Distillation

Date: Aug 25, 2026

• 🟡 (17:13) /home/byk/Code/getsentry/craft-workspace-action-propagation/package.json identifies Craft as @sentry/craft version 2.31.0-dev.0, with CLI bins craft and sentry-craft both mapped to dist/craft; Node 24.18.0 and pnpm 10.27.0 are pinned through Volta.
• 🟡 (17:13) Craft package scripts: build:fat = tsc -p tsconfig.build.json; build:watch = tsc -p tsconfig.build.json --watch; build = node build.mjs; precli = pnpm build; cli = node -r source-map-support/register dist/craft; clean = rm -rf dist coverage; lint = eslint --cache --cache-strategy content; fix = pnpm lint --fix; format = prettier --write .; format:check = prettier --check .; test = vitest run; test:watch = vitest; typecheck = tsc --noEmit; docs:dev = cd docs && pnpm dev; docs:build = cd docs && pnpm build.
• 🟡 (17:13) Craft direct runtime dependencies are @vercel/client@^18.2.5, fastest-levenshtein@^1.0.16, ignore@^7.0.5, marked@^17.0.1, p-limit@^6.2.0, and semver@^7.7.3; development tooling includes TypeScript ^5.7.2, Vite ^7.3.5, Vitest ^4.1.0, yargs ^18, and Zod ^3.24.1.
• 🟡 (17:14) Craft test command vitest run -- src/__tests__/action.test.ts in /home/byk/Code/getsentry/craft-workspace-action-propagation passed: 60 test files passed; 1,129 tests passed, 1 skipped (1,130 total); duration 35.97s, starting 17:13:14.
• 🟡 (17:14) The Craft action-test run emitted expected GitHub-target scenario logs covering: deletion of orphaned draft release v1.0.0; cleanup failure Error: Cleanup failed; skipping creation where tag 1.0.0 is already published; handling createRelease HTTP 422 by deleting leftover draft release id=789; avoiding deletion where the release was already published; failure to update floating tags Error: Tag update failed; truncation of release bodies exceeding GitHub's 125,000-character limit (180,000 and 125,001 characters); refusal to delete non-draft release v1.0.0; and dry-run github.repos.deleteRelease(...).
• 🟡 (17:14) The Craft action-test run logged remote fallback diagnostics: Failed to fetch from remote, using locally cached refs and Failed to list remote branches.
• 🟡 (17:14) Vite/esbuild issued two SSR warnings from src/targets/__tests__/symbolCollector.test.ts at assignments on lines 58 and 68: assigning vi.fn() to imported checkExecutableIsPresent will throw because it is an import.
• 🟡 (17:14) A subsequent Craft command, vitest run -- src/utils/__tests__/helpers.test.ts src/utils/__tests__/publishState.test.ts src/__tests__/config.test.ts, also passed with 60 test files passed; 1,129 tests passed and 1 skipped (1,130 total); duration 27.55s, starting 17:13:51. The invocation runs the complete Vitest suite rather than only the three named test files.
• 🟡 (17:14) /home/byk/Code/getsentry/publish-workspace-acceptance/package.json defines private package publish version 0.0.1, an approval-based publishing system for Sentry, with repository git@github.com:getsentry/publish.git, Apache-2.0 license, and Volta pins Node 24.0.0 and Yarn 1.22.22.
• 🟡 (17:14) Publish package scripts are test = vitest run, test:watch = vitest, lint = eslint src .github --ignore-pattern '!.github', and prettier = prettier --write src; dependencies are @actions/core@^2.0.0, @actions/github@^7.0.0, and @sentry/node@^10.0.0; undici@^6.23.0 is a Yarn resolution.
• 🟡 (17:15) Publish acceptance tests yarn vitest run src/modules/__tests__/details-from-context.js src/modules/__tests__/update-issue.js passed: 2 test files and all 15 tests passed; duration 459ms, starting 17:14:58.
• 🟡 (17:15) The publish acceptance test run warned that vitest.config.js:1:1 uses ESM syntax while loaded as CommonJS, unsupported by Vite's planned-default configLoader: 'native'; suggested fixes are renaming to .mjs, setting nearest package.json "type": "module", or suppressing with VITE_CONFIG_NATIVE_IGNORE_WARNING=true.
• 🟡 (17:15) src/utils/__tests__/publishState.test.ts verifies getCraftStateDir() uses ${homedir()}/.local/state/craft when XDG_STATE_HOME is unset or empty, and /var/lib/ci-state/craft when XDG_STATE_HOME=/var/lib/ci-state; it resets XDG_STATE_HOME before each test and restores the full process.env afterward.
• 🟡 (17:15) getPublishStateFilename(version, githubConfig, cwd, workspace?) tests require owner/repo, a 12-hex-character short cwd hash, and version in normal filenames—for example publish-state-getsentry-craft-[0-9a-f]{12}-1.2.3.json; distinct monorepo cwd paths must create distinct names; repeated identical inputs must be stable.
• 🟡 (17:15) Publish-state workspace isolation tests require cli and mcp at identical repository, cwd, and version to produce distinct filenames ending respectively -workspace-Y2xp-1.2.3.json and -workspace-bWNw-1.2.3.json; names CLI, cli, cli/workspace, and cli_workspace must all remain non-colliding. With no workspace, the legacy-compatible filename pattern remains publish-state-o-r-[0-9a-f]{12}-1.2.3.json.
• 🟡 (17:15) Publish-state filename tests sanitize unsafe owner/repo/version characters: version 1.2.3+build/hack$, owner Weird Owner, and repo Re po! must contain none of /, $, +, or ! and begin publish-state-weird_owner-re_po-[0-9a-f]{12}-; when GitHub config is null, filenames fall back to publish-state-[0-9a-f]{16}-<version>.json, still differing by cwd.
• 🟡 (17:15) getPublishStatePath() tests require joining the external state directory and filename (e.g. with XDG_STATE_HOME=/var/state, path starts /var/state/craft/ and ends -1.2.3.json), and enforce that neither normal nor null-GitHub-config fallback state files can reside under an attacker-influenceable repository cwd such as /workspace/untrusted-repo.
• 🟡 (17:15) In src/commands/publish.ts lines 667–701, publish initializes targetsToPublish from argv.target or [SpecialTarget.All], rejects combinations of all/none with any other target, expands npm workspace targets via expandWorkspaceTargets(config.targets || []), then obtains publishStateGithubConfig through getGlobalGitHubConfig(), falling back to null on error.
• 🟡 (17:15) src/commands/publish.ts constructs external publish-state paths with getPublishStatePath(newVersion, publishStateGithubConfig, process.cwd(), getActiveWorkspace()), so selected Craft release workspaces participate in publish-state keying.
• 🟡 (17:15) In src/commands/publish.ts lines 707–736, Craft detects but never reads legacy cwd file .craft-publish-${newVersion}.json, warning users to migrate pre-seeded state to $XDG_STATE_HOME/craft/ because repository contents can be attacker-influenced by PRs. If the new external state file exists, Craft parses it, resets targetsToPublish to all expanded target IDs, and removes every target already listed in publishState.published; otherwise it initializes { published: Object.create(null) }.
• 🟡 (17:16) src/schemas/project_config.ts defines release-unit fields shared by top-level config and named release workspaces: github, targets, preReleaseCommand, postReleaseCommand, releaseBranchPrefix, changelog, deprecated changelogPolicy, requireNames, statusProvider, artifactProvider, versioning, and noMerge.
• 🟡 (17:16) WorkspaceSchema inherits the release-unit fields but makes its github block GitHubGlobalConfigSchema.partial().optional(), permitting a workspace to override only projectPath, owner, or repo while inheriting remaining top-level GitHub settings.
• 🟡 (17:16) CraftProjectConfigSchema.workspaces is z.record(z.string(), WorkspaceSchema).optional(). Schema documentation distinguishes named Craft release workspaces—independently versioned release units—from an npm target's workspaces: true, which discovers and publishes packages inside one target at the same version.
• 🟡 (17:16) CraftProjectConfigSchema.minVersion is optional but, when supplied, must match /^\d+\.\d+\.\d+.*$/; top-level github requires string owner and repo, with optional projectPath.
• 🟡 (17:17) Search found getGlobalGitHubConfig exported in src/config.ts at line 471.