Distillation

🔴 (03:22) src/modules/release-revision.js defines isRevision(revision) as /^[0-9a-f]{40}$/; updateReleaseRevision({ issueBody, repo, revision }) rejects anything other than a lowercase 40-character SHA with Release revision must be a lowercase 40-character SHA. and replaces only the parsed revision range in the issue body. 🔴 (03:22) src/modules/release-revision.js requires exactly one View check runs link via Peggy start rule CheckRunsLinkCount; getReleaseRevisionDetails({ issueBody, repo }) parses ReleaseRevision, requires the parsed repository to equal repo, and emits repository-specific errors for duplicate, missing, malformed, or mismatched links. 🔴 (03:22) src/modules/ci-poller-input.js defines getCiPollerInput({ title, issueBody, labels, revision }): it validates repository, semantic version, and prefixed path; reads the current revision from the original body; optionally writes a supplied revision into resolvedIssueBody; and returns repo: getsentry/<repo>, a digest of the resolved request, the original currentRevision, and version, plus the modified issueBody only when a replacement revision was supplied. 🔴 (03:23) src/modules/approval-attestation.js uses SHA-256 over JSON.stringify({ body, dryRun, title }), where dryRun is true iff a label named dry-run exists; invalid non-string body/title or non-array labels throw Invalid publish request. 🔴 (03:23) src/modules/approval-attestation.js encodes JSON attestations as base64url HTML comments with prefixes <!-- publish-approval , <!-- publish-auto-approval , or <!-- publish-ci-ready and suffix -->; malformed, incomplete, or invalidly encoded attestations parse as null. 🔴 (03:23) Approval attestations bind actor, stringified eventId, requestDigest, and title; auto-approval attestations bind autoApprover, requestDigest, and title; CI-ready attestations bind acceptedActor, stringified acceptedEventId, ciReadyActor, requestDigest, and title. 🔴 (03:23) compareEventIds(left, right) strips leading zeroes, validates decimal-only IDs, compares by digit count and then locale order, and throws Invalid issue event ID for invalid values; currentLabeledEvent(events, labelName) chooses the labeled event with the greatest ID and returns { actor, eventId }, or null if no valid event exists or comparison fails. 🔴 (03:23) hasApprovalAttestation(), hasAutoApprovalAttestation(), and hasCiReadyAttestation() accept only comments authored by the expected attestationAuthor and require all bound actors, event IDs, request digest, and title to match the live issue/event snapshot. 🔴 (03:23) src/modules/approval-authorizer.js allows repository roles write, maintain, and admin; auto-approvers are getsantry[bot] and sentry-release-bot[bot], while the auto-approval labeler is sentry-internal-app[bot]. 🔴 (03:23) authorizeApproval({ actor, issueTitle, getPermission }) returns { authorized: false, repository: null } for an invalid title; rejects auto-approvers and sentry-internal-app[bot] as direct human approvers; otherwise queries the actor’s permission on getsentry/<repo> and authorizes only write, maintain, or admin. 🔴 (03:23) isAutoApprovedRepository() requires an allowed auto-approver, a valid publish title, and an exact allow-list entry of getsentry/${title.repo}${title.path || ""}. 🔴 (03:23) src/modules/publish-issue-title.peggy accepts canonical titles of the form publish: plus optional getsentry/, repository, optional slash-separated path, @, and version; repository/path characters are syntactically [A-Za-z0-9_.-], while version characters are [A-Za-z0-9_.+-]. 🔴 (03:23) src/modules/publish-issue-title.peggy requires the issue request header to begin with Requested by, Merge target, Quick links, one View changes line, then a View check runs URL of the form https://github.com/getsentry/<repo>/commit/<40-lowercase-hex-SHA>/checks; the SHA parser records exact source offsets for safe replacement. 🔴 (03:23) src/modules/publish-issue-title.peggy permits merge target (default) or [A-Za-z0-9_./-]+; CheckRunsLinkCount scans the complete body to count literal - [View check runs]( occurrences and protect against appended decoy links. 🔴 (03:23) src/modules/publish-issue-validation.js defines safe repository names as /^[A-Za-z0-9_.-]+$/ excluding ., .., __proto__, and names beginning with -; isReleaseVersion() validates numeric major.minor.patch without leading zeroes, with optional prerelease and build metadata. 🔴 (03:23) src/publish/inputs.js calls detailsFromContext({ context: github.context }) and writes its JSON result to the GitHub Actions output result. 🔴 (03:23) src/publish/resolve-release-revision.js requires repo in JSON PUBLISH_ARGS, reads the issue body from PUBLISH_ISSUE_BODY, resolves the authoritative check-runs SHA via getReleaseRevision(), and writes it to output revision. 🔴 (03:23) src/publish/discover-location.js pins Craft to getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b; when a root .craft.yml exists, getWorkspaceNames() executes docker run --rm --volume <absolute-repository-directory>:/github/workspace/__repo__ --workdir /github/workspace/__repo__ <CRAFT_IMAGE> workspace list, parses JSON, and fails closed unless it is an array. 🔴 (03:23) src/publish/discover-location.js returns no workspaces without a root .craft.yml; main() requires input.path from PUBLISH_ARGS, defaults PUBLISH_REPOSITORY_DIRECTORY to __repo__, and writes the discovered location as JSON output result. 🔴 (03:23) src/publish/resolve-ci-poller-input.js reads the issue body from PUBLISH_ISSUE_BODY_FILE when set, otherwise PUBLISH_ISSUE_BODY; it parses labels from PUBLISH_ISSUE_LABELS, title from PUBLISH_TITLE, optional revision from PUBLISH_REVISION, and writes getCiPollerInput() JSON to stdout. 🔴 (03:23) src/publish/request-digest-from-event.js requires GITHUB_EVENT_PATH and GITHUB_OUTPUT, requires an object-valued event.issue, computes requestDigest(event.issue), and appends request_digest=<digest> to the GitHub output file. 🔴 (03:24) src/publish/validate-approval-attestation.js calls GitHub with media type application/vnd.github+json, bearer APPROVAL_TOKEN, and API version 2026-03-10; getAllPages() fetches issue events/comments in pages of 100 until a page contains fewer than 100 records. 🔴 (03:24) validateApprovalAttestation() requires the live issue to remain open, preserve issueTitle and expectedRequestDigest, retain accepted, have a current accepted event optionally matching expectedAcceptedEvent, and have a matching approval attestation; when requireCiReadyAttestation is true, it additionally requires a current ci-ready event, live ci-ready label, and matching CI-ready attestation. 🔴 (03:24) src/publish/authorize-approval.js loads exact non-empty allow-list lines from auto-approve-repos.txt; GitHub permission, issue, event, and comment lookups use API version 2026-03-10, with events/comments paginated 100 per page. 🔴 (03:24) In src/publish/authorize-approval.js, an accepted label applied by sentry-internal-app[bot] is authorized only if the live issue remains open and unchanged, its requester is getsantry[bot] or sentry-release-bot[bot], the exact repository/path is allow-listed, the current accepted event actor is the app, and a github-actions[bot] auto-approval attestation matches the live issue and requester. 🔴 (03:24) For non-automated approval, src/publish/authorize-approval.js rejects self-approval case-insensitively and requires the live issue to remain open with unchanged title/digest, a string requester, and a current accepted event whose actor equals the approving actor; success writes authorized=true and approval_attestation=<attestation>, while rejection writes authorized=false. 🔴 (03:24) src/publish/current-accepted-event.js fetches all issue events, resolves the current accepted-label event, throws The issue has no current accepted label event if absent, and writes { actor, eventId } JSON to stdout. 🔴 (03:24) src/publish/record-auto-approval-attestation.js re-fetches the issue and records an attestation only if it is open, title and request digest still match, and the requester login equals AUTO_APPROVER case-insensitively; otherwise it throws The automated approval request changed before approval. 🔴 (03:24) src/publish/record-ci-ready-attestation.js obtains the authenticated login from GitHub’s user endpoint and creates a CI-ready attestation only if the issue remains open and unchanged, still has accepted, has a current accepted event, and that event matches the optional expected actor/event ID; otherwise it throws The approval changed before CI could be marked ready. 🔴 (03:24) src/publish/update-issue.js parses optional PUBLISH_ARGS, warns Could not parse publish inputs; skipping target update on malformed JSON, and invokes updateIssue({ context, octokit, inputs }). 🔴 (03:24) src/modules/update-issue.js reads CRAFT_STATE_FILE_PATH only when present and existing, updates declared target checkboxes according to craftState.published, appends published-state targets not already declared, and then updates the issue body; updateIssue() performs that target update concurrently with removal of the accepted label. 🔴 (03:24) User directed that new Craft requests always include the checkout repository identity. 🔴 (03:24) User stated workspace release titles use the full concrete workspace path suffix, exemplified by publish: getsentry/toolkit/packages/cli@1.2.3, while a root release is exemplified by publish: getsentry/sentry@21.3.1. 🔴 (03:24) User stated the controller never normalizes workspace names and Craft preserves their exact spelling. 🔴 (03:24) User stated a missing root .craft.yml always means checkout-path behavior; with a root .craft.yml, only an exact craft workspace list match is treated as a workspace, every other suffix remains a checkout path, and discovery errors fail the release. 🔴 (03:24) docs/publish-issue-format.md states getsentry/ remains optional only for parsing existing issues; the complete suffix is resolved after checkout of the exact CI-approved revision from the View check runs link. 🔴 (03:24) docs/publish-issue-format.md defines body behavior: (default) means the target repository’s default branch; checked - [x] <target-id> entries are skipped; failed-release target state is refreshed from the secure Craft publish-state file; checked targets remain skipped on retry unless manually unchecked.