Dashboard › publish › Distillation
9b588dd5-ba78-4ef7-ae93-d33fdd2706b3["lore_tm_v1_V5vu5eIQb_2QxqQmelHla9yL0nHdgDRUjXMDicw98BI","lore_tm_v1_CM9XfUiU_Po72SvVhHaBCYve9OZ46qflo_6i_E0ICNE","lore_tm_v1_onz1zSxmi1q5IAWva8_bngqVINLuF6YAQHxlwniEae8","lore_tm_v1_A5LahGQxhxUkl-NWJFVM-oPkFOW3pYlVm4CTmD7fOIk","lore_tm_v1_2B3b3MT8siVW-FkZArjfpdHe3yVTBt0NQmCrx3dLuss"]
83d210b29553ea6f4d97508821724a834c43856e; it contained 21 modified tracked files and 20 untracked files. Unstaged diff SHA-256 was 8ca4aa7afcb6a1c171f695d488a06b8cf4d08436a414a3223a18b33a08db4fc6; staged diff was empty with SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855..github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, docs/key_rotation_vault_changes.md, docs/rfc.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js..github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/authorize-approval.js, src/publish/__tests__/auto-approval-workflow.js, src/publish/__tests__/ci-poller-workflow.js, src/publish/__tests__/current-accepted-event.js, src/publish/__tests__/publish-workflow.js, src/publish/__tests__/record-auto-approval-attestation.js, src/publish/__tests__/record-ci-ready-attestation.js, src/publish/__tests__/validate-approval-attestation.js, src/publish/__tests__/workflow-action-pinning.js, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js.yarn lint ran with Yarn Classic 1.22.22 using eslint src .github --ignore-pattern '!.github' and passed in 1.54s..github/workflows/auto-approve.yml:18-36: sparse checkout includes only auto-approve-repos.txt, but the workflow executes src/publish/record-auto-approval-attestation.js; that script and its dependencies will be absent, causing automated approval to fail with MODULE_NOT_FOUND. src/publish/__tests__/auto-approval-workflow.js:7-13 checks textual ordering but not checkout contents, so it misses the defect..github/workflows/ci-poller.yml:36-46: the retry-attempt validation regex claims to accept 0–59 but actually accepts only 0 and 10–59. The first run dispatches attempt 1 at .github/workflows/ci-poller.yml:453-463, and the next run rejects it before polling. src/publish/__tests__/ci-poller-workflow.js:40-51 explicitly preserves the faulty regex.src/publish/__tests__/authorize-approval.js:96-107 omits state: "open", so src/publish/authorize-approval.js:202-210 exits at the open-state guard before exercising the intended self-approval guard.src/publish/__tests__/record-ci-ready-attestation.js:48-63 and :66-91 omit open state, causing src/publish/record-ci-ready-attestation.js:46-55 to short-circuit before the intended title or event mutation checks. Removing the intended self-approval, title, or event checks would therefore not fail these regressions.src/modules/approval-authorizer.js:1-49: permission must be write, maintain, or admin; automated requesters and direct Internal App authorization are denied through the generic path. src/publish/authorize-approval.js:186-219 also performs a live requester check and denies case-insensitive self-approval.src/publish/authorize-approval.js:135-169 requires all of: an allowlisted parsed path, an approved bot requester, the current accepted event, and a request-bound comment authored by github-actions[bot].src/modules/approval-attestation.js:14-55, src/modules/approval-attestation.js:176-240, and src/publish/validate-approval-attestation.js:63-100 binds the live open issue, title, body/dry-run digest, current labels, accepted event, trusted comment author, and CI-ready actor..github/workflows/ci-poller.yml:121-153 and :272-359 captures the accepted event before polling, revalidates it after CI while recording proof, and validates again immediately before adding ci-ready..github/workflows/publish.yml:113-129 removes stale ci-ready while waiting for CI and .github/workflows/ci-poller.yml:356-359 always re-adds it after successful validation..github/workflows/publish.yml:197-220 validates publish state at entry and .github/workflows/publish.yml:328-354 validates it again directly before Craft.accepted even when publish inputs are absent or malformed, via .github/workflows/publish.yml:409-414, src/publish/update-issue.js:8-18, and src/modules/update-issue.js:62-79..github/workflows/ci-poller-dispatch.yml:3-16 is a permissionless, secret-free workflow_dispatch relay protected by production; .github/workflows/ci-poller.yml:8-31 and :48-74 allow the privileged poller only after a successful default-branch relay run and check out the default branch before token creation.README.md:97-99 and the reviewed diff does not widen its organization scope..github/workflows/publish.yml:191-223, :266-274, and :353-354; src/publish/__tests__/workflow-action-pinning.js:30-75 enforces this.yarn test --printConsoleTrace passed all 84 tests across 16 files.git diff --check passed with no output.83d210b29553ea6f4d97508821724a834c43856e, unstaged diff SHA-256 remained 8ca4aa7afcb6a1c171f695d488a06b8cf4d08436a414a3223a18b33a08db4fc6, staged diff remained empty, and every untracked-file hash matched its initial snapshot.DO-NOT-MERGE because of the automated-approval sparse-checkout failure and the CI-poller retry regex failure.