Dashboard › publish › Distillation
8351cd62-5cc2-4fe1-b970-df172cf2a15d["lore_tm_v1_Qv3RcCffPUGroy-y9AlnwumVx4wYqtZvwHYVaBiedns","lore_tm_v1_lMwVpFyt4VbKDVklne31R-3wN4Vd9chVUJHtX0ZeGyw","lore_tm_v1_GmbIKSt1l2KS9ypxvEtIdvjiETlafKArLhGgl9XK4X8","lore_tm_v1_QAuzNPvq1dQ34eg74nfeVifYKPyIbFbsHIYWEYus2fE","lore_tm_v1_bk76BfVN97nKZV0Q_8dCwTDB1VzGcq16ytYvVkXj9BE"]
Date: Aug 27, 2026
ses_fbb25722bffe6VcAZUCaO5Vva8 (“Adversarial workflow review”) completed but returned an empty <task_result> with no findings or report..github/workflows/ci-poller.yml, .github/workflows/publish.yml, AGENTS.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js; untracked files/directories listed: .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/, src/publish/authorize-approval.js, and src/publish/validate-approval-attestation.js.yarn vitest run succeeded: 9 test files passed and 40 tests passed. Passing files/counts: src/modules/__tests__/approval-attestation.js (3), src/publish/__tests__/validate-approval-attestation.js (4), src/modules/__tests__/update-issue.js (5), src/publish/__tests__/authorize-approval.js (3), src/modules/__tests__/process-end-state.js (4), src/modules/__tests__/approval-authorizer.js (14), src/modules/__tests__/post-workflow-details.js (1), src/modules/__tests__/details-from-context.js (4), and src/libs/__tests__/github.js (2). Vitest v4.0.17 duration was 1.31s; Yarn completed in 1.80s.prettier --write src --check .github/workflows/publish.yml .github/workflows/ci-poller.yml src/modules/details-from-context.js src/modules/approval-attestation.js src/modules/approval-authorizer.js src/modules/__tests__/approval-attestation.js src/modules/__tests__/approval-authorizer.js src/publish/authorize-approval.js src/publish/validate-approval-attestation.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/validate-approval-attestation.js succeeded; all matched files used Prettier code style.yarn eslint src .github --ignore-pattern '!.github' failed with 1 error and 0 warnings: .github/workflows/cocoapods-keepalive.yml line 1 column 7 violates yml/plain-scalar (“Must use plain style scalar”); ESLint reported that the error is potentially fixable with --fix. This unrelated lint failure caused exit code 1..github/workflows/publish.yml lines 1–340. It triggers on issue labeled events, uses concurrency group ${{ github.event.issue.title }} with cancel-in-progress: false, and has permissions contents: read, issues: write, and packages: write.waiting-for-ci workflow-job details in .github/workflows/publish.yml: it runs on ubuntu-latest, environment production, when the labeled event is accepted, the issue is open, and the title starts publish: ; it checks out via actions/checkout@v6 with persist-credentials: false.waiting-for-ci authorization flow: it creates an internal-app token using actions/create-github-app-token@v3, vars.SENTRY_INTERNAL_APP_ID, and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY; separately attempts a getsentry-wide release-bot token with vars.SENTRY_RELEASE_BOT_CLIENT_ID, secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY, owner: getsentry, and continue-on-error: true.Authorize approval step details: node src/publish/authorize-approval.js runs with continue-on-error: true, APPROVAL_TOKEN=${{ steps.release-token.outputs.token }}, APPROVAL_ACTOR=${{ github.actor }}, APPROVAL_ISSUE_NUMBER=${{ github.event.issue.number }}, APPROVAL_ISSUE_REPOSITORY=${{ github.repository }}, and APPROVAL_ISSUE_TITLE=${{ github.event.issue.title }}.authorized == 'true', gh issue comment writes ${{ steps.authorization.outputs.approval_attestation }} using GH_TOKEN=${{ github.token }}; node src/publish/validate-approval-attestation.js then runs with continue-on-error: true, APPROVAL_TOKEN=${{ github.token }}, APPROVAL_ATTESTATION_AUTHOR=github-actions[bot], issue number/repository/title, and only if the attestation step succeeded..github/workflows/publish.yml removes the accepted label, comments “Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue.”, and exits 1.Mark ci-pending behavior: after valid approval, it uses the internal-app token to idempotently remove ci-failed and ci-ready and add ci-pending; removing ci-ready ensures a later re-add produces a fresh labeled event after a retry following publish failure.GH_TOKEN=${{ github.token }}, it comments either “Retrying — CI was previously failed. Checking CI status now.” if the issue previously had ci-failed, or “Approved. Checking CI status on the release branch. Publishing will start automatically when CI passes.”.github/workflows/publish.yml best-effort creates a dedicated CI_POLLER_APP_CLIENT_ID / CI_POLLER_APP_PRIVATE_KEY app token because sentry-internal-app lacks actions_variables:write; on success it runs gh variable set CI_POLLER_HAS_PENDING -R "$GITHUB_REPOSITORY" -b "true"..github/workflows/publish.yml runs gh workflow run ci-poller.yml -R "$GITHUB_REPOSITORY" with the internal-app token; its comments state that GITHUB_TOKEN-originated workflow_dispatch events are suppressed.publish job, named Publish a new version, runs on ubuntu-latest in environment production, has timeout-minutes: 90, and only runs for open issues on a ci-ready label event when labels include both accepted and ci-ready and exclude ci-pending and ci-failed.ci-ready after checking CI; waiting-for-ci removes any existing ci-ready first, so a fresh ci-ready labeled event is guaranteed on the happy path and triggers publishing.publish job revalidates approval before publishing via node .__publish__/src/publish/validate-approval-attestation.js, with continue-on-error: true, APPROVAL_TOKEN=${{ github.token }}, APPROVAL_ATTESTATION_AUTHOR=github-actions[bot], and the current issue number/repository/title; on failure it removes accepted, posts the same invalid-or-unverifiable approval comment, and exits 1..__publish__ with actions/checkout@v6 and persist-credentials: false; sets up Node 24 through actions/setup-node@v6; caches Yarn using .__publish__/yarn.lock; installs dependencies with yarn install --cwd ".__publish__"; parses inputs through node .__publish__/src/publish/inputs.js; and posts workflow details through node .__publish__/src/publish/post-workflow-details.js.sentry-migr8 uses tmp-merge-target; sentry-javascript uses v10, v9, v8, v7, or master; sentry-python uses alpha; and sentry-wizard uses 1.x. The target-repository checkout uses getsentry/${{ fromJSON(steps.inputs.outputs.result).repo }}, release-bot token authentication, fetch-depth: 0, and optional target_repo_branch.Set targets takes CRAFT_PUBLISH_REPO, CRAFT_PUBLISH_PATH, CRAFT_PUBLISH_VERSION, and CRAFT_PUBLISH_TARGETS_JSON; creates an “already published” JSON payload; derives canonical Craft-container cwd under /github/workspace/__repo__; hashes it with sha1sum | cut -c1-12; sanitizes owner/repo/version; and writes publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${version_sanitised}.json under $GITHUB_WORKSPACE/.craft-state/craft, outside __repo__/, preventing repository contents from pre-populating Craft state.docker://getsentry/craft:latest runs /bin/bash -e -c, exports HOME=/root, changes to __repo__/${{ fromJSON(steps.inputs.outputs.result).path }}, and executes craft publish ${{ fromJSON(steps.inputs.outputs.result).version }}.