Dashboard › publish › Distillation
868dafc6-261f-4310-acf9-2913b6143a7f["lore_tm_v1_hbpUBLnByjJlhdBCgJa7txG1nvYec37cn1XCtoN5jV4","lore_tm_v1_iiT5InY5uT6Arl1F9ZUWY0os3_2DXDr-cDhEWrEY2Js","lore_tm_v1_JThcq1kaomv84EB9ptS3iiu0CcTAX90z0n8WyFmnl3I","lore_tm_v1_GCaZWYQmv4DqI9f7b8JgNeCQ1mm0zg6a0g8rU_yj04Q","lore_tm_v1_X-YnHUJh3Sg7C5S_dw6fTMPV7SK2xXxoPDMHnQySnmk","lore_tm_v1_zzzxLL9E02Bs93-iQVSztTTtF33JaCIb4MU0BGKJhu8","lore_tm_v1_iTd-iARoSN9BhBJaq9-AYEBIDgoj2T8lUuuJytL40WI","lore_tm_v1_O7qm3j3eES3O3gcYt6SR3-DuEg6OWRLbt8_Yi8-HwNc","lore_tm_v1_E2bZIW51F7LIDWbRXx5DCnh6sbvUIG_1pkHkxGo_1rI","lore_tm_v1_vREo3QEh8m9I65HSejU-bMH8fsDNGWXTGIpKMr7QQrE","lore_tm_v1_7yyHiKFQsFBQ_ZA1FDdX17PcvuQfVYhD0tfIBypbhl0","lore_tm_v1_5yUyIexznOLTyKBp6emsS3OSDpvbfYIUoBx_psclfXg","lore_tm_v1_QVgWhOUCMTO8hsGJLaKJKI-iv0IpCPEDzWJj_hihJHw","lore_tm_v1_saIgy_WOxR54RW1X1ylKnqADZd1Mb7U3IZEyPkSHyR4","lore_tm_v1_yIamVoueH-k6ZIKq1Fdb2LnM2YZ0iTktCbCY9h6KEog","lore_tm_v1_u0t-MIb97PqjcEevS3nNmMSrOavubwaG6c3bcb89MyI","lore_tm_v1_sXr1rSwOWNmKnrgVtGiWq1MlFvUCzC3KUiqKN5DzyEY"]
Date: Sep 9, 2026
file:line and test evidence, ending exactly MERGE or DO-NOT-MERGE; or a response beginning BLOCKED, naming the exact tool/error, and ending exactly DO-NOT-MERGE.yarn vitest run --printConsoleTrace completed successfully under Vitest v4.0.17 in /home/byk/Code/getsentry/publish: 16 test files passed, 84 tests passed, 0 failed; duration 2.78s (transform 356ms, setup 0ms, import 1.95s, tests 430ms, environment 9ms), with Yarn completing in 3.77s.src/publish/__tests__/current-accepted-event.js (2), src/publish/__tests__/validate-approval-attestation.js (9), src/modules/__tests__/update-issue.js (6), src/publish/__tests__/authorize-approval.js (7), src/modules/__tests__/post-workflow-details.js (1), src/modules/__tests__/approval-attestation.js (5), src/modules/__tests__/process-end-state.js (4), src/publish/__tests__/workflow-action-pinning.js (16), src/publish/__tests__/record-auto-approval-attestation.js (2), src/modules/__tests__/approval-authorizer.js (15), src/modules/__tests__/details-from-context.js (5), src/publish/__tests__/publish-workflow.js (2), src/publish/__tests__/record-ci-ready-attestation.js (3), src/publish/__tests__/ci-poller-workflow.js (3), src/libs/__tests__/github.js (2), and src/publish/__tests__/auto-approval-workflow.js (2).yarn eslint src .github --ignore-pattern '!.github' completed successfully with no lint errors in 1.89s.src/modules/details-from-context.js:4-19 defines target-section parsing regexes and PUBLISH_TITLE_REGEX = /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/; parsePublishTitle(title) at lines 21-23 returns matched groups or null.src/modules/details-from-context.js:25-65 validates context.payload.issue, rejects invalid titles, maps a dry-run label to dry_run: "1" (otherwise ""), defaults the parsed path to ".", parses Merge target: ..., extracts checked targets, and returns { ...titleMatch, dry_run, merge_target, path, targets }.src/modules/update-issue.js:7-35 implements updateTargets(): it uses ${process.env.GITHUB_WORKSPACE}/__repo__/.craft-publish-${version}.json, returns when that file is absent, concurrently fetches the issue and parses the UTF-8 Craft state JSON, transforms the body, and updates the issue.src/modules/update-issue.js:37-60 implements transformIssueBody(craftState, issueBody): it rewrites declared target checkboxes based on craftState.published[targetId], appends any unlisted targets, and preserves the generated targets section via TARGETS_SECTION_PARSER_REGEX and TARGETS_PARSER_REGEX.src/modules/update-issue.js:62-79 implements updateIssue() with a Promise.all() that conditionally runs updateTargets() when inputs?.version is truthy and always removes the accepted label.src/publish/update-issue.js:5-19 gets GitHub context and a token-backed Octokit client, parses PUBLISH_ARGS when present, warns Could not parse publish inputs; skipping target update on malformed JSON, and awaits updateIssue({ context, octokit, inputs }); lines 21-28 run main() only when invoked directly and convert rejection into logged output plus process.exitCode = 1.src/publish/post-result.js:5-11 initializes GitHub context and Octokit at module load, parses process.env.PUBLISH_ARGS, reads the first CLI argument as status, and invokes processEndState({ context, octokit, inputs, status }) without awaiting it or attaching a rejection handler..github/workflows/publish.yml invokes publishing scripts at exact lines: post-workflow-details.js at line 240, update-issue.js at line 414, and post-result.js cancelled, failure, and success at lines 421, 428, and 435 respectively..github/workflows/publish.yml:409-435 runs “Update completed targets and remove label” when ${{ cancelled() || failure() }}, “Inform about cancellation” when ${{ cancelled() }}, “Inform about failure” when ${{ failure() }}, and “Close on success” when ${{ success() }}; each receives PUBLISH_ARGS: ${{ steps.inputs.outputs.result }} and GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}..github/workflows/publish.yml:390-407 exposes publishing environment entries HEX_API_KEY, TWINE_USERNAME: __token__, TWINE_PASSWORD, TWINE_VERBOSE: "1", NPM_TOKEN, GEM_HOST_API_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, NUGET_API_TOKEN, POWERSHELL_API_KEY, GPG_PRIVATE_KEY, GPG_PASSPHRASE, OSSRH_USERNAME, OSSRH_PASSWORD, PUBDEV_ACCESS_TOKEN, PUBDEV_REFRESH_TOKEN, VERCEL_ORG_ID, and VERCEL_TOKEN.src/publish/inputs.js:5-12 calls detailsFromContext({ context: github.context }), writes the result through core.setOutput("result", result), and invokes inputs() at module load without attaching an error handler.src/modules/post-workflow-details.js:1-16 fetches the current workflow run using context.repo and context.runId, then creates issue comment Publishing: [run#${run_id}](${workflowInfo.html_url}).src/modules/process-end-state.js:3-38 derives release and workflow details, fetches the workflow run, posts an issue comment, closes the issue only for status === "success", and then awaits Sentry session reporting.src/modules/process-end-state.js:49-67 maps statuses to issue comments: failure → Failed to publish plus run logs and branch-deletion link; cancelled → Publish workflow cancelled plus the same links; success → Published successfully: [run#${run_id}](...); unknown statuses throw Unknown status: '${status}'.src/modules/process-end-state.js:70-91 initializes Sentry with process.env.SENTRY_DSN and release ${details.repo}@${details.version}, tags repository, records release context containing issue_number and inputs, captures the mapped message/severity, starts and ends a session, and awaits Sentry.close().src/modules/process-end-state.js:94-116 maps failure to message Release failed: ${repo}, severity error, session status crashed; cancelled to Release cancelled: ${repo}, severity warn, status crashed; and success to Release succeeded: ${repo}, severity info, status ok.src/publish/post-workflow-details.js:1-8 initializes GitHub context and token-backed Octokit at module load and invokes postWorkflowDetails({ context, octokit }) without awaiting it or attaching a rejection handler.src/libs/github.js:7-15 implements getGitHubToken(): absent GITHUB_TOKEN throws No "GITHUB_TOKEN" environment variable found. Please ensure the workflow is configured correctly; otherwise it returns process.env.GITHUB_TOKEN.src/publish/__tests__/authorize-approval.js:45-235 contains 7 entry-point tests covering: exact auto-approval allowlist paths; successful authorization after a write permission lookup; rejection of requester self-approval; authorization of an allowlisted automated request carrying an attestation; rejection when the automated request lacks proof; rejection of direct approval by sentry-release-bot[bot] without making a fetch; and fail-closed behavior when GitHub permission lookup returns HTTP 404.src/publish/__tests__/authorize-approval.js:215-235 verifies a GitHub 404 rejects with exact error Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404, does not log inside main(), and does not append authorization output.src/modules/__tests__/approval-attestation.js:21-173 contains 5 tests covering: matching the latest accepted-label event to a trusted approval attestation; converting numeric GitHub event ID 29503999078 to string "29503999078"; matching CI-ready attestations to the current accepted event while rejecting mismatched event or actor; rejecting malformed/stale/wrong-author attestations; and rejecting an approval attestation after the issue’s dry-run state changes.