Distillation

🔴 (01:01) User-provided repository state showed commit 83d210b29553ea6f4d97508821724a834c43856e on branch main. 🔴 (01:01) User-provided command output included SHA-256 value 3739058aece2ef53a61eef5a04030fc2e68a8b834a3cb45abe827643a7f6f2b3. 🔴 (01:01) User-provided shell output showed python is unavailable: /usr/bin/bash: line 1: python: command not found. 🔴 (01:01) User-provided worktree calculation reported worktree_sha256=0fa2f7e51d39b426214e2516fb41dae09d8527367f402bbde0ee40fad087c228 across exactly 51 files. 🔴 (01:01) User directive for .github/workflows/ci-poller.yml: “Always allow workflow_dispatch for manual recovery.” 🔴 (01:01) User directive for manual workflow dispatches: “Always run trusted code”; because workflow_dispatch can target any ref, execution must use trusted code rather than arbitrary target-ref code. 🔴 (01:01) User directive for CI state integrity: “Never move a release to ci-ready after it changes.” 🔴 (01:01) User stated that a renamed or re-approved issue must never reach ci-ready. 🔴 (01:01) User-provided .github/workflows/ci-poller.yml validation requires a repository_dispatch attempt to be an integer from 0 through 59. 🔴 (01:01) User-provided .github/workflows/ci-poller.yml changes include removing labels such as ci-pending and accepted, posting issue comments, and dispatching ci-poller through gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input -. 🔴 (01:01) User-provided .github/workflows/auto-approve.yml is 53 lines and defines auto-approve non-sdks, triggered when issues are opened. 🔴 (01:01) User-provided .github/workflows/auto-approve.yml grants contents: read and issues: write; job auto-approve runs on ubuntu-latest in the production environment. 🔴 (01:01) User-provided .github/workflows/auto-approve.yml restricts execution to actor sentry-release-bot[bot] or getsantry[bot] and issue titles beginning with publish: . 🔴 (01:01) User-provided .github/workflows/auto-approve.yml pins actions/checkout to 11d5960a326750d5838078e36cf38b85af677262 and sets persist-credentials: false. 🔴 (01:01) User-provided .github/workflows/auto-approve.yml pins actions/create-github-app-token to bcd2ba49218906704ab6c1aa796996da409d3eb1, using vars.SENTRY_INTERNAL_APP_ID and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY. 🔴 (01:01) User-provided .github/workflows/auto-approve.yml records an automated approval attestation by running node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and AUTO_APPROVER. 🔴 (01:01) User-provided .github/workflows/auto-approve.yml posts ${{ steps.attestation.outputs.auto_approval_attestation }} as an issue comment only when steps.attestation.outcome == 'success'. 🔴 (01:01) User-provided .github/workflows/auto-approve.yml parses the repository from an issue title using sed -n 's/^publish: \(.*\)@.*/\1/p'; if the parsed repository exactly matches a line in auto-approve-repos.txt via grep -qxF, it adds the accepted label using gh issue edit "$ISSUE_URL" --add-label accepted. 🔴 (01:01) User-provided workflow changes replace mutable action tags with commit-pinned actions, including actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38.