Distillation

Date: Aug 28, 2026

• 🔴 (10:10) User stated that new Craft-created publish requests always include the checkout repository identity.
• 🟡 (10:10) docs/publish-issue-format.md defines publish-title formats: legacy publish: getsentry/<repository><optional-path>@<version> and workspace publish: getsentry/<repository><optional-path> [workspace: <json-string>] @<version>. Existing-issue parsing permits optional getsentry/; legacy form has no space before @, while workspace form has one space between ] and @.
• 🟡 (10:10) Publish-title validation documented in docs/publish-issue-format.md: repository permits ASCII letters, digits, ., _, -; optional path begins /, permits letters, digits, _, ., /, -, and cannot contain a .. segment; version permits letters, digits, _, ., +, -; workspace is one double-quoted valid JSON string decoding to a nonempty value without Unicode Cc, Cf, Zl, or Zp characters.
• 🟡 (10:10) docs/publish-issue-format.md documents body fields Requested by: @<actor>, optional Merge target: <branch-or-(default)>, Quick links for changes and check runs, approval via accepted label, and ### Targets checkboxes. Checked target IDs are skipped; Craft preserves checked entries on refresh, controller updates them from secure Craft publish-state after failed releases, and manually unchecking retries a target. dry-run label enables dry-run mode.
• 🟡 (10:10) package.json identifies private package publish version 0.0.1, “Approval-based publishing system for Sentry,” repository git@github.com:getsentry/publish.git, Apache-2.0 licensed, authored by Sentry Open Source <oss@sentry.io>; Volta pins Node 24.0.0 and Yarn 1.22.22; resolution undici: ^6.23.0.
• 🟡 (10:10) package.json scripts are test: vitest run, test:watch: vitest, lint: eslint src .github --ignore-pattern '!.github', and prettier: prettier --write src; dependencies are @actions/core ^2.0.0, @actions/github ^7.0.0, @sentry/node ^10.0.0; dev dependencies include eslint ^8.9.0, eslint-config-prettier ^8.3.0, eslint-plugin-yml ^0.13.0, peggy 5.1.0, prettier ^2.2.1, and vitest ^4.1.0.
• 🟡 (10:11) Search results showed .github/workflows/publish.yml derives a workspace-specific Craft state filename by base64url-encoding CRAFT_PUBLISH_WORKSPACE (base64 -w 0, +// translated to -/_, padding removed), prefixes it workspace-, and writes publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${workspace_prefix}${version_sanitised}.json; comments specify state follows issue checkout identity rather than workspace identity.
• 🟡 (10:11) Search results showed src/modules/details-from-context.js uses titleParser /^publish: (?:getsentry\/)?(?<repo>[A-Za-z0-9_.-]+)(?<path>\/[\w./-]+)?(?: \[workspace: (?<workspace>"(?:[^"\\]|\\.)*")\] )?@(?<version>[\w.+-]+)$/, parses captured workspace JSON, rejects invalid JSON with Invalid publish workspace JSON in title: '<title>', and rejects empty or Cc/Cf/Zl/Zp workspace values.
• 🟡 (10:14) Commit 33de3f1df5bdb9a6a480e9217d566df7b5a48b8e (feat: accept workspace publish requests) was authored and committed by Burak Yigit Kaya <byk@sentry.io> on Aug 26, 2026 at 14:15:22 UTC. Its visible diff introduced Craft workspace state handling in .github/workflows/publish.yml, changed detailsFromContext test assertions from toEqual to toStrictEqual, and added workspace parsing/escaping, invalid-title separator, unsafe/empty workspace, and invalid-path test coverage.
• 🟡 (10:17) src/modules/__tests__/publish-workflow.js extracts the Set targets Bash script from .github/workflows/publish.yml, runs it with CRAFT_PUBLISH_PATH, CRAFT_PUBLISH_REPO, CRAFT_PUBLISH_TARGETS_JSON: '["github"]', CRAFT_PUBLISH_VERSION, CRAFT_PUBLISH_WORKSPACE, GITHUB_OUTPUT, and GITHUB_WORKSPACE, then verifies the generated state filename and JSON state.
• 🟡 (10:17) src/modules/__tests__/publish-workflow.js test uses Craft's legacy root state filename expects path ./repo sentry/version 21.3.1 to write .craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json with {"published":{"github":true}}; test matches Craft's workspace state filename for a monorepo release expects path ./cli/repo toolkit/workspace cli/version 1.2.3 to write .craft-state/craft/publish-state-getsentry-toolkit-21cf7beaeda4-workspace-Y2xp-1.2.3.json with the same state.
• 🟡 (10:22) .github/workflows/auto-approve.yml auto-approves only newly opened issues created by sentry-release-bot[bot] or getsantry[bot] whose title begins publish: . It checks out only auto-approve-repos.txt, obtains an app token via actions/create-github-app-token@v3 using vars.SENTRY_INTERNAL_APP_ID and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY, extracts REPO with sed -n 's/^publish: \(.*\)@.*/\1/p', and adds accepted when that exact string is in the allowlist.
• 🟡 (10:23) src/publish/post-workflow-details.js gets GitHub Actions context, creates an Octokit client with github.getOctokit(getGitHubToken()), and invokes postWorkflowDetails({context, octokit}).