Distillation

🔴 (16:16) User directed that workflow_dispatch must always be allowed for manual recovery.
🔴 (16:16) User directed that manually dispatched workflows must always run trusted code because workflow_dispatch can target any ref.
🔴 (16:16) User stated the CI poller always adds the "ci-ready" label.
🔴 (16:16) User directed that a release must never be moved to "ci-ready" after its request changes.
🔴 (16:16) User stated that a renamed or re-approved issue must never reach "ci-ready".
🔴 (16:16) User provided a workflow change making the “Auto-approve if repo is in the list” step conditional on steps.attestation.outcome == 'success'; the auto-approval attestation is posted to "$ISSUE_URL" before the "accepted" label can be added.
🔴 (16:16) User provided changes to .github/workflows/ci-poller.yml: triggers include cron "*/5 * * * *", repository_dispatch type ci-poller, and completed workflow_run events from Run CI Status Poller; permissions change from issues: read to issues: write.
🔴 (16:16) User provided CI-poller logic that binds processing to the current accepted event and request snapshot before inspecting CI, preventing changed, renamed, or re-approved releases from receiving "ci-ready".
🔴 (16:16) User provided CI-poller recovery logic involving "ci-pending" restoration; if restoration fails, it emits ::warning::Could not restore ci-pending for issue #${number}. Revoking approval..
🔴 (16:16) User changed actions/create-github-app-token@v3 to the pinned commit actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 for the poller app token.
🔴 (16:16) User provided workflow validation that runs node .__publish__/src/publish/validate-approval-attestation.js before proceeding with publication-related work.

Distillation

Observations