Distillation

Date: Aug 29, 2026

• 🟡 (09:30) Docker successfully pulled getsentry/craft:2.30.1 locally, digest sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b. Running Craft without a project configuration failed with Error: Cannot find Craft configuration file. Have you added ".craft.yml" to your project?; Node emitted deprecation warnings DEP0040 for punycode and DEP0169 for url.parse().
• 🟡 (09:31) Assistant stated getsentry/craft:2.30.1 is locally available and intended to verify its actual --rev behavior, tightening controller boundaries only if the older image satisfies the CI-pinned-revision contract.
• 🔴 (09:32) User-provided task status: “Verify immutable legacy Craft image compatibility with CI-pinned revisions” is in progress, high priority.
• 🔴 (09:32) User-provided task status: “Harden compact title parser and location resolution boundaries,” “Run full cross-repository verification,” and “Obtain adversarial review and update linked PRs” are pending, high priority.
• 🔴 (09:32) User-provided task status: “Document workspace migration” is pending, low priority.
• 🟡 (09:33) Assistant stated it would complete remaining compatibility and regression checks while an independent review runs, would not alter the reviewer’s scope, and would apply concrete findings before committing or updating either PR.
• 🔴 (09:35) Repository AGENTS.md states this is the Sentry Publish Repository: a GitHub Actions-based approval system for publishing releases across Sentry projects using Craft; it is pure CommonJS JavaScript targeting Node.js 24.0.0.
• 🔴 (09:35) Repository convention: use Yarn Classic 1.22.22 via Volta as pinned in package.json; do not use npm. Commands are yarn install, yarn test, yarn test:watch, yarn test src/modules/__tests__/update-issue.js, yarn test -t "pattern", yarn lint, and yarn prettier.
• 🔴 (09:35) Repository source layout: src/libs/ holds shared utilities, src/modules/ reusable core business logic, and src/publish/ GitHub Actions entry points; tests reside in __tests__/ subdirectories.
• 🔴 (09:35) Repository code conventions: kebab-case file names; test file names match source names under __tests__/; camelCase variables/functions; UPPER_SNAKE_CASE constants/regexes; CommonJS require/module.exports source modules; ES Modules test files; import order is Node built-ins, external packages, then local modules.
• 🔴 (09:35) Repository formatting convention: default Prettier, double-quoted strings, required semicolons, and run yarn prettier before committing.
• 🔴 (09:35) User directive/repository guideline: throw descriptive errors with context and potential fixes; validate inputs early with guard clauses.
• 🔴 [enforced-error-handling] (09:35) User directive/repository guideline: always throw for unexpected values, including a default switch branch such as throw new Error(\Unknown status: '${status}'`)`.
• 🔴 (09:35) Repository guideline: check file existence before reading, e.g. if (!fs.existsSync(CRAFT_STATE_FILE_PATH)) { return; }.
• 🔴 (09:35) Repository testing uses Vitest v4.0.0 with globals enabled; mocks auto-clear between tests. Tests may use vi.mock(...), and modules under test should be imported after mocks.
• 🟡 (09:36) Assistant claimed full verification had passed before the independent review began; it would inspect only repository state and deployment preconditions while awaiting review results, without duplicating correctness analysis.
• 🟢 (09:37) File search returned “No files found.”
• 🔴 (09:40) Working tree has modified files: .github/workflows/publish.yml, docs/publish-issue-format.md, package.json, src/modules/__tests__/publish-workflow.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/publish/inputs.js, and yarn.lock.
• 🔴 (09:40) Working tree has untracked files/directories: pnpm-lock.yaml, scripts/, src/modules/__tests__/publish-location.js, src/modules/__tests__/release-revision.js, src/modules/publish-issue-title.js, src/modules/publish-issue-title.peggy, src/modules/publish-location.js, src/modules/release-revision.js, src/publish/resolve-location.js, and src/publish/resolve-release-revision.js.
• 🔴 (09:40) Diffstat reports 8 tracked files changed, with 145 insertions and 65 deletions: .github/workflows/publish.yml (62 lines), docs/publish-issue-format.md (55), package.json (4), src/modules/__tests__/publish-workflow.js (38), src/modules/details-from-context.js (16), src/modules/post-workflow-details.js (2), src/publish/inputs.js (2), and yarn.lock (31).
• 🔴 (09:40) New Craft requests always include the checkout repository identity.
• 🔴 (09:40) Root workspace releases use one trailing path segment as the workspace name; Craft rejects a workspace paired with a non-root checkout path.
• 🔴 (09:40) New-title workspace names must match ^[A-Za-z0-9_.-]+$; Craft preserves their exact spelling and the controller never normalizes names.
• 🔴 (09:40) Controller behavior: it resolves a one-segment suffix only after checking out the exact CI-approved revision from the View check runs link. If that checkout has root .craft.yml, craft workspace list supplies exact workspace keys; an exact matching suffix is a workspace, every other suffix is a checkout path.
• 🔴 (09:40) Controller behavior: a missing root .craft.yml always means checkout-path behavior; discovery errors when root configuration exists fail the release.
• 🔴 (09:40) Existing JSON-qualified workspace titles remain supported for compatibility, but Craft does not create them. Legacy workspace titles require one space after ] before @; unqualified titles have no space before @.
• 🔴 (09:40) Publish-title parsing keeps getsentry/ optional for existing issues; paths must not contain a .. segment. Legacy JSON workspace strings must decode to nonempty names without Unicode control (Cc), format (Cf), line-separator (Zl), or paragraph-separator (Zp) characters.
• 🟡 (09:40) Workflow tests in src/modules/__tests__/publish-workflow.js changed getSetTargetsScript() to obtain YAML via getWorkflow() and now match controller Craft image docker://getsentry/craft:2.31.0; tests also assert CRAFT_PUBLISH_WORKSPACE: ${{ fromJSON(steps.location.outputs.result).workspace || '' }} and craft publish ${{ fromJSON(steps.inputs.outputs.result).version }} --rev ${{ steps.release-revision.outputs.revision }}.
• 🟡 (09:40) src/modules/details-from-context.js now parses issue titles through parsePublishIssueTitle(context.payload.issue.title), converts parser failures into Invalid publish issue title: '<title>', extracts { workspace: workspaceJson, ...parsedTitleDetails }, and computes path as "." + parsedTitleDetails.path before rejecting paths containing ...