Distillation

Date: Sep 2, 2026

• 🟡 (11:21) Scheduled follow-up instructed: await independent adversarial-review completion; if complete, address every finding and rerun verification; otherwise remain blocked without editing reviewed files.
• 🟡 (11:22) Replacement foreground read-only adversarial review found one release blocker: .github/workflows/ci-poller.yml could not support controller-accepted legacy publish titles. Planned fix: make the poller use the same title parser, add regressions, and remove an untracked pnpm lockfile.
• 🟡 (11:23) Task status remained: 1. “Fix adversarial review blockers in the compact publish contract” in progress, high priority; 2. “Re-run adversarial review and verify both repositories” pending, high; 3. “Commit, push, and monitor linked PRs” pending, high; 4. “Document workspace migration” pending, low.
• 🟡 (11:25) Scheduled follow-up instructed: if independent review completed, handle findings and rerun verification; otherwise report the gate blocked without editing reviewed worktrees.
• 🟡 (11:28) Scheduled follow-up instructed: check for independent review completion; if completed address findings and verify, otherwise remain blocked without modifying reviewed files.
• 🔴 (11:30) User stated .github/workflows/ci-poller.yml must always allow workflow_dispatch for manual recovery. check-ci runs when vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'; schedule is every 5 minutes ("*/5 * * * *"), and manual dispatch has optional attempt input defaulting to "0".
• 🟡 (11:30) Existing CI poller configuration uses actions/create-github-app-token@v3 twice: steps.token with SENTRY_INTERNAL_APP_ID / SENTRY_INTERNAL_APP_PRIVATE_KEY for local label changes, and steps.release-token with SENTRY_RELEASE_BOT_CLIENT_ID / SENTRY_RELEASE_BOT_PRIVATE_KEY, owner: getsentry, for cross-repository API calls. It selects up to 200 open issues with both ci-pending and accepted labels.
• 🟡 (11:33) src/modules/release-revision.js originally used CHECK_RUNS_LINK to match a View check runs URL for getsentry/<repo>/commit/<40-lowercase-hex revision>/checks, and getReleaseRevision({ issueBody, repo }) required the matched repository to equal repo.
• 🟡 (11:35) Controller test files enumerated: src/modules/__tests__/release-revision.js, publish-location.js, publish-workflow.js, update-issue.js, process-end-state.js, post-workflow-details.js, details-from-context.js; and src/libs/__tests__/github.js.
• 🟡 (11:36) Review investigation found a second issue: getReleaseRevision() accepted a decoy View check runs link outside the Quick links section. Planned fail-closed canonical-link extraction in both controller paths, alongside the CI-poller title-parser fix.
• 🟡 (11:38) Craft WorkspaceNameSchema in src/schemas/project_config.ts permitted only ^[A-Za-z0-9_.-]+$ and explicitly rejected __proto__ because assigning that key to a regular object mutates its prototype. CraftProjectConfigSchema allows optional workspaces: z.record(WorkspaceNameSchema, WorkspaceSchema) and rejects top-level github.projectPath when workspaces exist.
• 🟡 (11:41) src/publish/inputs.js calls detailsFromContext({ context: github.context }) and sets GitHub Action output result.
• 🟡 (11:44) Craft action.yml validates that inputs.workspace cannot be combined with inputs.path other than "."; it originally checked workspace names with ^[A-Za-z0-9_.-]+$ and emitted “Workspace names must use only ASCII letters, digits, periods, underscores, and hyphens.”
• 🟡 (11:45) Implementation decision: add a controller-side CI-poller resolver that uses the generated publish-title parser and canonical Quick links revision helper; make .github/workflows/ci-poller.yml consume the resolver’s JSON output; reject . and .. at both Craft entry points; and update the publish-workflow state test to use real compact resolution.
• 🟡 (11:46) Patch attempt to modify src/modules/__tests__/publish-location.js failed because expected test test("rejects invalid discovered workspace names", () => { was not present.
• 🟡 (11:48) src/modules/__tests__/publish-location.js behavior included: discovery required for { path: "./cli" } but not "./packages/cli", ".", or explicit workspace; exact one-segment workspace "CLI" resolves to { path: ".", workspace: "CLI" } without normalization; nonworkspace and multi-segment suffixes remain checkout paths; legacy explicit "cli/v2" is preserved and does not validate discovery; workspace plus non-root path throws “A publish workspace must use the repository root path.”; discovered "cli-日本語" throws “Craft workspace discovery returned an invalid workspace list”.
• 🟡 (11:52) Files changed for traversal guard hardening: craft-workspace-action-propagation/src/schemas/project_config.ts, action.yml, src/__tests__/config.test.ts, src/__tests__/action.test.ts; and publish-workspace-acceptance/src/modules/publish-location.js, src/modules/__tests__/publish-location.js.
• 🟡 (11:53) Assistant reported Craft schema and Action now reject traversal names; next change would introduce a shared controller input resolver for consistent accepted-title and canonical-CI-link parsing.
• 🟡 (11:56) Assistant stated the first hardening patch was in place and was replacing broad CI-poller parsing with parser-backed title and canonical Quick-links resolution, including safe link updates.
• 🟡 (11:58) Patch attempt against src/modules/release-revision.js failed because the file had already changed. Current implementation used global CHECK_RUNS_LINK, QUICK_LINKS, issueBody.matchAll(CHECK_RUNS_LINK), and required exactly one matching check-runs link whose matched text occurs in the captured Quick-links block; otherwise it throws “Expected exactly one View check runs link in Quick links for getsentry/${repo}.”
• 🟡 (12:02) Added publish-workspace-acceptance/src/modules/ci-poller-input.js.
• 🟡 (12:05) getCiPollerInput({ title, issueBody }) in src/modules/ci-poller-input.js calls parsePublishIssueTitle(title), then returns { repo: \getsentry/${repo}`, revision: getReleaseRevision({ issueBody, repo }), version }`.
• 🟡 (12:07) Added src/publish/resolve-ci-poller-input.js, which writes JSON for getCiPollerInput({ issueBody: process.env.PUBLISH_ISSUE_BODY || "", title: process.env.PUBLISH_TITLE || "" }) to stdout.
• 🟡 (12:10) CI poller integration changed to invoke node .__publish__/src/publish/resolve-ci-poller-input.js with PUBLISH_ISSUE_BODY and PUBLISH_TITLE; parsing failure warns and skips issue. It reads JSON .repo, .version, .revision; resolves branch from the original commit’s check suites, resolves branch head if available, otherwise falls back to issue SHA, and if changed updates the issue body by replacing ${issue_sha} with ${sha}.
• 🟡 (12:13) Added src/modules/__tests__/ci-poller-input.js.
• 🟡 (12:15) Updated controller files: .github/workflows/ci-poller.yml, src/modules/release-revision.js, src/modules/ci-poller-input.js, src/publish/resolve-ci-poller-input.js, and tests release-revision.js / ci-poller-input.js.
• 🟡 (12:18) Focused controller verification ran node scripts/generate-publish-issue-title-parser.js --check, then yarn check:generated && vitest run src/modules/__tests__/release-revision.js src/modules/__tests__/ci-poller-input.js src/modules/__tests__/publish-location.js src/modules/__tests__/publish-workflow.js. Result: 24 passed and 3 failed of 27 tests across 4 files. Failures: two release-revision decoy/duplicate Quick-links tests received generic repository-link error rather than canonical-link error; publish-workflow expected state hash 21cf7beaeda4 but received checkout-root hash c232c383e26f.
• 🟡 (12:19) Investigation conclusion: focused failures were test defects rather than permissive behavior. Compact workspace resolution correctly hashes checkout root for Craft publish-state; release-revision helper needed to detect/report duplicate links before attempting block membership matching.
• 🟡 (12:20) Updated src/modules/release-revision.js and src/modules/__tests__/publish-workflow.js.
• 🟡 (12:22) Re-run focused controller verification yielded 26 passed and 1 failed of 27 tests: rejects a missing CI-approved revision expected old generic “Expected a View check runs link for getsentry/toolkit” but received fail-closed “Expected exactly one View check runs link in Quick links for getsentry/toolkit.”
• 🟡 (12:25) Updated src/modules/__tests__/release-revision.js to expect the canonical fail-closed error.
• 🟡 (12:26) Assistant identified that ci-poller.yml must check out controller source before calling the shared resolver, and planned the required workflow checkout step.
• 🟡 (12:27) Patch attempt against docs/publish-issue-format.md failed because the expected bare View check runs context did not match.
• 🟡 (12:30) Updated .github/workflows/ci-poller.yml with the controller checkout requirement.
• 🔴 (12:35) User stated the documented controller contract: Craft preserves exact workspace spelling; controller only resolves a one-segment suffix after checking out the exact CI-approved View check runs revision and listing root .craft.yml workspace keys; exact key matches are workspaces and all other suffixes remain checkout paths; the controller never normalizes names; missing root .craft.yml always means checkout-path behavior; discovery errors with root configuration fail the release.
• 🟡 (12:35) Documentation states legacy JSON-qualified titles remain supported but Craft does not create them, e.g. publish: getsentry/toolkit [workspace: "cli/v2"] @1.2.3; legacy workspace titles require repository-root path; parsed paths cannot contain ..; Quick links include View changes and View check runs; accepted starts publishing and dry-run requests dry-run mode.
• 🟡 (12:37) Updated docs/publish-issue-format.md to document the canonical Quick-links contract.
• 🟡 (12:39) Focused Publish verification passed: generated parser check, 4 test files / 27 tests, and eslint src .github --ignore-pattern '!.github'.
• 🟡 (12:42) Focused Craft checks passed: vitest run src/__tests__/config.test.ts src/__tests__/action.test.ts src/commands/__tests__/publish.test.ts had 3 files / 83 tests passing. Craft lint had 0 errors and 7 pre-existing warnings: five unused variables in src/commands/publish.ts at lines 482, 499, 515, 521, 527, and two _err warnings in src/utils/git.ts at lines 241 and 249.
• 🔴 (12:42) User stated the project had never used @typescript-eslint/no-unused-vars; current Craft lint output nevertheless reported 7 warnings attributed to that rule.
• 🟡 (12:43) Assistant found that the canonical Quick-links matcher needed to allow the Action-documented blank line and indentation under Quick links, while preserving the rejection of decoy matching.
• 🟡 (12:44) Updated src/modules/release-revision.js and src/modules/__tests__/release-revision.js to accept the documented Quick-links layout while requiring exactly one canonical check-runs link.
• 🟡 (12:47) Complete Publish verification passed parser generation, 9 test files / 53 tests, and ESLint. A subsequent shell formatting invocation failed only because global prettier was not installed (/usr/bin/bash: prettier: command not found).
• 🟡 (12:48) Assistant determined full Publish suite/lint were green; planned to run formatting through local Yarn dependency and then full Craft suite after guard changes.
• 🟡 (12:49) yarn exec prettier failed with exit code 2 because it received no file path/parser: “No parser and no file path given, couldn't infer a parser.”
• 🟡 (12:52) Publish package.json has scripts: generate, check:generated, test, test:watch, lint, and prettier: "prettier --write src"; dev dependency prettier: "^2.2.1"; Volta pins Node 24.0.0 and Yarn 1.22.22.
• 🟡 (12:54) Prettier check found style issues in 5 files: src/modules/ci-poller-input.js, src/modules/release-revision.js, src/modules/__tests__/ci-poller-input.js, src/modules/__tests__/publish-location.js, and src/modules/__tests__/release-revision.js.
• 🟡 (12:55) Planned formatting only intended controller files, regenerate/check parser, and rerun all checks.
• 🟡 (12:56) Formatted 8 Publish files: src/modules/ci-poller-input.js, publish-location.js, release-revision.js, tests ci-poller-input.js, publish-location.js, publish-workflow.js, release-revision.js, and src/publish/resolve-ci-poller-input.js.
• 🟡 (12:59) Full Craft tests passed: 61 files, 1,156 passed, 1 skipped, 1,157 total. Craft lint again had 0 errors and the same 7 unused-variable warnings. Formatting then found only src/__tests__/action.test.ts noncompliant.
• 🟡 (13:00) Assistant stated Craft suite/lint completed and planned to format src/__tests__/action.test.ts, rerun remaining Craft checks, then complete Publish verification.
• 🟡 (13:02) Formatted src/__tests__/action.test.ts; Craft formatting then passed and node build.mjs passed, with source-map upload skipped because SENTRY_AUTH_TOKEN was absent.
• 🟡 (13:04) Publish full tests again passed (9 files / 53 tests), ESLint passed, and Prettier reported all matched files formatted. Verification listed intended and pre-existing modified/untracked files; format invocation errored only for unsupported grammar file src/modules/publish-issue-title.peggy: “No parser could be inferred”.
• 🟡 (13:05) Assistant classified the .peggy formatting error as expected because Prettier lacks a Peggy parser; planned to exclude only that unsupported grammar, remove newline-only churn, then request final read-only review.
• 🟡 (13:07) Diff identified newline-only churn in src/modules/post-workflow-details.js and src/publish/inputs.js; both had only an added final newline. Modified Publish files also included .github/workflows/ci-poller.yml, .github/workflows/publish.yml, docs, package.json, parser-related modules/tests, and yarn.lock; new files included parser grammar/generated parser, location/revision resolvers, and CI-poller input resolver/tests.
• 🟡 (13:08) Assistant planned one workflow-level poller-integration regression and a final read-only review; stated newline-only src/modules/post-workflow-details.js and src/publish/inputs.js changes would be explicitly excluded from staging.
• 🟡 (13:09) Patch attempt to extend src/modules/__tests__/ci-poller-input.js failed because expected single-line assertion context did not match the formatted multiline assertion.
• 🟡 (13:12) ci-poller-input test fixture uses revision 7e5ca7ed5581552de066e2a8bc295b8306be38ac and Quick links containing toolkit compare/check-runs URLs; it verifies both compact title publish: getsentry/toolkit/cli@1.2.3 and legacy title publish: toolkit [workspace: "cli/v2"] @1.2.3 resolve to { repo: "getsentry/toolkit", revision: REVISION, version: "1.2.3" }.
• 🟡 (13:14) Updated src/modules/__tests__/ci-poller-input.js; formatted it; regenerated parser check passed; targeted ci-poller-input.js and release-revision.js tests passed (2 files / 12 tests); Publish ESLint passed.
• 🟡 (13:18) Assistant reported all review-blocker regressions passing and requested one final fresh read-only review of exact current worktrees before preparing commits.