Distillation

Current State

• Date: Sep 8, 2026. Craft’s merged workspace release is in recovery publication:
  • Craft PR #872 was merged at 2026-09-08T17:39:00Z as c8a878c53d937a62124796b39ac00f4d73212fe0.
  • Craft master was fetched at 17:40, advancing from 21270a1 to c8a878c; package version was 2.31.0-dev.0.
  • The established Craft self-release workflow (release.yml, workflow ID 4152940) was dispatched with version=auto. It ran successfully as Release run 34258579011 on c8a878c, completing at 17:44.
  • This successful Craft Release workflow prepared release/2.31.0, creating release commit 55694f8bf3a0fd051e21a877f57b4c0dd8e946bb and Publish request getsentry/publish#9454, titled publish: getsentry/craft@2.31.0.
  • Craft 2.31.0 is not yet confirmed published and no GitHub release artifact/tag 2.31.0 had been found as of 18:16.
• Active task: monitor recovery Publish workflow run 34261921633 for issue getsentry/publish#9454, then verify all Craft 2.31.0 targets/GitHub release evidence after it completes. Do not bypass the Publish controller’s fresh CI gate.
  • Recovery run URL: https://github.com/getsentry/publish/actions/runs/34261921633
  • Triggered by issues at 18:15:15 on merged Publish hotfix commit 44931fa501e457ee631fbd1234ab27f029eb4f8c.
  • At 18:16 it was in_progress.
  • #9454 was OPEN with accepted and fresh ci-ready; a recovery approval comment was posted at 18:14:48 and controller comment stated CI passed / publishing began at 18:15:06.
  • Fresh gate evidence: CI Status Poller 34261924327 completed successfully at 18:15:30; preceding poller 34261891224 also succeeded at 18:15:15. Release-branch Test 34261678672 and Push on main 34261678080 succeeded.
• Publish bootstrap hotfix is merged:
  • Publish PR #9456: https://github.com/getsentry/publish/pull/9456
  • Branch/worktree: fix/root-location-bootstrap / /home/byk/Code/getsentry/publish-root-location-bootstrap
  • Hotfix commit 4f4b00fa50a23294b058423032188a2846b086c4 (fix: bootstrap root publish locations)
  • Merged at 2026-09-08T18:12:39Z as 44931fa501e457ee631fbd1234ab27f029eb4f8c.
  • It fixes the failed initial Craft publication, which stopped before Craft ran because getsentry/craft:latest lacked workspace list.
• Task tracking at 18:16:
  • Verify Publish PR #9339 exact merge gate: completed.
  • Verify Craft PR #872 exact merge gate: completed.
  • Admin-merge ready PRs: completed.
  • Cut Craft release from merged master: release preparation completed; publication recovery active.
  • Verify failed Publish location resolution: completed.
  • Implement root-path bootstrap fallback with regression: completed.
  • Verify/review/merge Publish hotfix #9456: completed.
  • Resume and verify Craft 2.31.0 publication: active, high priority.
• User authorization:
  • At Sep 8 17:34, user authorized admin merging both original PRs once ready; used for Publish #9339 and Craft #872.
  • The clean hotfix PR #9456 was also admin-squash-merged after all checks passed and self-approval remained the only gate.
  • User explicitly enforced that Publish request #9454 must remain behind the controller gate; recovery was performed by re-adding accepted, not direct publication.
• User directives:
  • Always load repo-setup before situation skills.
  • Action publish titles always carry the full concrete workspace path.
  • .sentryclirc resolution must always check global locations as fallback after walking upward from cwd.
  • Workspace/CLI parsing must never interpret flags such as --workspace --dry-run as a workspace name.
  • CLI scanning must never open excluded directories such as node_modules; default walks must not re-enter directories, including via symlinks when following them.
  • Superseding parsing preference (Sep 8 17:36; originating from Sep 2 Publish #9339 review): replace regexp-based parsing with Peggy wherever that directive applies.
• Scheduled follow-ups:
  • Current relevant follow-up: k3npsy3u, scheduled Sep 8 18:15 to inspect #9454 recovery labels/comments/current Publish workflows and verify fresh CI gating without bypass.
  • Superseded earlier release/polling follow-ups: p4gwh2g0, 1zhdnhfo, mleaytjs, u2uaigqq, 40yk5hby, f6cq8f1a, 4fjfsk2i, 2dmvnm1z.
• Background tasks:
  • ses_f7ecc9434ffeledouaoJSXmmtQ, started Sep 8 13:28 for CLI discovery inspection, completed Sep 8 13:49 with no directly reusable findings.
  • ses_f7e3cf790ffean2YR8MT3hLull, started Sep 8 16:04 for independent Craft audit, completed Sep 8 16:59 with MERGE.
  • ses_f7dfd0a94ffeFo9yAHzdIeQDqO, started Sep 8 17:14 for initial broken-symlink repair audit, completed Sep 8 17:17 with DO-NOT-MERGE; its MUST-FIX findings were repaired.
  • ses_f7df4b4a4ffeQoqF7rJr5Uz3FG, started Sep 8 17:23 for hardened symlink repair audit, completed Sep 8 17:25 with MERGE.
• Outpost/Jared operating context:
  • Root AGENTS.md directs autonomous GitHub coding work in /workspace/repo: triage → explore → plan → implement → review → ship; worker is a deprecated alias of implement.
  • Read each target repository’s AGENTS.md / CONTRIBUTING.md first; .lore.md, if present, holds long-term Outpost knowledge.
  • Outpost operator-chat turns skip triage and treat the request as the task/conversation response.
  • Skills are .agents/skills/, generated from canonical skills/ by scripts/sync-skills.mjs.
  • Model tiers: heavy triage/plan/review = Jared / Claude Opus 4.8; light = Jared / xAI Grok 4.3; explore = OpenAI gpt-5-mini; implement = Moonshot kimi-k2.7-code; ship = xAI Grok grok-build-0.1.

Key Decisions

• Craft release and publication flow
  • Craft’s repository self-release must use .github/workflows/release.yml through its normal workflow_dispatch with version=auto; do not manually improvise versioning/publishing.
  • release.yml dogfoods the local merged Craft action for getsentry/craft, preparing a release branch and opening a Publish approval request. A successful Craft Release workflow does not itself mean the npm/GitHub/etc. release has been published.
  • master version 2.31.0-dev.0 correctly prepares stable release 2.31.0.
  • Craft release 2.31.0 changelog contains:
    • Features: top-level workspaces schema plus --workspace selector (Craft #848, @BYK); propagated release workspaces (Craft #872, @BYK).
    • Fixes: missing origin remote no longer fatal (Craft #871, @sentry); registry push retries with concurrent-update backoff (Craft #870, @jared-outpost).
  • Publishing must remain behind Publish’s accepted → reset/revalidate → fresh ci-ready controller state machine. Never directly invoke or bypass the publish workflow merely because a release branch’s checks appear green.
  • Initial #9454 publish attempt correctly failed closed at location resolution. Recovery must use a fresh approval/CI cycle, which was done after the controller hotfix merged.
• Bootstrap compatibility decision
  • Root cause of initial #9454 failure: Publish’s newly merged workspace-aware resolver invokes getsentry/craft:latest workspace list whenever target checkout has .craft.yml; at the time, published getsentry/craft:latest predates Craft’s new workspace list command.
  • Failure log exact command context: PUBLISH_ARGS={"repo":"craft","path":".","version":"2.31.0","dry_run":"","merge_target":"","targets":[]}, PUBLISH_REPOSITORY_DIRECTORY=__repo__; discover-location.js:66:7 invoked Craft and got help followed by Unknown commands: workspace, list under Node v24.20.0.
  • Minimal safe compatibility fix: input.path === "." returns { path: "." } before workspace discovery. Checkout root can never be a concrete workspace identity, so discovery is unnecessary there.
  • All non-root paths continue to invoke workspace discovery and fail closed on unavailable/malformed Craft output. This preserves workspace-routing security and avoids broad fallback based on arbitrary Craft command errors.
  • Rejected alternative: blanket fallback when workspace list fails. It could silently misroute a non-root workspace publication and violates fail-closed discovery.
• Craft concrete workspace contract
  • Canonical Craft title identity is path-only: publish: getsentry/<checkout-repository>/<full-concrete-workspace-path>@<version>.
  • Legacy JSON-qualified workspace-title syntax was removed. getsentry/ remains optional only when parsing existing issues.
  • cli/v2 is a valid concrete multi-segment workspace directory path, not legacy compatibility syntax. Removing it would violate full-path title/selection behavior and break valid paths such as packages/CLI.
  • Safe repository/path tokens use ASCII [A-Za-z0-9_.-]+, excluding ., .., __proto__, and leading -; versions are Craft-compatible semvers and may have + build metadata.
  • Semantic token/semver validation remains in src/modules/publish-issue-validation.js; Peggy is syntactic; poller/controller validation remains required.
  • After authoritative exact revision checkout, matching is exact and case-sensitive: root "." is root; only exact ./<workspace> discoveries become workspaces; other suffixes stay safe checkout paths.
• Craft configuration/workspace discovery
  • Top-level workspaces: keys can be literal paths or globs; globs expand to concrete .craft.yml-relative directories. A selected release needs one concrete --workspace <path> or CRAFT_WORKSPACE.
  • craft workspace list emits concrete workspace paths as a JSON array.
  • Workspace paths reject empty/dot/parent/prototype/leading-dash/backslash/absolute/unsafe-glob/file matches; overlaps are rejected.
  • Workspace config cannot use github.projectPath; a workflow cannot provide both path and workspace.
  • Explicit workspace root is threaded through remote config loading; prepare --config-from resolves relative config from git rev-parse --show-toplevel.
  • Glob behavior: *, ?, classes/negated classes, globstar, finite balanced braces; extglob rejected. Nested brace expansion fails closed.
  • Existing results require lexical and physical realpath containment, directories only, no node_modules, sorted POSIX paths, and ambiguity rejection before dedupe.
  • Broken/racy candidate policy: realpathSync() errors with ENOENT skip that candidate, covering broken symlinks/removal races. All other errors (ELOOP, EACCES, EPERM, unexpected I/O) propagate.
  • CLI walker is not a Craft workspace-expansion replacement: Craft is synchronous/deterministic/config-oriented and stricter in glob, exact path, realpath, containment, and failure behavior. Do not add parallel scanning absent profiling proof.
• GitHub target/release workspace behavior
  • Example workspace config: minVersion: 2.29.0; global GitHub { owner: getsentry, repo: toolkit }; packages/* uses releaseBranchPrefix: release/cli, tagPrefix: "cli@"; tools/mcp uses releaseBranchPrefix: release/mcp, tagPrefix: "mcp@".
  • Differing target tagPrefix values use the first for read-path operations and log a warning; independent products should be separate release workspaces.
  • GitHub Latest is repository-wide, not prefix-scoped; tags/changelogs/branches/version detection remain product-specific.
• Release/publish workflow security
  • Required order: title parse/validate → authoritative issue-body revision parse → exact checkout → optional root .craft.yml workspace discovery → full-suffix classification → craft publish <version> --rev <revision>.
  • The new root bootstrap exception occurs before discovery only for exact root "."; it does not weaken non-root discovery.
  • Craft state is outside checkout in $GITHUB_WORKSPACE/.craft-state/craft; state identity uses physical container cwd SHA-1, lossless base64url workspace identity, and conditional lossless version identity.
  • CRAFT_PUBLISH_STATE_GITHUB_REPO identifies checkout repository, never release-repository override.
  • Controller image intentionally remains getsentry/craft:latest: it needs to understand the exact checked-out revision/config format. CI-approved SHA plus craft publish --rev bind release revision. The root-only bootstrap repair bridges a necessary bootstrapping transition without allowing non-root fallback.
• Workflow JSON handoffs
  • @actions/core.setOutput() values consumed by fromJSON() must serialize objects using JSON.stringify.
  • PUBLISH_ARGS absent/empty parses as "{}"; workspace-list input as "[]".
  • Required repo and path errors are contextual:
    • Publish input must define a repository.
    • Publish input must define a path.
• Peggy revision and merge-target authority
  • User preference supersedes regexp parsing where applicable: use Peggy.
  • src/modules/publish-issue-title.peggy is canonical for PublishIssueTitle, ReleaseRevision, and CheckRunsLinkCount; generated start rules exactly ["PublishIssueTitle", "ReleaseRevision", "CheckRunsLinkCount"].
  • Canonical body header requires requester, Merge target, Quick links, View changes, then one repository-bound checks URL.
  • Parser returns { repo, mergeTarget, revision }; Merge target comes solely through getReleaseRevisionDetails().
  • (default) maps to empty Craft merge_target; decoy/late Merge target fields cannot override canonical header.
  • Merge-target grammar is (default) or documented branch characters [A-Za-z0-9_./-]; arbitrary non-newline values such as main; not-a-branch are rejected.
  • CheckRunsLinkCount counts all literal - [View check runs]( occurrences to reject decoys.
  • Retained errors:
    • Expected exactly one View check runs link in Quick links for getsentry/${repo}.
    • Expected a View check runs link for getsentry/${repo} in the publish issue body.
    • Release revision must be a lowercase 40-character SHA.
• Revision/body preservation
  • updateReleaseRevision() only accepts /^[0-9a-f]{40}$/ and replaces parser-recorded SHA offsets.
  • Poller transfers bodies via file-backed jq -jr/jq -ejr and gh issue edit --body-file, never Bash command substitution.
  • Branch-move rewrites fail closed unless resolver succeeds and .issueBody is a nonempty string. Malformed/scalar/missing/non-string/empty results never edit.
  • Per-issue poller body temp files live in cleanup subshells with EXIT traps; skip/failure paths use exit 0.
• Generated documentation
  • Grammar generator extracts only between // BEGIN TITLE GRAMMAR / // END TITLE GRAMMAR; docs use <!-- BEGIN GENERATED TITLE GRAMMAR --> / <!-- END GENERATED TITLE GRAMMAR -->.
  • Generator rejects missing, duplicate, and malformed marker-like documentation fragments.
  • Docs state Merge target is required and constrained.
• Checkout scope
  • Scoped checkouts in .github/workflows/publish.yml and controller checkout in .github/workflows/ci-poller.yml use actions/checkout@v7.
  • Do not update unrelated test.yml or auto-approve.yml.
• Sentry CLI operational context
  • Before CLI code, read packages/cli/AGENTS.md and .cursor/rules/ultracite.mdc.
  • CLI is a Node.js/pnpm/Stricli package at packages/cli; docs at apps/cli-docs.
  • It has no runtime dependencies; add packages via pnpm add -D and preserve pnpm run check:deps.
  • Use Node APIs, no Bun; use Node fs/process APIs, src/lib/which.ts, src/lib/scan/, and node:timers/promises.
  • Directory creation: mkdirSync(dir, { recursive: true, mode: 0o700 }); prefer array argument execFileSync.
  • Use direct @sentry/api response types rather than duplicate Valibot schemas.
  • Commands use buildCommand, async generators, CommandOutput, shared rendering; no custom JSON flags/manual stdout/stderr.
  • Route maps use buildRouteMap, preserving aliases.
  • .sentryclirc walks upward from cwd, then global fallback with getGlobalPaths(), applyGlobalFallbacks(), tryApplyFile(), walkUpFrom(cwd), loadSentryCliRc(); tests reset cached globals on SENTRY_CONFIG_DIR changes.
  • packages/cli/src/lib/walk-up.ts resolves/yields absolute ancestors and stops safely at broken/denied paths/symlink cycles.
  • packages/cli/src/lib/scan/walker.ts is a streaming DFS scanner, not workspace discovery: ignore before descent, never open node_modules-like excluded dirs, sorted POSIX regular files, symlinks off unless enabled, root inode seeded when following symlinks, serial and bounded-parallel exhaustive modes.

Technical Changes

Craft release activity

• getsentry/craft master:
  • Fetched at Sep 8 17:40 from 21270a1 to merged commit c8a878c.
  • Recent history: c8a878c feat: support concrete release workspaces; 21270a1 feat(config): add release workspaces; 32f5462 fix(git): prevent fatal error for missing 'origin' remote (#871); 5d0ec43 fix(registry): retry registry push with backoff on concurrent updates (#870); 35e8063 meta: Bump new development version.
  • package.json: @sentry/craft version 2.31.0-dev.0; release target inferred/created as 2.31.0.
  • Node/Volta pin 24.18.0; pnpm 10.27.0.
• .github/workflows/release.yml:
  • Workflow name Release, ID 4152940, 76 total runs as of 17:40.
  • workflow_dispatch inputs: required version default 'auto'; optional force; optional workspace.
  • workflow_call accepts version, string force default 'false', merge_target, blocker_label default 'release-blocker', publish_repo, Git user settings, path default '.', workspace, craft_config_from_merge_target default 'false'.
  • Build job runs only for getsentry/craft, calls ./.github/workflows/build.yml; release needs build and runs if build succeeded/skipped.
  • Self-release gets release-bot token via actions/create-github-app-token@v3, checks out at v6 with full depth, and dogfoods local ./ action (craft-local).
• Release run 34258579011:
  • URL: https://github.com/getsentry/craft/actions/runs/34258579011
  • Successful on c8a878c53d937a62124796b39ac00f4d73212fe0.
  • Build / Node 22 job 102170534326: succeeded, 17:41:10Z–17:41:47Z.
  • Build / Node 24 job 102170534557: succeeded, 17:41:09Z–17:41:40Z.
  • Build / Build job 102170752544: succeeded, 17:41:52Z–17:42:16Z.
  • Build / Build Docs job 102170752557: succeeded, 17:41:50Z–17:42:13Z.
  • Release a new version job 102170912442: succeeded, 17:42:19Z–17:42:34Z; dogfooding prepare succeeded, normal external prepare skipped.
  • Release preparation made branch release/2.31.0, commit 55694f8bf3a0fd051e21a877f57b4c0dd8e946bb, and Publish issue #9454.

Publish initial Craft release failure

• Publish request #9454:
  • URL: https://github.com/getsentry/publish/issues/9454
  • Title: publish: getsentry/craft@2.31.0
  • Opened by @BYK; default merge target; comparison 2.30.1...release/2.31.0.
  • Targets: npm, gcs, registry, docker[release], docker[latest], github, gh-pages.
• First publishing workflow run:
  • Publish run 34259475611: https://github.com/getsentry/publish/actions/runs/34259475611
  • Triggered at 17:50:16, job Publish a new version 102173522513 ran 17:50:21Z–17:51:55Z and failed.
  • Steps 1–10 succeeded: setup; pull Craft latest; Publish checkout; Node; Yarn dependencies; input parsing; CI-approved revision resolution; start announcement; release-bot token; target checkout.
  • Resolve publish location step 11 failed at 17:51:48Z–17:51:49Z. Set targets/Publish using Craft then failed; Craft did not execute.
  • Completion/status update and failure comment succeeded; cancellation and close-on-success were skipped.
  • Issue ended OPEN with ci-ready only; accepted was removed by failure processing. Failure comment suggested deleting 2.31.0 branch and starting over only if branch was bad.
• Exact failed resolver behavior:
  • node .__publish__/src/publish/discover-location.js called with root path ".".
  • src/publish/discover-location.js:66:7 executed Docker Craft discovery because root __repo__/.craft.yml existed.
  • Docker command used getsentry/craft:latest workspace list.
  • The currently published Craft image printed CLI help then Unknown commands: workspace, list.
  • Therefore the release-bootstrap compatibility bug was in Publish workspace discovery versus old craft:latest, not Craft release preparation, release-branch CI, or Craft publishing itself.

Publish bootstrap hotfix: merged

• Worktree/branch:
  • New worktree /home/byk/Code/getsentry/publish-root-location-bootstrap.
  • Branch fix/root-location-bootstrap created Sep 8 17:55 from origin/main / 7c60ddb.
  • Fresh worktree initially lacked dependencies; yarn run vitest ... failed with error Command "vitest" not found.
  • yarn install v1.22.22 succeeded at 17:57 in 1.72s; emitted [DEP0169] url.parse() deprecation and Vitest’s established unmet Vite peer-dependency warning.
• Files changed:
  • src/publish/discover-location.js
  • src/publish/__tests__/discover-location.js
• Production change:
  • discoverLocation({ input, repositoryDirectory, exists, execFile }) now immediately returns { path: "." } when input.path === ".".
  • This prevents root checkout releases from calling getWorkspaceNames()/Docker craft workspace list.
  • Any non-root path still calls getWorkspaceNames({ repositoryDirectory, exists, execFile }) and propagates errors fail-closed.
• Tests added:
  • does not discover workspaces for the checkout root: mocked execFile would throw Error("workspace list is unavailable"); verifies root returns { path: "." } and execFile is never called.
  • fails closed when non-root workspace discovery is unavailable: for path: './packages/cli', root config present, a throwing execFile propagates and execFile is called exactly once.
• Development/audit sequence:
  • Fail-first root test initially failed: one of five tests; error propagated from test mock at src/publish/__tests__/discover-location.js:21 via getWorkspaceNames line 18 and discoverLocation line 53.
  • After root guard, focused test passed 5 tests, lint passed, generated parity passed, full suite passed 14 files / 95 tests.
  • First read-only audit at 18:02 returned DO-NOT-MERGE only for missing paired non-root propagation coverage; it verified implementation itself was correctly root-only at src/publish/discover-location.js:51 and non-root discovery continued at line 55.
  • Added paired non-root test; focused suite passed 1 file / 6 tests; lint, generated parity, full Vitest 14 files / 96 tests, and diff hygiene passed.
  • Attempt to stage .lore.md failed because no such file existed (fatal: pathspec '.lore.md' did not match any files); this did not affect the actual two-file fix.
• Commit/PR:
  • Commit 4f4b00f fix: bootstrap root publish locations, 2 files / 36 insertions, created Sep 8 18:10.
  • Pushed fix/root-location-bootstrap.
  • PR #9456 opened Sep 8 18:10: https://github.com/getsentry/publish/pull/9456
  • Exact head 4f4b00fa50a23294b058423032188a2846b086c4.
  • All 14 checks passed by 18:12: CodeQL action/javascript/aggregate; Dependency Review; Secret Scan; unit tests; Warden/workflow/aggregate/security-review; Cursor Bugbot; Seer Code Review; Socket Security project report/pull request alerts; Semgrep.
  • No reviews, review threads, bot findings, or unresolved issues; only REVIEW_REQUIRED self-approval gate remained.
  • Merged Sep 8 18:12:39Z as 44931fa501e457ee631fbd1234ab27f029eb4f8c.

Craft worktree: /home/byk/Code/getsentry/craft-workspace-action-propagation

• Completed and merged workspace implementation:
  • Branch feat/workspace-action-propagation.
  • Commit d48b906 feat: support concrete release workspaces, created Sep 5 03:34 and pushed 03:43, range 4862056..d48b906.
  • 9 files, 684 insertions / 44 deletions: action.yml; docs/src/content/docs/targets/github.md; src/__tests__/action.test.ts; src/__tests__/config.test.ts; src/commands/prepare.ts; src/config.ts; src/schemas/project_config.ts; src/utils/__tests__/publishState.test.ts; src/utils/publishState.ts.
• Terminology correction:
  • f174cea test: describe workspace paths accurately, committed/pushed Sep 8 16:03.
  • src/__tests__/config.test.ts renamed test from allows legacy workspace names to allows multi-segment workspace paths; behavior retained.
• Broken-symlink repair:
  • Cursor Bugbot finding at src/config.ts#L249-L260: globbed broken symlink hit realpathSync() before directory filter and threw ENOENT.
  • Initial broad catch { return false; } was rejected because it swallowed EACCES, EPERM, ELOOP, and unexpected I/O and did not prove glob emitted fixture.
  • Final commit fb1a705 fix: ignore broken workspace symlinks, exact head fb1a705a01277570bf8564477b37eb4d561d1967, committed/pushed Sep 8 17:26.
  • Changed only src/config.ts and src/__tests__/config.test.ts, 53 insertions / 1 deletion.
  • getWorkspaceGlobMatches() now skips only error.code === 'ENOENT', rethrowing all other realpath errors.
  • Tests prove globSync emits packages/broken, only packages/cli resolves, and unexpected ELOOP propagates.
  • Craft PR #872 merged as c8a878c53d937a62124796b39ac00f4d73212fe0.
• Important implementation:
  • loadConfigurationFromString(configContent, workspaceDirectory = process.cwd()); config-from resolves against Git top-level.
  • src/config.ts:210-229: duplicate pattern matches throw ConfigurationError: Workspace "${workspaceName}" matches multiple workspace patterns: ${matchingKeys.join(', ')}.
  • getWorkspaceGlobMatches() uses globSync(... { absolute: false, cwd: root, dot: true, ignore: ['**/node_modules/**'], posix: true }), then safe lexical/realpath directory checks and sorted output.
  • isWorkspacePattern() uses hasMagic(... { magicalBraces: true }).
  • isVersionGteMinVersion() is pure/config-safe and false for absent/unparseable versions.
  • Workspace schema allows release-unit fields and partial GitHub inheritance, but rejects github.projectPath.
  • action.yml validates before side effects, clears inherited CRAFT_WORKSPACE, and emits exact full titles.
  • publishState.ts preserves workspace/version identity losslessly.
• Verification:
  • Sep 4 full Vitest: 61 files / 1197 passed / 1 skipped.
  • Sep 8 hardened repair: 61 files / 1199 passed / 1 skipped / 1200 total, plus typecheck/lint/format/build/diff checks.
  • ESLint had 0 errors and 7 established unused-variable warnings in src/commands/publish.ts and src/utils/git.ts.
  • Build skipped source-map upload absent SENTRY_AUTH_TOKEN.
  • Existing Vite/esbuild SSR warnings and cached-ref remote fetch warnings remained nonblocking.
• Craft review status:
  • All final checks were green before merge: Build/Test Node 22/24, Build, Docs, CodeQL, Dependency Review, Docs Preview, license, Lint, Secret Scan, Warden/security review/image, Cursor Bugbot, Seer, Socket, Semgrep.
  • GitHub reported 9 Craft default-branch vulnerabilities Sep 8 17:26: 7 high, 1 moderate, 1 low: https://github.com/getsentry/craft/security/dependabot.

Publish worktree: /home/byk/Code/getsentry/publish-workspace-acceptance

• Publish PR #9339:
  • Former branch feat/workspace-acceptance.
  • Final head fd1e1156ae878a12a276af401a15a656bfff8127.
  • Admin-squash merged Sep 8 17:37 as 7c60ddb7f43040fe8fbfea70efc833f689c04e75.
• Earlier commits: b658ffa fix: validate publish workspace JSON, 52ef600 feat: resolve compact workspace publish requests, a81ab03 feat: resolve workspace publish paths.
• Review-fix commit:
  • fd1e115 fix: address publish workspace review feedback, committed/pushed Sep 8 13:01.
  • 21 files, 1,509 insertions / 96 deletions.
  • New: src/modules/__tests__/ci-poller-workflow.js; src/modules/__tests__/generate-publish-issue-title-parser.js; src/publish/__tests__/discover-location.js; src/publish/__tests__/resolve-location.js; src/publish/__tests__/resolve-release-revision.js; src/publish/discover-location.js.
  • Modified: .github/workflows/ci-poller.yml; .github/workflows/publish.yml; docs/publish-issue-format.md; generator/parser/revision modules; Publish input/location/revision scripts.
• Preserved behavior:
  • publish-location.js validates safe locations; invalid workspace discovery error: Craft workspace discovery returned an invalid workspace list.
  • Title fields are validated before state/checkout/Craft/network/cross-repository actions.
  • Publish gate remains fresh ci-ready, accepted + ci-ready, open issue, no pending/failed labels, 90-minute timeout.
  • Exact target checkout uses approved SHA at __repo__, Release Bot, full history; Craft receives publish ... --rev.
  • workflow_dispatch remains in CI poller with internal optional attempt default "0".
• Original workspace discovery implementation:
  • getWorkspaceNames() returned [] if no root .craft.yml; otherwise Docker runs getsentry/craft:latest workspace list.
  • Parses only valid JSON arrays; malformed/blank/non-array/unsafe results fail closed.
  • This implementation is now supplemented by root-only early return in hotfix 44931fa.
• Publish verification/audits:
  • Sep 8 03:56 lint/generated/full 14 files/92 tests/diff check passed.
  • Sep 8 04:02 audit found poller response coverage gap; fixed.
  • Sep 8 04:03 focused poller 6 tests passed; full 14 files/94 passed.
  • Sep 8 04:14–04:15 final audit MERGE.
  • All #9339 CI/security checks green before merge.
• Tooling: Volta Node 24.0.0, Yarn 1.22.22; test = yarn check:generated && vitest run; lint = eslint src .github --ignore-pattern '!.github'; Git worktree, not jj.
• GitHub reported 22 Publish default-branch dependency vulnerabilities: 12 high, 8 moderate, 2 low: https://github.com/getsentry/publish/security/dependabot.

Session Timeline

• Sep 3–5, 2026:
  • Implemented Craft concrete workspace behavior and Publish canonical path-only title/location behavior.
  • Craft d48b906 created Sep 5 03:34/pushed 03:43; Publish a81ab03 created Sep 5 03:40/pushed 03:46.
  • Sep 5 02:05 evidence audit returned MERGE.
• Sep 5 13:10–Sep 8 04:15:
  • Addressed Publish #9339 feedback; implemented Peggy authority/body preservation, JSON handoff, fail-closed discovery, workflow changes, and test coverage.
  • Final Publish review audit at Sep 8 04:14–04:15 returned MERGE.
• Sep 8 12:56–17:39:
  • Pushed Publish review repairs (fd1e115); corrected Craft terminology (f174cea); fixed Craft broken-symlink glob handling (fb1a705) after one DO-NOT-MERGE audit and hardened re-review.
  • User authorized admin merges at 17:34.
  • Publish #9339 merged 17:37 as 7c60ddb.
  • Craft #872 merged 17:39 as c8a878c.
• Sep 8 17:40–17:45:
  • Fetched Craft master to c8a878c; inspected release.yml and version 2.31.0-dev.0.
  • Dispatched established self-release workflow with version=auto.
  • Release run 34258579011 succeeded, prepared release/2.31.0 at 55694f8, and created Publish request #9454.
  • #9454 was accepted at 17:46; controller entered ci-pending.
• Sep 8 17:47–17:51:
  • Release branch Build & Test passed; image was final running check.
  • Once release-branch CI completed, controller emitted fresh ci-ready and started Publish run 34259475611.
• Sep 8 17:52–17:53:
  • Publish run 34259475611 failed before Craft ran at Resolve publish location.
  • Logs showed old getsentry/craft:latest did not support workspace list.
  • Determined root path "." cannot select a workspace, allowing a narrowly scoped bootstrap fix while retaining non-root fail-closed behavior.
• Sep 8 17:54–18:03:
  • Created fix/root-location-bootstrap from 7c60ddb.
  • Installed fresh-worktree Yarn dependencies after initial vitest command-not-found.
  • Wrote fail-first root regression; confirmed current controller eagerly attempted discovery.
  • Implemented root-only early return in discoverLocation().
  • First audit required paired non-root failure-propagation test; added it.
  • Final verification: focused 6 tests, lint, generated parity, full 14 files / 96 tests, diff hygiene.
• Sep 8 18:07–18:13:
  • Explained Craft release had prepared but failed during Publish bootstrap compatibility.
  • Committed hotfix 4f4b00f, pushed, and opened Publish PR #9456.
  • At 18:12 all 14 checks were green with no findings/threads; admin-squash merged it at 2026-09-08T18:12:39Z as 44931fa.
• Sep 8 18:14–18:16:
  • Re-added accepted to recover #9454 through normal controller behavior.
  • Controller revalidated release-branch CI, emitted fresh ci-ready, and started recovery Publish run 34261921633.
  • At 18:16 recovery was in progress; Craft 2.31.0 publication/release artifact still needed final verification.