Distillation

Date: Aug 25, 2026

• 🟡 [requested-review] (16:25) User requested a rigorous, read-only adversarial review of CURRENT uncommitted changes in /home/byk/Code/getsentry/craft-workspace-action-propagation against origin/master; explicitly instructed not to modify files. Required inspection of source/tests/diff and only prioritized findings with precise file:line evidence, a PASS/FAIL table for compatibility, security, lifecycle, and tests, ending in MERGE or DO-NOT-MERGE; requested explicit statement if no blocking findings exist.
• 🟡 (16:25) Review scope requested: workspace propagation through action.yml and reusable release workflow; exact legacy compatibility; human-readable/lossless issue identity; selected target list; early validation before any git/Craft prepare side effect; workspace option parsing and shell injection; Unicode/control edge cases; tests and workflow behavior.
• 🟡 (16:25) User stated prior reviews found an option-like workspace injection and a Unicode line-separator validation gap, and requested verification that these exact defects are fixed.
• 🟢 (16:25) Repository directory /home/byk/Code/getsentry/craft-workspace-action-propagation contains 32 listed entries including .github/, action.yml, dist/, package.json, pnpm-lock.yaml, src/, and vitest.config.mts.
• 🟢 (16:26) Git working tree at /home/byk/Code/getsentry/craft-workspace-action-propagation: modified .github/workflows/release.yml and action.yml; untracked src/__tests__/action.test.ts.
• 🟢 (16:26) Current branch is feat/workspace-action-propagation; HEAD, origin/master, and origin/HEAD all resolve to 21270a1d12a60b461c51fba93bd076b90d9cf4af (feat(config): add release workspaces).
• 🟢 (16:26) Diff stat against origin/master: .github/workflows/release.yml has 9 additions; action.yml has 30 additions and 3 deletions; 36 insertions and 3 deletions total. The untracked src/__tests__/action.test.ts is not represented in that diff stat.
• 🔴 (16:26) User/project package-management preference: always use pnpm; never use npm or yarn.
• 🔴 (16:26) Project Node.js version is managed by Volta, currently v22.12.0; dependencies should be installed with pnpm install --frozen-lockfile.
• 🟡 (16:26) .github/workflows/release.yml adds optional workspace input to both workflow_dispatch (.github/workflows/release.yml:15-17) and reusable workflow_call (.github/workflows/release.yml:57-60), described as “Named Craft release workspace to prepare and publish.”
• 🟡 (16:26) .github/workflows/release.yml:123-132 forwards workspace: ${{ github.event.inputs.workspace }} to local uses: ./ Craft action for dogfooding; .github/workflows/release.yml:135-151 forwards workspace: ${{ inputs.workspace }} to external getsentry/craft@v2 action.
• 🟡 (16:26) New test file src/__tests__/action.test.ts parses action.yml with js-yaml, locates named composite-action steps, and executes each selected step via spawnSync('bash', ['-e', '-c', getActionStep(stepName)]) in an isolated temporary environment (src/__tests__/action.test.ts:21-31, 36-79).
• 🟡 (16:26) src/__tests__/action.test.ts:47-56 creates executable fake craft and git commands. Fake craft appends its argv as "$*" to $CRAFT_CALLS and emits ["github"] when $1 == "targets"; fake git appends argv as "$*" to $GIT_CALLS.
• 🟡 (16:26) src/__tests__/action.test.ts:88-100 tests option-looking workspace --config-from=untrusted: runs action steps named Craft Prepare and Read Craft Targets, expects success, and asserts exact fake-Craft calls prepare --workspace=--config-from=untrusted and targets --workspace=--config-from=untrusted.
• 🟡 (16:26) src/__tests__/action.test.ts:102-110 tests Unicode line-separator workspace cli\u2028next: runs Craft Prepare, expects exit status 1, and asserts no fake Git or Craft calls, testing early rejection before either side effect.