Distillation

Date: Aug 27, 2026

• 🟡 (16:19) Background security review ses_fbc2027dbfferQZUN0ETLQ4agz completed DO-NOT-MERGE. Critical: authorization reads the immutable accepted-label event title but only persists authorized; it never binds that title or repository to later stages. .github/workflows/ci-poller.yml and Publish then consume the mutable current issue title, enabling authorization for repository A followed by retitling and publication of repository B. Affected: .github/workflows/publish.yml:62-65,90-98,174-176, .github/workflows/ci-poller.yml:80,90-100, src/publish/authorize-approval.js:46-53.
• 🔴 (16:19) User stated that authorization “never binds that title or repository to later stages.”
• 🟡 (16:19) Security review High: checkout or internal-app-token failures before authorization skip subsequent cleanup under GitHub Actions’ implicit success() condition; the rejection step also relies on the possibly failed app token, leaving accepted attached. Affected .github/workflows/publish.yml:35-45,67-80.
• 🟡 (16:19) Security review Medium: .github/workflows/auto-approve.yml permits both sentry-release-bot[bot] and getsantry[bot], but labels using the internal-app token; the later labeled event identifies the app rather than the originating bot. This either rejects legitimate allowlisted automation or authorizes from the app’s repository role instead of exact trusted provenance. Affected .github/workflows/auto-approve.yml:13,20-34, .github/workflows/publish.yml:62-65, src/modules/approval-authorizer.js:2,17-21.
• 🟡 (16:19) Security review Low concern: authorization title grammar is broader than the publish parser; use one shared exact parser to prevent approving titles publishing rejects and future parser-drift bypasses. Affected src/modules/approval-authorizer.js:3-4, src/modules/details-from-context.js:24-26.
• 🟡 (16:19) Security review PASS: target permission checks use GitHub effective repository role and permit only write, maintain, or admin; triage, read, unknown, and custom roles fail closed.
• 🟡 (16:19) Security review PASS: the bot exception uses exact allowlist membership including release paths and skips permission lookup only for exact actor getsantry[bot].
• 🟡 (16:19) Security review PASS: permission API failures throw; after authorization starts, the workflow detects failure and rejects. Owner, repository, and username URL segments are encoded; checkout does not log or persist the release token.
• 🟡 (16:19) Security review PASS: no repository RBAC configuration is exposed in this public repository; authorization makes a live GitHub API decision.
• 🟡 (16:19) Security review validation: yarn test passed with 33 tests. Existing tests do not cover workflow-level cleanup, provenance, or title-mutation paths.
• 🟡 (16:19) Assistant chose to harden approval with an internal-app attestation of the exact title, verify it immediately before publishing, identify auto-approval using immutable issue creator plus internal-app identity, and run cleanup after every pre-authorization failure.
• 🟢 (16:20) Task status: “Harden approval authorization workflow” is in progress (high priority); “Add adversarial authorization regressions” and “Run validation and final reviews” are pending (high priority).
• 🔴 (16:20) User stated that workflow_dispatch must always be allowed for manual recovery.
• 🟡 (16:20) .github/workflows/ci-poller.yml context: scheduled every 5 minutes (cron: "*/5 * * * *"), has check-ci, concurrency group ci-status-poller, checks only issues with both ci-pending and accepted, parses repo from current title via sed -n 's|^publish: \([^/]*/[^/@]*\).*@.*|\1|p', checks commit status and paginated check runs using a cross-repo sentry-release-bot token, adds ci-ready after CI passes, removes ci-pending, and handles CI failure by removing accepted/changing labels and commenting.
• 🟡 (16:22) Tool lookup returned actor joshuarli, created at 2026-08-25T20:47:45Z.
• 🟡 (16:23) src/modules/details-from-context.js parses publish titles with PUBLISH_TITLE_REGEX equivalent to /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/; it derives path as "." + (titleMatch.path || ""), sets dry_run to "1" when the issue has dry-run, parses Merge target: <[\w.\-/]+>, and parses checked target IDs from the Targets section.
• 🟡 (16:25) Tool lookup returned actor getsantry[bot], created at 2026-08-15T17:06:41Z, with issue_author: null.
• 🟡 (16:27) Issue timeline evidence: chadwhitacre mentioned and subscribed at 2026-08-15T17:06:33Z; getsantry[bot] added accepted at 17:06:41Z, added ci-pending at 17:06:52Z, removed ci-pending and added ci-ready at 17:16:07Z; github-actions[bot] closed the issue at 17:18:55Z.
• 🟡 (16:28) Assistant’s intended design: a bot-authored attestation tied to the latest accepted event and exact validated title; publishing will reject if that event, title, actor, or attestation no longer match, requiring fresh approval after a rename.
• 🟡 (16:28) Files changed: added src/modules/approval-attestation.js; modified src/modules/details-from-context.js and src/modules/approval-authorizer.js.
• 🟡 (16:28) Assistant stated the repair targets: immutable approval proof across title changes, explicit bot-approval provenance, and unconditional removal of rejected approval labels.
• 🟢 (16:28) Task status updated: “Map current approval workflow and test coverage against review findings” is in progress; “Implement immutable approval attestation and fail-closed authorization,” “Harden workflow cleanup and polling against approval drift,” “Add adversarial regression tests and validate changes,” and “Process final security review findings” are pending; all high priority.
• 🟡 (16:28) .github/workflows/publish.yml waiting-for-ci runs only for an open issue where github.event.label.name == 'accepted' and the title starts publish: . It checks out with actions/checkout@v6 and persist-credentials: false; obtains a sentry-internal-app token with actions/create-github-app-token@v3; attempts a getsentry release-bot token with continue-on-error: true; invokes node src/publish/authorize-approval.js with APPROVAL_TOKEN, APPROVAL_ACTOR: ${{ github.actor }}, and APPROVAL_ISSUE_TITLE: ${{ github.event.issue.title }}.
• 🟡 (16:28) .github/workflows/publish.yml rejects when authorization does not succeed or authorized != 'true': using the internal-app GH_TOKEN, it removes accepted, comments that the actor cannot approve and must have write, maintain, or admin, then exits 1. This cleanup currently follows checkout and token creation and is vulnerable to prior-step implicit-success() skipping.
• 🟡 (16:28) .github/workflows/publish.yml resets approved issues by removing ci-failed and ci-ready and adding ci-pending; it optionally enables CI_POLLER_HAS_PENDING=true with a dedicated poller app because sentry-internal-app lacks actions_variables:write, then triggers ci-poller.yml through the internal-app token.
• 🔴 (16:28) User stated that the poller always adds ci-ready after CI passes; waiting-for-ci removes any existing ci-ready so the fresh labeled event triggers Publish.
• 🟡 (16:28) .github/workflows/publish.yml publish job runs only for an open issue on a ci-ready label event when labels include accepted and ci-ready but exclude ci-pending and ci-failed; it has timeout-minutes: 90 and SENTRY_DSN: "https://303a687befb64dc2b40ce4c96de507c5@o1.ingest.sentry.io/6183838".
• 🟡 (16:28) src/modules/approval-authorizer.js: ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]); AUTO_APPROVER = "getsantry[bot]"; it imports PUBLISH_TITLE_REGEX from details-from-context.js, rejects unmatched titles with { authorized: false, repository: null }, computes repository = getsentry/<repo> and releasePath = repository + path, approves getsantry[bot] only for exact allowlisted release paths without a permission lookup, explicitly rejects non-allowlisted getsantry[bot], and otherwise calls getPermission({ owner: "getsentry", repository: title.groups.repo, username: actor }).
• 🟡 (16:28) src/publish/authorize-approval.js: getAutoApprovedRepositories() reads auto-approve-repos.txt, splits on line endings, filters blank lines, and returns a Set; getPermission() fetches https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/collaborators/${encodeURIComponent(username)}/permission with Authorization: Bearer ${process.env.APPROVAL_TOKEN} and GitHub API version "2026-03-10", throwing on non-OK responses. main() requires GITHUB_OUTPUT and APPROVAL_TOKEN, calls authorizeApproval() with APPROVAL_ACTOR and APPROVAL_ISSUE_TITLE, and appends authorized=<boolean>\n.
• 🟡 (16:28) Existing src/modules/__tests__/approval-authorizer.js coverage: allowlisted getsantry[bot] release getsentry/sentry-javascript authorizes without lookup; non-allowlisted bot test expects rejection for allowlist getsentry/sentry-python but incorrectly expects getPermission to be called with bot username; human collaborators with write, maintain, and admin authorize; unqualified publish: sentry-javascript/packages/core@10.0.0 maps to getsentry/sentry-javascript; none, read, triage, "Elevated Bot", and undefined reject; malformed titles reject without lookup; lookup errors propagate.
• 🟡 (16:28) Existing src/publish/__tests__/authorize-approval.js verifies exact allowlist release paths getsentry/sentry-javascript and getsentry/objectstore/clients; verifies successful contractor permission lookup against https://api.github.com/repos/getsentry/sentry-javascript/collaborators/contractor/permission with Bearer release-bot-token writes authorized=true\n; verifies a 404 permission response throws and writes no output.
• 🟡 (16:29) .github/workflows/auto-approve.yml runs on opened issues only when github.actor is either sentry-release-bot[bot] or getsantry[bot] and title starts publish: . It sparse-checks out auto-approve-repos.txt, creates a sentry-internal-app token, extracts REPO with sed -n 's/^publish: \(.*\)@.*/\1/p', and adds accepted when that exact string exists in auto-approve-repos.txt.
• 🟡 (16:31) Assistant identified the root cause as the initial gate using the label-event title without carrying that snapshot to the later poller and publisher; planned fix is a signed-by-app, event-bound attestation validated before both CI transition and publish.