Distillation

Date: Sep 8, 2026

• 🔴 [requested-security-review] (10:09) User requested a fresh, independent, read-only correctness and security review of the exact current working tree at /home/byk/Code/getsentry/publish. Scope: verify remediation for prior finding that workflow_dispatch checked out untrusted refs before app tokens; review all current changes concerning approval attestations, ci-poller trusted checkout, and failure cleanup. User instructed not to edit files; inspect git diff and relevant code/tests; report evidence with current file:line references; classify every point PASS, CONCERN, or MUST-FIX; end exactly MERGE or DO-NOT-MERGE; if blocked, begin BLOCKED and name the tool/error.
• 🔴 (10:09) User directive: never return an empty review.
• 🟡 (10:09) Tool access to /home/byk/Code/getsentry/publish/.jj failed with File not found: /home/byk/Code/getsentry/publish/.jj.
• 🟡 (10:09) Current working tree modifications reported: .github/workflows/ci-poller.yml, .github/workflows/publish.yml, AGENTS.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js.
• 🟡 (10:09) Current untracked files/directories reported: .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js.
• 🟡 (10:09) Diff statistic reported 15 tracked files changed with 375 insertions and 61 deletions; untracked approval-attestation/authorizer and publish files were separately listed and not included in that tracked diff statistic.
• 🔴 (10:10) User directive: Always run trusted code.
• 🔴 (10:10) User directive: Never move a release to ci-ready after it changes.
• 🔴 (10:10) User stated that a renamed or re-approved issue never reaches ci-ready.
• 🔴 (10:10) User stated change replace deprecated trimRight() with trimEnd() (#9012).
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:13-15 permissions are contents: read and issues: write.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:29-34 checks out Publish code using actions/checkout@v6 at ref: ${{ github.event.repository.default_branch }} with persist-credentials: false; comment at line 32 says workflow_dispatch can target any ref. Always run trusted code.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:39-56 creates two GitHub App tokens: steps.token uses vars.SENTRY_INTERNAL_APP_ID and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY; steps.release-token uses vars.SENTRY_RELEASE_BOT_CLIENT_ID, secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY, and owner: getsentry.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:58-79 uses GH_TOKEN: ${{ steps.token.outputs.token }} for local issue-label changes and RELEASE_TOKEN: ${{ steps.release-token.outputs.token }} for cross-repository calls; defines gh_api_release() that invokes GH_TOKEN="$RELEASE_TOKEN" gh api "$@", emits ::warning::gh api failed: $output on failure, and returns the original nonzero exit status.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:80-94 polls open issues carrying both ci-pending and accepted labels, up to 200, requesting number,title,labels,body; exits successfully when zero qualifying issues are found.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:102-115 obtains a current accepted-label event through node src/publish/current-accepted-event.js with APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY; on failure it removes ci-pending and accepted, comments Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue., then continues.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:116-133 parses .actor and .eventId from the accepted event, then validates an approval attestation with node src/publish/validate-approval-attestation.js, passing APPROVAL_ATTESTATION_AUTHOR="github-actions[bot]", the issue number/repository/title, EXPECTED_ACCEPTED_ACTOR, and EXPECTED_ACCEPTED_EVENT_ID; validation failure removes ci-pending and accepted, posts the invalid-approval comment, then continues.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:136-149 calls parsePublishTitle from ./src/modules/details-from-context.js, prefixes the parsed repository with getsentry/, and skips an issue if the repository or version cannot be parsed.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:151-198 extracts a 40-character lowercase hexadecimal commit SHA from an issue-body commit/{SHA}/checks URL; resolves branch name from repos/${repo}/commits/${issue_sha}/check-suites, resolves branch HEAD via repos/${repo}/git/ref/heads/${branch}, falls back to issue_sha on API/lookup failure, and updates the issue body by replacing issue_sha with the branch-head SHA when the branch moved.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:202-251 retrieves combined commit status and paginated check runs using the release-bot token. CI readiness requires at least one check run or commit status; a successful commit status or zero statuses; zero pending check runs; and zero check runs concluded other than success, neutral, or skipped.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:253-270 revalidates the approval attestation after CI becomes ready, using the originally bound accepted actor/event ID; failure is treated as approval changing during CI and removes ci-pending and accepted, posts the invalid-approval comment, and continues.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:272-316 records CI-ready proof using node src/publish/record-ci-ready-attestation.js with the expected accepted actor/event ID; requires output beginning ci_ready_attestation=; posts the proof comment using GH_TOKEN="${{ github.token }}"; any proof-generation, output-format, or comment-posting failure removes ci-pending and accepted, posts the invalid-approval comment, and continues.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:318-340 validates the approval attestation a third time immediately before promotion; if validation fails, it removes ci-pending and accepted and does not add ci-ready; if validation succeeds, it removes ci-pending and adds ci-ready.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:342-345 comments CI checks passed for ${repo}@${version}. Publishing is starting now. after adding ci-ready.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:347-372 handles completed failed checks by swapping ci-pending to ci-failed, removing accepted, listing failed check names, and instructing users to re-add accepted after fixing CI; handles commit-status failure with no failed check runs similarly, listing failed status contexts and URLs when available.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:376-417 runs failure cleanup with if: always(): queries for remaining open issues with both ci-pending and accepted, then creates steps.poller-token using vars.CI_POLLER_APP_CLIENT_ID and secrets.CI_POLLER_APP_PRIVATE_KEY; if token creation succeeds, it sets repository variable CI_POLLER_HAS_PENDING to false when no matching issues remain or true otherwise.
• 🟡 (10:10) Current .github/workflows/ci-poller.yml:419-442 self-dispatches ci-poller.yml when pending issues remain and both steps.token and steps.remaining succeeded; uses ATTEMPT: ${{ github.event.inputs.attempt || '0' }}, increments it, caps self-dispatch at 60 attempts, then relies on cron fallback.
• 🟡 (10:10) Recent commit history shown: 83d210b build(deps): bump js-yaml from 4.3.0 to 4.3.1 (#9174); 5268a23 feat: Add Vercel creds; 92eba3f feat: Add CLOUDFLARE_API_TOKEN (#9122); ada6147 build(deps): bump js-yaml from 4.1.1 to 4.3.0 (#8731); a4f961a fix: Add GITHUB_API_TOKEN for commit-on-git target (#9069); bf10f82 build(deps): bump postcss from 8.5.15 to 8.5.23 (#9017); 837edc0 docs: fix possessive apostrophe placement (#9015); 4da4a25 chore: replace deprecated trimRight() with trimEnd() (#9012); 22fd64d docs: fix typo 'acces' -> 'access' (#9011); 24b9ce3 docs: fix missing article in rfc.md (#9014).