javascript/v10, v9, v8, v7, or master; sentry-python/alpha; and sentry-wizard/1.x.
• 🟡 (20:25) .github/workflows/publish.yml obtains the Release Bot App token for owner getsentry, then checks out target repository getsentry/${{ fromJSON(steps.inputs.outputs.result).repo }} to __repo__ at the selected target branch with fetch-depth: 0.
• 🟡 (20:25) .github/workflows/publish.yml constructs Craft’s already-published state at $GITHUB_WORKSPACE/.craft-state/craft/publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${version_sanitised}.json, outside __repo__/, using a 12-character SHA-1 prefix of Craft’s canonical container cwd and a sanitized owner/repository/version; the state payload is {"published": ...} derived from CRAFT_PUBLISH_TARGETS_JSON.
• 🟡 (20:25) .github/workflows/publish.yml revalidates the approval attestation immediately before Craft with REQUIRE_CI_READY_ATTESTATION: "true"; if invalid, it removes accepted, comments the invalid-approval message, and exits 1.
• 🟡 (20:25) .github/workflows/publish.yml publishes through digest-pinned docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b, executing craft publish ${{ fromJSON(steps.inputs.outputs.result).version }} from __repo__/${{ fromJSON(steps.inputs.outputs.result).path }} with XDG_STATE_HOME=/github/workspace/.craft-state.
• 🟡 (20:25) On Craft cancellation or failure, .github/workflows/publish.yml runs node .__publish__/src/publish/update-issue.js; on cancellation it runs node .__publish__/src/publish/post-result.js cancelled; on failure it runs node .__publish__/src/publish/post-result.js failure; on success it runs node .__publish__/src/publish/post-result.js success.
• 🟡 (20:25) .github/workflows/test.yml runs on pushes to main and pull requests; its unit-test job uses SHA-pinned actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with Node 24, and actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830; it caches node_modules, conditionally runs yarn install --frozen-lockfile, then runs yarn test.
• 🟡 (20:25) .github/workflows/cocoapods-keepalive.yml runs daily at 00:00 UTC and manually via workflow_dispatch; it runs in production on macos-15, provides COCOAPODS_TRUNK_TOKEN, executes gem install cocoapods, pod --version, and pod trunk me > /dev/null 2>&1 to refresh the CocoaPods session, whose stated inactivity validity is 3 days.
• 🟡 (20:25) Publish test files enumerated: src/publish/__tests__/workflow-action-pinning.js, src/publish/__tests__/record-auto-approval-attestation.js, src/publish/__tests__/publish-workflow.js, src/publish/__tests__/auto-approval-workflow.js, src/publish/__tests__/ci-poller-workflow.js, src/publish/__tests__/current-accepted-event.js, src/publish/__tests__/record-ci-ready-attestation.js, src/publish/__tests__/validate-approval-attestation.js, and src/publish/__tests__/authorize-approval.js.