Dashboard › craft › Distillation
a0a04b39-7ed7-4968-bb21-8164da9e48ac["lore_tm_v1_xkWyo9mwzC5-s_MATTIm0d9cfGuLieg48M42V_3w9ZY","lore_tm_v1_fy55WpSODml4wzf6a2grWFJCZYdT2wUWkEJeZxUF8nY","lore_tm_v1_ppcHdQudM993ylSHr6ssrH9ubadXInco1W-yp45ZMkM","lore_tm_v1_y0Dg1xGjvyP5Yzyl0f_waxBmuIGeTouTcdsq4svxoeg","lore_tm_v1_JJKYrsM7IXDY3h57lX2ImKU1jgN_-TjiWXO1HLh4ZuQ","lore_tm_v1_zW5egujMcnjpEaZ3MWo8CblFhSJTlOisTcFoxYq-RrI","lore_tm_v1_Ed1yFANMH9aIinaa-TSRe4H1RW2CbKUZBnhep5Kt6C8","lore_tm_v1_lrIEdzpMO0hpxStJ52d-RANDCDMokEfyst2TRnusaGI","lore_tm_v1_AYKoSgfsn-j-QHMtWewWdroOmUbxvJzfOrnIXeZxJgw","lore_tm_v1_ikZwiWyE--uBLFzVdQxeC-da08cinlkhfxMN6bsmkSs","lore_tm_v1_SzhDcStBJpcEZkVguWWDOybEhmWTBv_nRex7vLy-IZI","lore_tm_v1_g8XjR_JSCxutMf_VM-Duj40nPiXhqCNMVYlTeB4bZR8","lore_tm_v1_kryrHYKOB50BjJWKtDlksupO6NxdkaaACMPs-2lvTXU","lore_tm_v1_6Dyh9mACXsS-db074AgXGyjVBSy7muoT_5ynTUqF43c","lore_tm_v1_ngxKLdnlcBf7l9lg-qn1pyKg3ByRlolcZGfoaF9lxmw","lore_tm_v1_MzDC27TS9U_Mve4nLvzk72UFAWempJMF5F6_ZYlcezk","lore_tm_v1_X6FXVY4AkjohyUSmD5-WBKqcrmDFlFwIH35MMLq1wFA"]
Date: Aug 29, 2026
ses_fb273f3e6ffeLUVuKDtcxKR4i1 completed a read-only final compact-contract review of both full branch ranges and dirty worktrees; result was DO-NOT-MERGE.publish/src/modules/release-revision.js:1-12 matches the first same-repository View check runs link anywhere in an issue body rather than the canonical Quick links entry. Its revision drives target checkout and craft publish --rev in publish/.github/workflows/publish.yml:164-167,247-249. Read-only reproduction showed an earlier getsentry/toolkit decoy link selecting SHA aaaaaaaa… instead of the later Quick-links SHA; repository equality does not prevent publication of a different CI-green commit in the same repository.publish/.github/workflows/ci-poller.yml:107-110 has the same broad check-runs SHA extraction flaw. Existing tests in publish/src/modules/__tests__/release-revision.js:26-49 cover missing, wrong-repo, and uppercase links but not decoys or duplicate links. Required fix identified: parse exactly one check-runs link inside canonical Quick links; reject missing, duplicate, and out-of-block links in both resolver and CI poller; update docs/publish-issue-format.md:91-92, which calls the security-critical link “informational.”WorkspaceNameSchema in craft/src/schemas/project_config.ts:218-225 permits workspace name ..; craft/action.yml:84 accepts it and craft/action.yml:268 creates title …/..@version, while Publish converts it to ./.. and rejects traversal in publish/src/modules/details-from-context.js:53-55. This leaves a configured workspace unreleasable after craft prepare. Required fix identified: reject . and .. consistently in Craft schema, action validation, and Publish discovery validation; add end-to-end regression tests.publish/src/modules/__tests__/publish-workflow.js:104-112 state-path test uses impossible pair {path: './cli', workspace: 'cli'}, rejected by publish/src/modules/publish-location.js:5-10; actual compact classification returns {path: '.', workspace: 'cli'} at publish/src/modules/publish-location.js:24-30. Required fix identified: resolve a compact title first, then assert state filename using returned root path and workspace.publish/pnpm-lock.yaml must never be committed.publish/.github/workflows/cocoapods-keepalive.yml:1; src/modules/post-workflow-details.js and src/publish/inputs.js have newline-only changes. Required hygiene: remove/revert before staging and use an explicit allowlist.craft/action.yml:268, covered by craft/src/__tests__/action.test.ts:236-248.--rev in publish/.github/workflows/publish.yml:159-187,194-198,217-233,247-261.craft/src/commands/publish.ts:632-637,933-945; verified legacy workspace/path rejection, exact compact matching, root-config absence behavior, and fail-closed discovery in publish/src/modules/details-from-context.js:34-59, publish/src/modules/publish-location.js:1-40, and publish/.github/workflows/publish.yml:174-187.craft/src/utils/publishState.ts:82-99; Peggy generation is pinned and checked by yarn test in publish/package.json:18-20.yarn test passed with 45 tests, including generated-parser drift detection; Craft pnpm test passed with 1,152 passed and 1 skipped; both worktrees remained unchanged after tests; git diff --check passed.getsentry/craft:latest use at publish/.github/workflows/publish.yml:181-184,239 is intentional and correct for release ordering, not a mutable-image finding../.. workspace names, and impossible state-parity fixture—and stated plan to harden canonical link parser/poller, align Craft/Publish workspace validation, and replace fixture with actual compact resolution flow.publish/.github/workflows/ci-poller.yml currently runs every 5 minutes (cron: "*/5 * * * *") and supports workflow_dispatch with optional attempt input defaulting to "0". It lists up to 200 open issues labelled both ci-pending and accepted, parses title repository/version, broadly extracts a lowercase 40-hex SHA with grep -oP '(?<=commit/)[0-9a-f]{40}(?=/checks)', resolves branch/check-suite and current branch HEAD through release-bot API calls, and replaces every matching SHA occurrence in issue body when branch head moves.ci-ready after checking CI; Publish’s ci-ready event gate depends on that fresh label event after waiting-for-ci removes any existing ci-ready.Quick links containing View changes followed by View check runs, and planned one shared Node resolver rule that accepts exactly one View check runs line in that section so decoys and duplicates fail closed in both Publish resolver and CI poller.workflow_dispatch for manual recovery.publish/.github/workflows/ci-poller.yml:23-24 implements manual recovery by running check-ci when vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'; job concurrency group is ci-status-poller with cancel-in-progress: false.craft-workspace-action-propagation/action.yml Validate workspace step rejects simultaneous non-root path and workspace; workspace validation currently only allows /^[A-Za-z0-9_.-]+$/, so it permits . and .., reporting only the ASCII-character grammar error for other invalid names.craft-workspace-action-propagation/action.yml:268 constructs compact publish title publish: ${GITHUB_REPOSITORY}${SUBDIRECTORY}${WORKSPACE:+/$WORKSPACE}@${RESOLVED_VERSION}. Existing issue lookup filters exact title and takes first duplicate; title’s Quick links body is generated beginning at line 333.Quick links:, then - [View changes](https://github.com/${GITHUB_REPOSITORY}/compare/${RELEASE_PREVIOUS_TAG}...${RELEASE_BRANCH}), then - [View check runs](https://github.com/${GITHUB_REPOSITORY}/commit/${RELEASE_SHA}/checks/); this is followed by accepted-label instruction, ### Targets, target checklist, and optional changelog section.craft/src/__tests__/action.test.ts tests workspace action behavior: option-looking workspace --config-from=untrusted is passed inline as --workspace=--config-from=untrusted; validation rejects tab/control, bidi format, U+2028 line separator, U+2029 paragraph separator, and non-ASCII cli-é before git/Craft side effects; accepts '' and cli-v2; rejects simultaneous packages/cli path plus cli workspace and rejects cli/v2; title tests expect root publish: getsentry/toolkit@1.2.3 and workspace publish: getsentry/toolkit/cli@1.2.3.craft/src/__tests__/config.test.ts validates workspace configs, permits partial workspace GitHub owner/repo overrides, rejects compact-title-invalid workspace key cli/v2, rejects __proto__ with message Workspace name "__proto__" is not supported., rejects workspace github.projectPath, rejects base github.projectPath when workspaces are configured, and permits base github.projectPath with an empty workspace map.publish/src/modules/__tests__/release-revision.js currently expects getReleaseRevision() to return revision 7e5ca7ed5581552de066e2a8bc295b8306be38ac from a Quick links check-runs URL; accepts CRLF body; rejects wrong repository, missing link, and uppercase SHA. It lacks canonical-block decoy and duplicate-link coverage.