Distillation

🔴 (18:34) User’s working repository is /home/byk/Code/getsentry/publish; directory contains 15 entries: .eslintrc.js, .git/, .github/, .gitignore, .lore.md, AGENTS.md, auto-approve-repos.txt, docs/, LICENSE, node_modules/, package.json, README.md, src/, vitest.config.js, yarn.lock. 🔴 (18:34) User showed repository HEAD/current commit as 83d210b29553ea6f4d97508821724a834c43856e. 🔴 (18:34) User’s working tree had 21 modified tracked files: .github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, docs/key_rotation_vault_changes.md, docs/rfc.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, src/publish/update-issue.js. 🔴 (18:34) User’s working tree had 20 untracked files: .github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/authorize-approval.js, src/publish/__tests__/auto-approval-workflow.js, src/publish/__tests__/ci-poller-workflow.js, src/publish/__tests__/current-accepted-event.js, src/publish/__tests__/publish-workflow.js, src/publish/__tests__/record-auto-approval-attestation.js, src/publish/__tests__/record-ci-ready-attestation.js, src/publish/__tests__/validate-approval-attestation.js, src/publish/__tests__/workflow-action-pinning.js, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, src/publish/validate-approval-attestation.js. 🔴 (18:35) Diff summary for the 21 tracked files was exactly 499 insertions and 117 deletions. 🔴 (18:36) User supplied checksum/output 8ca4aa7afcb6a1c171f695d488a06b8cf4d08436a414a3223a18b33a08db4fc6 -. 🔴 (18:37) User supplied SHA-256 checksums for all 20 untracked files: .github/workflows/ci-poller-dispatch.yml=570dcb023ae08f4fb8338923496a55bf1c2e012a944f9969650bc31feadd485c; .lore.md=3461658c70288911f3f6eb8be89c1b35ed1dfb5c5915c5c4c86f4824d14dbb55; src/modules/__tests__/approval-attestation.js=7b09762838a38df35f923c5abf900cb5627c6038bfa83900655ca5d76137a7b7; src/modules/__tests__/approval-authorizer.js=c6f64660b2fa5339b7b7936608ce90455518d5445c0ce3ff0298f1035e48a407; src/modules/approval-attestation.js=51898ad7a79e99d1a22a116a40953e5b52030a8e90c9eda5c46eb3ed3998b701; src/modules/approval-authorizer.js=c9ca690c7ca173c6cdc973e511dadb5479ff10cd958f9b0c4f10f83017e6ec55; src/publish/__tests__/authorize-approval.js=a4806a0195dcbe120845c401b555afd9b6e20281b48430fc2a2171f8a9bc56fb; src/publish/__tests__/auto-approval-workflow.js=e24b83d30238402ed9d79d6995f21e3d0ac39354e148f4ca77d2da1d43f64c2a; src/publish/__tests__/ci-poller-workflow.js=a549e01d0420a6c1d82f33d1416c304ef259f2228a391f2adb4068dc4a9dd07f; src/publish/__tests__/current-accepted-event.js=bf5e5eddd6ab87e0caf1497bda6f8948e1b403ccc543319966de949b85b1e545; src/publish/__tests__/publish-workflow.js=ae2d49aa0a56ce879081073ececc857d7d3870f09cee2c8ca722e0255f58da64; src/publish/__tests__/record-auto-approval-attestation.js=9b4d7bc1a8d6061e5f13eedf13fcbfda6c104880c5e8a4d2482b4939ac16dc0e; src/publish/__tests__/record-ci-ready-attestation.js=c1185ee6b13be4a2be575696511c297e0a5450f596198923e6601f634f1a99f5; src/publish/__tests__/validate-approval-attestation.js=a341596df1a5eb1bc0081e951ffda220ba3022f3163171ab8c05d4cbaf04ac02; src/publish/__tests__/workflow-action-pinning.js=f81aaf26af172b638b9ff9ef7c2eec036f0833dbe87d0b46c7e36c0c552c6e9a; src/publish/authorize-approval.js=7ced3d4b0d6137122942a8e3978a992ea20a30d0f12625ef9c04bf03d9bccb5a; src/publish/current-accepted-event.js=89327251626058674db523d8e541475bb9bf94cce2359adba06a85f99e359895; src/publish/record-auto-approval-attestation.js=dc1dee4b851b54efec8ab987fbc6e27210c5ed099b7094112b48511a9bfd9382; src/publish/record-ci-ready-attestation.js=ae06156794d4bb8b0559b1c5473d75b35bf1816960678c58e46f5f4c387dce3a; src/publish/validate-approval-attestation.js=943aacefbec471c91f264dca602f0a37199f7a29875cc41adaa2429828693fa7. 🔴 (18:38) User’s .github/workflows/auto-approve.yml runs on newly opened issues, only for actors sentry-release-bot[bot] or getsantry[bot] and titles beginning publish: ; it uses environment: production, checks out only auto-approve-repos.txt via sparse checkout, then executes node src/publish/record-auto-approval-attestation.js, posts the generated attestation with ${{ github.token }}, and adds accepted via the Sentry Internal App token when the parsed repository appears exactly in auto-approve-repos.txt. 🔴 (18:38) User directive/security invariant: “Always run trusted code.” .github/workflows/ci-poller.yml therefore checks out ${{ github.event.repository.default_branch }} with persist-credentials: false, including for recovery flows where workflow_dispatch could target an arbitrary ref. 🔴 (18:38) User directive/release invariant: “Never move a release to ci-ready after it changes.” The poller binds processing to the current accepted-label event using src/publish/current-accepted-event.js, validates with src/publish/validate-approval-attestation.js, and removes ci-pending plus accepted if the approval cannot be bound or validated. 🔴 (18:38) User directive/release invariant: a renamed or re-approved issue “never reaches ci-ready.” .github/workflows/ci-poller.yml revalidates approval after CI finishes, again while recording CI-ready proof through src/publish/record-ci-ready-attestation.js, and once more immediately before adding ci-ready; invalidated approvals lose ci-pending and accepted. 🔴 (18:38) User directive/security invariant for .github/workflows/ci-poller-dispatch.yml: repository secrets must “never be used by this workflow; protected environment secrets enforce” that arbitrary dispatched refs cannot add them. The workflow has permissions: {}, uses environment: production (which only permits deployments from main), and its only step is run: ":". 🔴 (18:38) User directive/workflow invariant: the poller “always adds ci-ready” after checking CI, including retry scenarios where waiting-for-ci first removes an existing ci-ready label so a fresh labeled event fires and triggers publishing. 🔴 (18:38) .github/workflows/ci-poller.yml triggers every 5 minutes (cron: "*/5 * * * *"), on repository_dispatch type ci-poller, and after completion of Run CI Status Poller; it gates scheduled work with CI_POLLER_HAS_PENDING == 'true', uses concurrency group ci-status-poller with cancel-in-progress: false, and only polls open issues carrying both ci-pending and accepted. 🔴 (18:38) The poller’s dispatch-attempt validation says attempts must be integers from 0 through 59 but implements regex ^(0|[1-5][0-9])$; the self-dispatch step increments with attempt=$((10#$ATTEMPT + 1)), stops when the incremented attempt is >= 60, and otherwise sends {event_type: "ci-poller", client_payload: {attempt: $attempt}}. 🔴 (18:38) The CI poller uses the Sentry Internal App token for label changes in the publish repository and a Sentry Release Bot token with owner: getsentry for cross-repository check-suites, status, check-run, and git-ref APIs because the internal app can return 404 for private repositories such as sentry-xbox, sentry-playstation, sentry-switch, and service-registry. 🔴 (18:38) CI-ready criteria in .github/workflows/ci-poller.yml: at least one check run or commit status must exist; combined commit status must be success or there must be zero statuses; all check runs must be completed; and unsuccessful check-run count must be zero. Check conclusions success, neutral, and skipped count as passing; failure, cancelled, timed_out, action_required, stale, and startup_failure count as unsuccessful. 🔴 (18:38) The poller resolves a release branch from the issue-body commit SHA’s first check suite, then resolves branch HEAD to account for bot pushes; API failures are non-fatal and fall back to the issue SHA. If branch HEAD changed, it updates the issue’s “View check runs” commit link before polling. 🔴 (18:38) On completed failing check runs, the poller swaps ci-pending to ci-failed, removes accepted, lists failed check names, and asks the author to re-add accepted after fixing CI. If check runs pass but commit statuses fail, it applies the same labels and lists failed/error status contexts with target URLs when available. 🔴 (18:38) The poller synchronizes CI_POLLER_HAS_PENDING after every run: sets it to "false" when no open issues have both ci-pending and accepted, otherwise ensures it is "true". It self-dispatches approximately every 30–60 seconds, capped at 60 attempts (approximately 30 minutes), with cron as fallback because the 5-minute GitHub cron may drift to 30–40 minutes under load. 🔴 (18:38) .github/workflows/publish.yml uses issue title as its concurrency group with cancel-in-progress: false. Adding accepted to an open publish: issue starts waiting-for-ci, which authorizes the actor’s effective role in the target repository via src/publish/authorize-approval.js, records and validates an approval attestation, resets labels by removing ci-failed and ci-ready and adding ci-pending, enables CI_POLLER_HAS_PENDING, and immediately sends repository dispatch ci-poller. 🔴 (18:38) .github/workflows/publish.yml rejects any failed, unauthorized, unrecorded, or invalid approval by removing accepted, commenting “Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue.”, and exiting with failure. 🔴 (18:38) The publish job fires only on a ci-ready label event for an open issue that simultaneously has accepted and ci-ready and lacks ci-pending and ci-failed; timeout is 90 minutes, Node version is 24, and approval validation requires REQUIRE_CI_READY_ATTESTATION: "true" both before setup and immediately before publishing. 🔴 (18:38) The publish workflow uses docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b and executes craft publish from __repo__/${{ fromJSON(steps.inputs.outputs.result).path }}. Craft state is placed outside target repository contents at $GITHUB_WORKSPACE/.craft-state/craft, exposed inside the container through XDG_STATE_HOME: /github/workspace/.craft-state; state filenames include sanitized owner, repository, version, and the first 12 characters of the SHA-1 hash of the container working directory. 🔴 (18:38) Explicit alternate protected target branches in .github/workflows/publish.yml: sentry-migr8 → tmp-merge-target; sentry-javascript → v10, v9, v8, v7, or master; sentry-python → alpha; sentry-wizard → 1.x. 🔴 (18:38) Publish workflow references these credential/configuration names without exposing their values: SENTRY_INTERNAL_APP_ID, SENTRY_INTERNAL_APP_PRIVATE_KEY, SENTRY_RELEASE_BOT_CLIENT_ID, SENTRY_RELEASE_BOT_PRIVATE_KEY, CI_POLLER_APP_CLIENT_ID, CI_POLLER_APP_PRIVATE_KEY, SENTRY_DSN, GITHUB_TOKEN, CLOUDFLARE_API_TOKEN, COCOAPODS_TRUNK_TOKEN, CRAFT_GCS_TARGET_CREDS_JSON, CRAFT_GCS_STORE_CREDS_JSON, CRATES_IO_TOKEN, DOCKER_PASSWORD, HEX_API_KEY, TWINE_PASSWORD, NPM_TOKEN, GEM_HOST_API_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, NUGET_API_TOKEN, POWERSHELL_API_KEY, GPG_PRIVATE_KEY, GPG_PASSPHRASE, OSSRH_USERNAME, OSSRH_PASSWORD, PUBDEV_ACCESS_TOKEN, PUBDEV_REFRESH_TOKEN, VERCEL_ORG_ID, VERCEL_TOKEN, and CRAFT_LOG_LEVEL. 🔴 (18:39) .github/workflows/cocoapods-keepalive.yml runs daily at midnight UTC (cron: "0 0 * * *") on macos-15 in environment: production, installs CocoaPods, prints pod --version, and refreshes the session with pod trunk me > /dev/null 2>&1; its rationale is that CocoaPods sessions currently expire after 3 days of inactivity. 🔴 (18:40) .github/workflows/test.yml runs on pushes to main and pull requests, grants only contents: read, uses ubuntu-latest, pinned actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, pinned actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with Node 24, and pinned actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830; cache key is ${{ runner.os }}-node_modules-${{ hashFiles('package.json', 'yarn.lock') }}, dependencies install with yarn install --frozen-lockfile only on a cache miss, and tests run via yarn test. 🟡 (18:40) Assistant’s first review hypothesis: .github/workflows/auto-approve.yml may fail because its sparse checkout includes only auto-approve-repos.txt while the workflow later executes src/publish/record-auto-approval-attestation.js; deeper verification against implementation and tests was still pending. 🟡 (18:40) Assistant’s second review hypothesis: .github/workflows/ci-poller.yml documents an allowed dispatch-attempt range of 0..59, but regex ^(0|[1-5][0-9])$ appears to reject attempts 1..9, potentially breaking the self-dispatch chain; deeper verification against implementation and tests was still pending.