Distillation

🔴 (01:02) User-provided src/publish/authorize-approval.js is 241 lines and imports createApprovalAttestation, currentAcceptedEvent, and hasAutoApprovalAttestation from src/modules/approval-attestation.js, plus AUTO_APPROVAL_LABELER, AUTO_APPROVERS, authorizeApproval, and isAutoApprovedRepository from src/modules/approval-authorizer.js. 🔴 (01:02) User-provided src/publish/authorize-approval.js function getAutoApprovedRepositories() synchronously reads auto-approve-repos.txt as UTF-8, splits on /\r?\n/, removes empty lines, and returns the entries as a Set. 🔴 (01:02) User-provided src/publish/authorize-approval.js function getGitHubResponse(path) fetches https://api.github.com/${path} with Accept: application/vnd.github+json, bearer credential from APPROVAL_TOKEN, and X-GitHub-Api-Version: 2026-03-10. 🔴 (01:02) User-provided src/publish/authorize-approval.js function getPermission({ owner, repository, username }) requests repos/{owner}/{repository}/collaborators/{username}/permission with each path component passed through encodeURIComponent; a non-OK response throws an error containing the username, repository, and HTTP status. 🔴 (01:02) User-provided src/publish/authorize-approval.js function getIssue({ repository, issueNumber }) requests repos/${repository}/issues/${issueNumber} and throws Could not retrieve issue #${issueNumber}: GitHub returned ${response.status} on a non-OK response. 🔴 (01:02) User-provided src/publish/authorize-approval.js functions getIssueEvents() and getIssueComments() paginate GitHub issue resources with per_page=100&page=${page}, accumulate all pages, stop when a page contains fewer than 100 entries, and throw resource-specific errors containing the issue number and HTTP status on non-OK responses. 🔴 (01:02) User-provided src/publish/authorize-approval.js function main() requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY; each missing variable causes a No "<NAME>" environment variable found error. 🔴 (01:02) User-provided src/publish/authorize-approval.js uses APPROVAL_ACTOR as actor, APPROVAL_ISSUE_TITLE as issueTitle, and loads autoApprovedRepositories through getAutoApprovedRepositories(). 🔴 (01:02) User-provided src/publish/authorize-approval.js handles actor === AUTO_APPROVAL_LABELER by concurrently fetching the live issue, all issue events, and all issue comments; it derives the requester from liveIssue.user?.login and the latest accepted-label event via currentAcceptedEvent(events). 🔴 (01:02) User-provided src/publish/authorize-approval.js authorizes the AUTO_APPROVAL_LABELER path only when the live issue is open, its title exactly equals APPROVAL_ISSUE_TITLE, the requester is a string and belongs to AUTO_APPROVERS, isAutoApprovedRepository({ actor: requester, autoApprovedRepositories, issueTitle }) succeeds, the current accepted event actor equals AUTO_APPROVAL_LABELER, and a github-actions[bot] comment contains a matching auto-approval attestation for that requester and live issue. 🔴 (01:02) User-provided src/publish/authorize-approval.js handles non-AUTO_APPROVAL_LABELER actors by calling authorizeApproval({ actor, issueTitle, getPermission, autoApprovedRepositories }) and using its authorized result. 🔴 (01:02) User-provided src/publish/authorize-approval.js appends authorized=false\n to GITHUB_OUTPUT and returns immediately when preliminary authorization fails. 🔴 (01:02) User-provided src/publish/authorize-approval.js fetches the live issue and all issue events concurrently after successful ordinary authorization, unless those values were already loaded by the auto-approval-labeler path, and derives the current accepted event with currentAcceptedEvent(events). 🔴 (01:02) User-provided src/publish/authorize-approval.js performs a final authorization check requiring an open issue, an exact title match with APPROVAL_ISSUE_TITLE, a string requester login, a current accepted event, and event.actor === actor; for actors other than AUTO_APPROVAL_LABELER, it also rejects case-insensitive self-approval where the requester login equals the approving actor. 🔴 (01:02) User-provided src/publish/authorize-approval.js creates the final approval attestation with createApprovalAttestation({ actor: event.actor, eventId: event.eventId, issue }) and appends authorized=true\napproval_attestation=${attestation}\n to GITHUB_OUTPUT. 🔴 (01:02) User-provided src/publish/authorize-approval.js invokes main() only when run directly, logs rejected errors with console.error, sets process.exitCode = 1, and exports getAutoApprovedRepositories, getGitHubResponse, getIssue, getIssueComments, getIssueEvents, getPermission, and main.

🔴 (01:02) User-provided src/publish/record-auto-approval-attestation.js is 61 lines and defines recordAutoApprovalAttestation({ autoApprover, getIssue, issueNumber, issueTitle, repository }). 🔴 (01:02) User-provided src/publish/record-auto-approval-attestation.js fetches the live issue and rejects with The automated approval request changed before approval unless the issue remains open, its title exactly matches issueTitle, and its requester login equals autoApprover case-insensitively. 🔴 (01:02) User-provided src/publish/record-auto-approval-attestation.js returns createAutoApprovalAttestation({ autoApprover, issue }) after validating the live issue. 🔴 (01:02) User-provided src/publish/record-auto-approval-attestation.js function main() requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and AUTO_APPROVER; it appends auto_approval_attestation=${attestation}\n to GITHUB_OUTPUT. 🔴 (01:02) User-provided src/publish/record-auto-approval-attestation.js imports getIssue from src/publish/validate-approval-attestation.js, invokes main() only when run directly with error logging and process.exitCode = 1, and exports main and recordAutoApprovalAttestation.

🔴 (01:02) User-provided src/publish/current-accepted-event.js is 48 lines and defines getCurrentAcceptedEvent({ getIssueEvents, issueNumber, repository }), which fetches issue events, applies currentAcceptedEvent(...), throws The issue has no current accepted label event when none exists, and otherwise returns the event. 🔴 (01:02) User-provided src/publish/current-accepted-event.js function main() requires APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY, obtains events via getAllPages({ repository, issueNumber, resource: "events" }), and writes the JSON-serialized current accepted event to standard output. 🔴 (01:02) User-provided src/publish/current-accepted-event.js invokes main() only when run directly with error logging and process.exitCode = 1, and exports getCurrentAcceptedEvent and main.

🔴 (01:02) User-provided src/publish/record-ci-ready-attestation.js is 109 lines and imports createCiReadyAttestation and currentAcceptedEvent from src/modules/approval-attestation.js, plus getAllPages, getGitHubResponse, and getIssue from src/publish/validate-approval-attestation.js. 🔴 (01:02) User-provided src/publish/record-ci-ready-attestation.js function getAuthenticatedLogin() requests GitHub API resource user; a non-OK response throws an error containing the HTTP status, and a response without a string login throws GitHub returned no authenticated user login. 🔴 (01:02) User-provided src/publish/record-ci-ready-attestation.js function recordCiReadyAttestation(...) concurrently fetches the live issue, all issue events, and the authenticated GitHub login, then derives the current accepted-label event with currentAcceptedEvent(events). 🔴 (01:02) User-provided src/publish/record-ci-ready-attestation.js rejects with The approval changed before CI could be marked ready unless the issue remains open, its title exactly equals issueTitle, its current labels include accepted, and a current accepted event exists. 🔴 (01:02) User-provided src/publish/record-ci-ready-attestation.js optionally validates expectedAcceptedEvent; when supplied, both acceptedEvent.actor and acceptedEvent.eventId must exactly match its actor and eventId. 🔴 (01:02) User-provided src/publish/record-ci-ready-attestation.js creates a CI-ready attestation with createCiReadyAttestation({ acceptedEvent, ciReadyActor, issue }), where ciReadyActor is the authenticated GitHub login. 🔴 (01:02) User-provided src/publish/record-ci-ready-attestation.js function main() requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, and APPROVAL_ISSUE_TITLE. 🔴 (01:02) User-provided src/publish/record-ci-ready-attestation.js supplies expectedAcceptedEvent only when both EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID are truthy; its fields are copied verbatim from those environment variables. 🔴 (01:02) User-provided src/publish/record-ci-ready-attestation.js retrieves issue events through getAllPages({ repository, issueNumber, resource: "events" }) and appends ci_ready_attestation=${attestation}\n to GITHUB_OUTPUT. 🔴 (01:02) User-provided src/publish/record-ci-ready-attestation.js invokes main() only when run directly with error logging and process.exitCode = 1, and exports getAuthenticatedLogin, main, and recordCiReadyAttestation.