Distillation

Date: Aug 27, 2026

• 🟡 (16:38) src/modules/approval-attestation.js initially defined ATTESTATION_PREFIX = "<!-- publish-approval " and ATTESTATION_SUFFIX = " -->"; createApprovalAttestation({ actor, eventId, title }) base64url-encodes JSON { actor, eventId: String(eventId), title } inside an HTML comment.
• 🟡 (16:38) src/modules/approval-attestation.js initially defined parseApprovalAttestation(body), returning null if the prefix/suffix is absent, JSON/base64url decoding fails, or decoded actor, eventId, or title is not a string.
• 🟡 (16:38) src/modules/approval-attestation.js initially defined currentAcceptedEvent(events): filters events whose label name is accepted, selects the greatest event ID using BigInt, requires event.event === "labeled" and event.actor?.login, and returns { actor, eventId: String(event.id) }; otherwise returns null.
• 🟡 (16:38) src/modules/approval-attestation.js initially defined hasApprovalAttestation({ comments, event, title, attestationAuthor }): accepts an attestation only when the comment author matches attestationAuthor and decoded actor, eventId, and title exactly match the current event and title.
• 🔴 (16:38) [enforced-workflow] User directed: “Always allow workflow_dispatch for manual recovery.”
• 🟡 (16:43) Assistant stated the existing untracked attestation module was scaffolding not yet wired into either workflow; planned to complete an approach where automatic approvals receive a trusted provenance record, authorized labels receive an event-bound approval record, and the poller and publisher revalidate it against the live issue.
• 🟡 (16:48) src/modules/__tests__/approval-authorizer.js was modified and src/modules/__tests__/approval-attestation.js was added.
• 🟡 (16:48) Assistant stated the authorization record binds the exact accepted label event, actor, and title; a later label re-addition or title mutation invalidates it, causing CI and publication to stop and remove accepted.
• 🟡 (16:50) src/modules/approval-attestation.js, src/modules/__tests__/approval-attestation.js, and src/publish/authorize-approval.js were modified; src/publish/validate-approval-attestation.js was added.
• 🟡 (16:51) Assistant stated approval will be rechecked before CI handoff and before publication; title changes and new accepted events invalidate approval.
• 🟡 (16:52) Implementation task list: 1. “Map approval flow against final review findings” — in progress, high priority; 2. “Implement immutable approval attestation checks” — pending, high priority; 3. “Add adversarial regression coverage” — pending, high priority; 4. “Run validation and final reviews” — pending, high priority.
• 🟡 (16:54) src/modules/approval-attestation.js was hardened: currentAcceptedEvent(events) now filters only events with event.event === "labeled", event.label?.name === "accepted", typeof event.id === "string", and event.actor?.login.
• 🟡 (16:54) src/modules/approval-attestation.js was hardened: the BigInt reduction and return in currentAcceptedEvent(events) are wrapped in try/catch, returning null for invalid/non-BigInt event IDs rather than throwing.
• 🔴 (16:56) User stated that the poller always adds ci-ready.
• 🟡 (16:59) src/publish/authorize-approval.js imports createApprovalAttestation and currentAcceptedEvent from ../modules/approval-attestation.js, and authorizeApproval from ../modules/approval-authorizer.js.
• 🟡 (16:59) src/publish/authorize-approval.js defines getAutoApprovedRepositories(), reading auto-approve-repos.txt as UTF-8, splitting by /\r?\n/, filtering empty lines, and returning a Set.
• 🟡 (16:59) src/publish/authorize-approval.js defines getPermission({ owner, repository, username }), calling repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/collaborators/${encodeURIComponent(username)}/permission; non-OK responses throw Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ${response.status}.
• 🟡 (16:59) src/publish/authorize-approval.js defines getGitHubResponse(path), fetching https://api.github.com/${path} with headers Accept: "application/vnd.github+json", Authorization: Bearer ${process.env.APPROVAL_TOKEN}, and X-GitHub-Api-Version: "2026-03-10".
• 🟡 (16:59) src/publish/authorize-approval.js defines getIssue({ repository, issueNumber }) for repos/${repository}/issues/${issueNumber} and getIssueEvents({ repository, issueNumber }), which paginates repos/${repository}/issues/${issueNumber}/events?per_page=100&page=${page} until a page has fewer than 100 events.
• 🟡 (16:59) src/publish/authorize-approval.js main() requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY; missing values throw explicit errors.
• 🟡 (16:59) src/publish/authorize-approval.js calls authorizeApproval({ actor: process.env.APPROVAL_ACTOR, issueTitle: process.env.APPROVAL_ISSUE_TITLE, getPermission, autoApprovedRepositories: getAutoApprovedRepositories() }); if unauthorized, it appends authorized=false\n to GITHUB_OUTPUT.
• 🟡 (16:59) For authorized requests, src/publish/authorize-approval.js concurrently retrieves the live issue title and all issue events, finds currentAcceptedEvent(events), and rejects authorization (authorized=false) if the live title differs from APPROVAL_ISSUE_TITLE, no valid accepted event exists, or the accepted-event actor differs from APPROVAL_ACTOR.
• 🟡 (16:59) On successful live validation, src/publish/authorize-approval.js creates an approval attestation bound to event.actor, event.eventId, and live title, then appends authorized=true\napproval_attestation=${attestation}\n to GITHUB_OUTPUT.
• 🟡 (16:59) src/publish/authorize-approval.js executes main() only when require.main === module; errors are logged via console.error(error) and set process.exitCode = 1; exports are getAutoApprovedRepositories, getGitHubResponse, getIssue, getIssueEvents, getPermission, and main.
• 🟡 (17:03) Repository search found 9 matches across .github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, and .github/workflows/publish.yml; all three use vars.SENTRY_INTERNAL_APP_ID and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY, while publish.yml additionally contains Authorize approval, node src/publish/authorize-approval.js, and Reject unauthorized approval or failed authorization.