Dashboard › publish › Distillation
7a2b34c7-549f-417e-8727-2cf0444388dc["lore_tm_v1_booGA6i05v2e0wKcVIHghdHd2u8AoJKRb5BRJ6cznHc","lore_tm_v1_MuiInu15kVce3S7ntxLQBD7obJgZo9wxurCWgj9l8zU"]
Date: Sep 14, 2026
src/publish/__tests__/publish-workflow.js reads .github/workflows/publish.yml and defines 7 Vitest workflow tests.src/publish/__tests__/publish-workflow.js test 1, "binds approval and publication to the triggering issue snapshot", requires node src/publish/request-digest-from-event.js and exactly 4 occurrences of EXPECTED_REQUEST_DIGEST: ${{ steps.request-digest.outputs.request_digest }}.src/publish/__tests__/publish-workflow.js test 2, "revalidates approval immediately before Craft", requires Revalidate approval attestation after Set targets but before Publish using Craft, with REQUIRE_CI_READY_ATTESTATION: "true" in the remaining workflow section.src/publish/__tests__/publish-workflow.js test 3, "does not make the informational start comment a publication gate", requires name: Inform start before name: Get Release Bot auth token and continue-on-error: true between them.src/publish/__tests__/publish-workflow.js test 4, "pins Craft to an immutable digest", requires uses: docker://getsentry/craft@sha256: followed by exactly 64 lowercase hexadecimal characters.src/publish/__tests__/publish-workflow.js test 5, "activates the poller independently of comments and revokes approval if both activation paths fail", inspects the waiting-for-ci job and requires this order: 1. Mark ci-pending, 2. Trigger CI poller, 3. Comment on issue, 4. Enable cron poller, 5. Revoke stranded approval. The trigger, comment, and enable sections must each contain continue-on-error: true; the guard must check both steps.trigger-poller.outcome != 'success' and steps.enable-poller.outcome != 'success', then include --remove-label "ci-pending" and --remove-label "accepted".src/publish/__tests__/publish-workflow.js test 6, "reconciles authorization without Node before and after terminal reporting", requires the publish-job order Publish using Craft → Reconcile publish issue → Report publish result → Verify publish issue reconciliation. Both reconciliation sections must contain if: always(), ${{ steps.publish.outcome }}" == "success, removal of labels "accepted", "ci-pending", and "ci-ready", --state closed, and no node invocation.src/publish/__tests__/publish-workflow.js test 7, "reports exactly one terminal status from the Craft outcome", requires exactly 1 name: Report publish result block. That block must use if: always(), switch on case "${{ steps.publish.outcome }}" in, map success to status=success, cancelled to status=cancelled, every other outcome to status=failure, invoke node .__publish__/src/publish/post-result.js "$status", and not contain cancelled().src/publish/__tests__/ci-poller-workflow.js reads .github/workflows/ci-poller.yml and .github/workflows/ci-poller-dispatch.yml, then defines 4 Vitest workflow tests.src/publish/__tests__/ci-poller-workflow.js test 1, "checks out trusted code before requesting app tokens", requires Get publish code to use actions/checkout@ with a 40-character lowercase hexadecimal commit and ref: ${{ github.event.repository.default_branch }}, with checkout occurring before Get auth token.src/publish/__tests__/ci-poller-workflow.js test 2, "uses a protected workflow dispatch relay for manual recovery", requires .github/workflows/ci-poller.yml to include repository_dispatch:, types: [ci-poller], workflow_run:, workflows: [Run CI Status Poller], guards for github.event.workflow_run.conclusion == 'success' and github.event.workflow_run.head_branch == github.event.repository.default_branch, and no workflow_dispatch:. It requires .github/workflows/ci-poller-dispatch.yml to include workflow_dispatch:, permissions: {}, and environment: production, while containing neither secrets. nor repository_dispatch:.src/publish/__tests__/ci-poller-workflow.js test 3, "validates repository dispatch attempts before requesting app tokens", requires Validate dispatch attempt before Get auth token. It extracts the regex from [[ "$ATTEMPT" =~ ^(.+)$ ]] and verifies acceptance of every decimal string from 0 through 59, while rejecting "00", "01", "60", "-1", "1x", "$(id)", and the empty string. It also requires ATTEMPT: ${{ github.event_name == 'repository_dispatch' && steps.dispatch-attempt.outputs.value || '0' }}, attempt=$((10#$ATTEMPT + 1)), and gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input -.src/publish/__tests__/ci-poller-workflow.js test 4, "binds every poller approval fence to the listed request snapshot", requires request_digest=$(echo "$publish_input" | jq -r '.requestDigest') and exactly 4 occurrences of EXPECTED_REQUEST_DIGEST="$request_digest".