Distillation

Date: Sep 4, 2026

• 🔴 (20:09) User stated that new Craft publish requests always include the checkout repository identity.
• 🔴 (20:09) User stated that a missing root .craft.yml always means checkout-path behavior.
• 🔴 (20:09) User stated that the controller never normalizes publish-location names.
• 🟡 (20:09) Read-only diff output for /home/byk/Code/getsentry/publish-workspace-acceptance showed modified .github/workflows/publish.yml, docs/publish-issue-format.md, src/modules/ci-poller-input.js, src/modules/details-from-context.js, and src/publish/resolve-location.js, among other elided files.
• 🟡 (20:09) Diff changes the issue-title convention: a workspace release title suffix is the workspace’s full concrete path rather than a one-segment workspace name; example reflected in tests is publish: getsentry/toolkit/packages/cli@1.2.3.
• 🟡 (20:09) Diff documentation states repository identities must satisfy the safe-token rule: only [A-Za-z0-9_.-]+, and cannot be ., .., __proto__, or begin with -.
• 🟡 (20:09) Diff documentation states versions must be valid Craft semantic versions and that build metadata such as 4.2.6+sentry1 is valid.
• 🟡 (20:09) Diff documentation states the controller checks out the exact CI-approved revision from the View check runs link before resolving the complete publish-title suffix; with a root .craft.yml, craft workspace list supplies exact concrete workspace paths, an exact suffix match is treated as a workspace, and every other suffix remains a checkout path.
• 🟡 (20:09) Diff documentation states workspace discovery errors fail the release when the checkout has a root .craft.yml.
• 🟡 (20:09) Diff documentation changes release triggering: the accepted label starts CI waiting; publishing starts only when the CI poller adds a fresh ci-ready label to an open accepted issue with neither ci-pending nor ci-failed; dry-run still requests dry-run mode.
• 🟡 (20:09) Diff test additions reject unsafe publish paths ./., ./.., and ./packages/../other with Invalid publish path.
• 🟡 (20:09) Diff test changes call resolvePublishLocation({ path: "./packages/cli", workspaceNames: ["cli-日本語"] }) and expect Craft workspace discovery returned an invalid workspace list; added invalid discovered workspace-path cases include packages/__proto__/cli.
• 🟡 (20:09) Diff removes legacy JSON-qualified workspace-title parsing and associated validation tests, including empty workspace names and names containing newline/NUL-style unsafe content.
• 🟡 (20:09) Read-only file output showed src/modules/publish-issue-validation.js defines isPublishRepository(name) using /^[A-Za-z0-9_.-]+$/, rejecting ., .., __proto__, and names beginning with -.
• 🟡 (20:09) Read-only file output showed src/modules/publish-issue-validation.js defines isReleaseVersion(version) with a case-insensitive semantic-version regex accepting major.minor.patch, optional prerelease identifiers, and optional + build metadata identifiers; exports are module.exports = { isPublishRepository, isReleaseVersion };.