Distillation

Date: Sep 9, 2026

• 🔴 (23:57) User directed that review work in /home/byk/Code/getsentry/publish must be read-only: never edit files.
• 🔴 [requested-review] (23:57) User requested a very thorough review of the current worktree in /home/byk/Code/getsentry/publish, including changed and untracked files, for security/correctness regressions involving approval proofs, self-approval, live request/event binding, CI-ready behavior, the final Craft fence, failure cleanup, dispatch trust, and immutable references.
• 🔴 (23:57) User stated org-wide App secrets are an accepted pre-existing risk unless the current diff worsens their exposure.
• 🔴 [requested-tests] (23:57) User required running tests, lint, and git diff --check.
• 🔴 (23:57) User required a non-empty review report with exact file:line evidence, ending exactly with MERGE or DO-NOT-MERGE; if blocked, the report must state the exact blocker and end with DO-NOT-MERGE.
• 🟡 (23:57) Repository state was main...origin/main [behind 1].
• 🟡 (23:57) Modified files reported by Git: .github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, docs/key_rotation_vault_changes.md, docs/rfc.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js.
• 🟡 (23:57) Untracked files reported by Git: .github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/authorize-approval.js, src/publish/__tests__/auto-approval-workflow.js, src/publish/__tests__/ci-poller-workflow.js, src/publish/__tests__/current-accepted-event.js, src/publish/__tests__/publish-workflow.js, src/publish/__tests__/record-auto-approval-attestation.js, src/publish/__tests__/record-ci-ready-attestation.js, src/publish/__tests__/validate-approval-attestation.js, src/publish/__tests__/workflow-action-pinning.js, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js.
• 🟡 (23:57) Tracked diff summary covered 21 files with 499 insertions and 117 deletions.
• 🔴 (23:58) User stated repository secrets must never be used by the .github/workflows/ci-poller-dispatch.yml workflow; protected production environment secrets enforce that an arbitrarily dispatched ref cannot add them.
• 🟡 (23:58) .github/workflows/ci-poller-dispatch.yml defines name: Run CI Status Poller, triggers via workflow_dispatch, sets permissions: {}, uses a dispatch job on ubuntu-latest, binds it to environment: production, and runs only ":".
• 🔴 (23:58) User stated workflows must always run trusted code; because workflow_dispatch can target any ref, the CI poller checkout is intended to use trusted code rather than the dispatched ref.
• 🔴 (23:58) User stated a release must never be moved to ci-ready after it changes; every poll cycle must bind to the current accepted-label event before inspecting CI.
• 🔴 (23:58) User stated a renamed or re-approved issue never reaches ci-ready.
• 🟡 (23:58) .github/workflows/auto-approve.yml runs for newly opened issues only when the actor is sentry-release-bot[bot] or getsantry[bot] and the title begins with publish: . It checks out auto-approve-repos.txt, creates an App token using vars.SENTRY_INTERNAL_APP_ID and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY, runs node src/publish/record-auto-approval-attestation.js, posts the generated attestation with ${{ github.token }}, parses the repository from the issue title, and adds the accepted label with the App token only if the repository exactly matches a line in auto-approve-repos.txt.
• 🟡 (23:58) .github/workflows/auto-approve.yml pins actions to immutable commit references: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 and actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1.
• 🟡 (23:58) .github/workflows/test.yml runs on pushes to main and pull requests with contents: read, uses Node 24, runs yarn install --frozen-lockfile on cache miss, then runs yarn test; actions are pinned to actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38, and actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830.
• 🟡 (23:58) .github/workflows/cocoapods-keepalive.yml runs daily at midnight UTC (0 0 * * *) on macos-15 in the production environment, exposes secrets.COCOAPODS_TRUNK_TOKEN as COCOAPODS_TRUNK_TOKEN, installs CocoaPods, prints its version, and runs pod trunk me > /dev/null 2>&1; its comment states CocoaPods sessions currently expire after 3 days of inactivity (VALIDITY_LENGTH).