Dashboard › publish › Distillation
7c200d54-c4fe-42b8-9b6b-a5f94e654d03["lore_tm_v1_hZOkC3JckC_VqpHfG_IS6jq4ctltt_YVrNkyTlT0Y1w","lore_tm_v1_QX_QpeznDX-Ata4heXw_sCkJtdo6Msdw4MOw7Ib1aA4","lore_tm_v1_iy5DLGva4Wyc-W5EdNuXSgrrTQRfM-MSs3L2ysuHoRQ","lore_tm_v1_0iKwJYVMgYSqDoQmBkHos8Fu6DfFg0wQRNtOSJlESCo","lore_tm_v1_5X8TVcuMhqBSiyqro19dkL5xpyBCiwRqN4UW01STJ_c","lore_tm_v1_teg15cJPIfi-qO3wtAbLMvcHBXmLWtsFyOxe81323ks","lore_tm_v1_AKRxeFtonPS_oWWPI-xhA3nuOK1GobbYalvXw5MTOFs","lore_tm_v1_Ix6DnHprkAF7IQznM7SErKP6nqt3KkuAenkEsqt3srY","lore_tm_v1_iNnf5Hf-BfgAAt9y6uB9eQZneCPBePHRryjLKW6RqSY","lore_tm_v1_GgFTPigQw3t9uAgAjarHs0qie530f2sXCWZnJzy3w5k","lore_tm_v1_9SHedm8LxeLzLpJIEUWzxWx2XUVcNLbW-56jwDgQSjY","lore_tm_v1_9Z0f8toSDL38d8Eiadu6JoYCu-cvEl_G_A1rkaUUVn4"]
Date: Sep 8, 2026
src/publish/__tests__/authorize-approval.js has 7 Vitest tests. getAutoApprovedRepositories() reads exact newline-delimited paths from auto-approve-repos.txt, including getsentry/sentry-javascript and nested path getsentry/objectstore/clients; it must return a Set of those exact paths.authorize-approval.js test harness sets GITHUB_OUTPUT=/tmp/github-output, APPROVAL_TOKEN=release-bot-token, APPROVAL_ISSUE_NUMBER=123, APPROVAL_ISSUE_REPOSITORY=getsentry/publish, APPROVAL_ISSUE_TITLE, and APPROVAL_ACTOR; successful authorization writes authorized=true\napproval_attestation=<!-- publish-approval .+ -->\n to $GITHUB_OUTPUT.contractor approving publish: getsentry/sentry-javascript@10.0.0 requires GitHub collaborator permission lookup at https://api.github.com/repos/getsentry/sentry-javascript/collaborators/contractor/permission, authenticated as Bearer release-bot-token; a role_name: "write" response authorizes when the open, accepted issue requester is a different user (requester) and the current accepted-label event is by contractor.contractor is both APPROVAL_ACTOR and issue opener, it writes authorized=false\n.sentry-internal-app[bot] for an allowlisted automated request opened by getsantry[bot] for publish: getsentry/relay@1.2.3 only with a GitHub Actions comment containing createAutoApprovalAttestation({autoApprover: "getsantry[bot]", issue}); this path must not call /collaborators/ permission lookup. Without request proof, it writes authorized=false\n.sentry-release-bot[bot] before any fetch, writing authorized=false\n. It fails closed if permission lookup returns non-OK (test: HTTP 404), throwing Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404 without writing output or logging console.error.src/modules/__tests__/approval-attestation.js has 5 Vitest tests: currentAcceptedEvent() chooses the latest "accepted" labeled event (event ID "200" over "100") and normalizes numeric GitHub event ID 29503999078 to string "29503999078".github-actions[bot]), tied to the current accepted event actor/event ID, and bound by requestDigest(issue); malformed <!-- publish-approval not-base64 -->, wrong comment author, stale event/title, and changed dry-run state are rejected.createCiReadyAttestation() bind acceptedActor, acceptedEventId, ciReadyActor, request digest, and title. hasCiReadyAttestation() accepts only when both the current approval and ci-ready labeling actor match; changing accepted event "200"→"201" or using contractor rather than sentry-internal-app[bot] as the CI-ready actor rejects it.src/publish/__tests__/auto-approval-workflow.js has 2 tests requiring .github/workflows/auto-approve.yml to run node src/publish/record-auto-approval-attestation.js before --add-label accepted, post the proof as github-actions[bot] using GH_TOKEN: ${{ github.token }}, then use GH_TOKEN: ${{ steps.token.outputs.token }} for the internal-app label operation.src/publish/__tests__/current-accepted-event.js has 2 tests: getCurrentAcceptedEvent({getIssueEvents, issueNumber: "123", repository: "getsentry/publish"}) returns the latest accepted event {actor: "contractor", eventId: "200"}; no valid accepted-label event throws The issue has no current accepted label event.src/publish/__tests__/publish-workflow.js has 2 tests requiring Revalidate approval attestation after Set targets but before Publish using Craft, with REQUIRE_CI_READY_ATTESTATION: "true", and requiring Craft image syntax pinned to an immutable 64-hex SHA-256 digest.src/publish/__tests__/record-auto-approval-attestation.js has 2 tests: recordAutoApprovalAttestation() binds automated requester getsantry[bot] and live open publish request publish: getsentry/sentry-javascript@10.0.0 to a parsed proof {autoApprover: "getsantry[bot]", requestDigest, title}; if the live issue author changes to contractor, it throws The automated approval request changed before approval.src/publish/__tests__/record-ci-ready-attestation.js has 3 tests: recordCiReadyAttestation() authenticates the CI-ready label actor via getAuthenticatedLogin() and creates a proof with acceptedActor: "contractor", acceptedEventId: "100", ciReadyActor: "sentry-internal-app[bot]", request digest, and title. It throws The approval changed before CI could be marked ready if issue/title changed or if expectedAcceptedEvent "100" differs from current accepted event "200".src/publish/__tests__/validate-approval-attestation.js has 9 Vitest tests. validateApprovalAttestation() accepts a live open issue with "accepted" label, matching current accepted event, and matching trusted github-actions[bot] approval proof; it rejects proofs if title or body changes, issue is closed, "accepted" is removed, or "accepted" is re-added creating a new event.validateApprovalAttestation() with expectedAcceptedEvent: {actor: "contractor", eventId: "100"} rejects a later valid-looking proof tied to accepted event "200". With requireCiReadyAttestation: true, it additionally requires a "ci-ready" label event by sentry-internal-app[bot] and matching CI-ready proof; a manually added "ci-ready" by contractor is rejected.src/publish/__tests__/workflow-action-pinning.js verifies action references in .github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/publish.yml, and .github/workflows/test.yml all use exactly 40 lowercase hexadecimal commit-SHA revisions..github/workflows/auto-approve.yml is named auto-approve non-sdks, triggered on opened issues, with contents: read and issues: write. Its auto-approve job runs on ubuntu-latest only when actor is sentry-release-bot[bot] or getsantry[bot] and title starts publish: .auto-approve.yml checks out only auto-approve-repos.txt using actions/checkout@11d5960a326750d5838078e36cf38b85af677262, sparse-checkout-cone-mode: false; creates an internal-app token via actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 using vars.SENTRY_INTERNAL_APP_ID and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY.auto-approve.yml runs node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN: ${{ github.token }}, issue number/repository/title, and AUTO_APPROVER: ${{ github.actor }}. On success it posts ${{ steps.attestation.outputs.auto_approval_attestation }} to the issue using ${{ github.token }}; then, using the internal-app token, extracts repository by sed -n 's/^publish: \(.*\)@.*/\1/p' and adds "accepted" only if grep -qxF "$REPO" auto-approve-repos.txt matches.package.json declares private package publish version 0.0.1, description Approval-based publishing system for Sentry, Apache-2.0 license, repository git@github.com:getsentry/publish.git, and Volta Node 24.0.0/Yarn 1.22.22. Scripts: test: vitest run, test:watch: vitest, lint: eslint src .github --ignore-pattern '!.github', prettier: prettier --write src; resolution undici: ^6.23.0; dependencies @actions/core ^2.0.0, @actions/github ^7.0.0, @sentry/node ^10.0.0; dev dependency vitest ^4.1.0.yarn run v1.22.22 → vitest run --printConsoleTrace completed successfully in /home/byk/Code/getsentry/publish: 16 test files passed and 72 tests passed; Vitest v4.0.17, duration 2.27s (transform 274ms, import 1.21s, tests 358ms), command completed in 2.85s.