Distillation

Date: Aug 29, 2026

• 🔴 [requested-review] (12:48) User requested a rigorous, read-only final adversarial review of uncommitted compact workspace publish-contract changes in both worktrees: /home/byk/Code/getsentry/craft-workspace-action-propagation on branch feat/workspace-action-propagation, and /home/byk/Code/getsentry/publish-workspace-acceptance on branch feat/workspace-acceptance. User required comparison against each branch base and prohibited editing, staging, committing, resetting, or destructive commands.
• 🔴 (12:48) User stated Publish always uses getsentry/craft:latest; this is intentional because Craft must release first so latest contains workspace list and craft publish --rev, and it must not be reported as a mutable-image concern.
• 🔴 (12:48) User stated new Craft-created publish requests always include checkout repository identity.
• 🔴 (12:48) User stated workspace names preserve exact spelling and are never normalized.
• 🔴 (12:48) User stated new compact workspace releases use one trailing ASCII-safe segment, and Craft rejects a workspace combined with a non-root path before side effects.
• 🔴 (12:48) User stated legacy JSON-qualified workspace titles remain supported but must reject a workspace combined with a non-root path.
• 🔴 (12:48) User stated pnpm-lock.yaml in Publish is unrelated and must never be committed.
• 🟡 (12:48) User requested exact file:line evidence assessing: (1) safe extraction and repository binding of the exact CI-approved revision link; (2) use of that exact revision and resolved location for checkout, compact classification, state path/CWD, workspace environment, and craft publish --rev; (3) safe detached CI-SHA checkout while retaining named-ref behavior; (4) legacy-title retention, post-checkout compact workspace-first classification, limited discovery, root .craft.yml absence as path behavior, and fail-closed discovery errors when root config exists; (5) elimination of workspace/path ambiguity, name normalization, injection, and traversal; (6) workflow YAML, Actions expressions, shell quoting, and state-filename parity; (7) deterministic Peggy grammar/generated parser plus generated-parser drift detection in tests/CI; and (8) meaningful tests that fail on broken paths and identification of intended committed files.
• 🟡 (12:48) User requested an evidence-based review with findings ordered CRITICAL/MAJOR/MINOR, practical fixes, explicit identification of intentional behavior, and a final MERGE or DO-NOT-MERGE; if no findings, list residual release/rollout risks.
• 🟡 (12:51) Craft worktree /home/byk/Code/getsentry/craft-workspace-action-propagation directory listing contains 33 entries: .craft.yml, .dockerignore, .eslintcache, .git, .github/, .gitignore, .lore.md, .nojekyll, .npmignore, .prettierignore, .prettierrc.yml, .tsbuildinfo, .vscode/, action.yml, AGENTS.md, blog-post-draft.md, build.mjs, CHANGELOG.md, CONTRIBUTING.md, dist/, Dockerfile, docs/, eslint.config.mjs, img/, LICENSE, node_modules/, package.json, pnpm-lock.yaml, README.md, src/, tsconfig.build.json, tsconfig.json, and vitest.config.mts.
• 🟡 (12:52) Publish worktree /home/byk/Code/getsentry/publish-workspace-acceptance directory listing contains 16 entries: .eslintrc.js, .git, .github/, .gitignore, AGENTS.md, auto-approve-repos.txt, docs/, LICENSE, node_modules/, package.json, pnpm-lock.yaml, README.md, scripts/, src/, vitest.config.js, and yarn.lock.
• 🔴 (12:53) User's Craft codebase package-management convention: always use pnpm; never use npm or yarn.
• 🟡 (12:53) Craft AGENTS.md specifies Node.js is managed by Volta at v22.12.0; dependencies are installed with pnpm install --frozen-lockfile; pnpm build outputs dist/craft; pnpm test runs tests; pnpm lint runs ESLint; pnpm fix auto-fixes lint; manual testing is pnpm build && ./dist/craft.
• 🟡 (12:53) Craft codebase uses TypeScript, Prettier 3.x with single quotes and no arrow parentheses via .prettierrc.yml, and ESLint 9.x flat configuration in eslint.config.mjs using typescript-eslint; unused variables prefixed with _ are allowed.
• 🟡 (12:53) Craft tests use Vitest; test files are in src/__tests__/ with *.test.ts names; mocking uses vi.fn(), vi.mock(), and vi.spyOn().
• 🟡 (12:53) Craft CI runs tests on Node.js 20 and 22; the main branch is master; Craft releases itself using its own tooling.
• 🟡 (12:53) Craft root configuration is .craft.yml; its configuration schema is in src/schemas/.
• 🟡 (12:53) Craft dry-run mode prevents destructive operations through centralized proxies: Git uses getGitClient() from src/utils/git.ts or createGitClient(directory); GitHub uses getGitHubClient() from src/utils/githubApi.ts; file writes use safeFs from src/utils/dryRun.ts; other actions use safeExec() or safeExecSync() from src/utils/dryRun.ts. ESLint blocks direct simple-git imports and new Octokit(); wrapper modules may use // eslint-disable-next-line no-restricted-imports -- This is the wrapper module before importing simple-git.