Distillation

🔴 (10:23) yarn prettier --write src --check . ran under Yarn v1.22.22; formatting check warned on exactly 2 files, .lore.md and AGENTS.md, reported Code style issues found in 2 files., and completed in 1.73s.

🔴 (10:23) Current /home/byk/Code/getsentry/publish/src/modules/details-from-context.js is 75 lines and uses PUBLISH_TITLE_REGEX = /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/; parsePublishTitle(title) returns matched groups or null; detailsFromContext() rejects absent issue context and invalid titles, maps dry-run to dry_run: "1", prefixes title paths with ., extracts merge targets via /^Merge target: (?<merge_target>[\w.\-/]+)$/m, extracts checked targets, and exports detailsFromContext, TARGETS_SECTION_PARSER_REGEX, TARGETS_PARSER_REGEX, CHECKED_TARGETS_PARSER_REGEX, parsePublishTitle, and PUBLISH_TITLE_REGEX.

🔴 (10:23) File lookup failed exactly with File not found: /home/byk/Code/getsentry/publish/src/publish/__tests__/ACLE_PLACEHOLDER.

🔴 (10:23) File lookup failed exactly with File not found: /home/byk/Code/getsentry/publish/src/publish/__tests__/ciодаря.

🔴 (10:24) File lookup failed exactly with File not found: /home/byk/Code/getsentry/publish/src/publish/__tests__/ci-pollerlass.

🔴 (10:26) Upstream origin/main / origin/HEAD pointed to commit 7c60ddb7f43040fe8fbfea70efc833f689c04e75 (feat: accept workspace publish requests), authored by Burak Yigit Kaya <byk@sentry.io> on Sep 8, 2026 at 18:37:21 +0100 and committed by GitHub <noreply@github.com> at 17:37:21 +0000. The commit changed exactly 32 files with 3257 insertions(+) and 115 deletions(-).

🔴 (10:26) Commit 7c60ddb7f43040fe8fbfea70efc833f689c04e75 summary: parse and validate workspace-qualified publish-request titles; propagate the selected workspace into Craft; isolate secure publish-resume state by workspace; and restore failed-target state only from the workflow-created XDG state file. Reported validation was pnpm test: 6 files, 25 tests passed, focused workflow-state regression 3 files, 18 tests passed, plus passing Prettier and changed-file ESLint. Deployment order requires deploying this controller before Craft PR #872.

🔴 (10:26) Commit 7c60ddb7f43040fe8fbfea70efc833f689c04e75 changed .github/workflows/publish.yml to use actions/checkout@v7, add Resolve CI-approved release revision via src/publish/resolve-release-revision.js, checkout the target repository at ${{ steps.release-revision.outputs.revision }}, discover the publish location with src/publish/discover-location.js, pass CRAFT_PUBLISH_WORKSPACE/CRAFT_WORKSPACE, invoke craft publish ... --rev ${{ steps.release-revision.outputs.revision }}, and set CRAFT_PUBLISH_STATE_GITHUB_REPO from the issue checkout identity rather than an optional workspace release-repository override.

🔴 (10:26) Commit 7c60ddb7f43040fe8fbfea70efc833f689c04e75 replaced manual publish-path concatenation with realpath -m "/github/workspace/__repo__/$CRAFT_PUBLISH_PATH" and rejects resolved paths outside /github/workspace/__repo__. Craft state filenames became publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${workspace_prefix}${version_component}.json; changed version strings are URL-safe base64 encoded as version-${version_encoded}, workspaces are URL-safe base64 encoded as workspace-${workspace_encoded}-, and the generated path is emitted as state_file to $GITHUB_OUTPUT for CRAFT_STATE_FILE_PATH.

🔴 (10:26) In upstream commit 7c60ddb, src/modules/details-from-context.js replaced its title regex with generated parsePublishIssueTitle, validates repositories using isPublishRepository(), versions using isReleaseVersion(), paths using isPublishPath(), and obtains the canonical merge target through getReleaseRevisionDetails(). Added tests cover canonical-header merge-target selection over a later decoy, concrete workspace path ./packages/cli, rejection of an unexpected pre-version space, checkout-escaping ../, current-directory /./, unsafe repository identities -toolkit, ., .., and __proto__, invalid versions --config and 1.2, and version path syntax such as 1.2.3/other.

🔴 (10:27) /home/byk/Code/getsentry/publish/src/publish/__tests__/ci-poller-workflow.js contains exactly 3 workflow tests: (1) trusted default-branch checkout must occur before Get auth token; (2) manual recovery must use a protected workflow_dispatch relay whose main poller is triggered by repository_dispatch type ci-poller and successful default-branch workflow_run, while the relay has permissions: {}, environment: production, no secrets., and no repository_dispatch:; (3) repository-dispatch attempts must be validated before app-token creation with regex ^(0|[1-5][0-9])$, base-10 increment attempt=$((10#$ATTEMPT + 1)), and dispatch via gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input -.

🔴 (10:29) /home/byk/Code/getsentry/publish/.github/workflows/ci-poller-dispatch.yml is a 16-line workflow named Run CI Status Poller, triggered by workflow_dispatch, with permissions: {} and one dispatch job using environment: production, runs-on: ubuntu-latest, and a sole run: ":" step.

🔴 (10:29) User’s workflow security directive is exact: repository secrets must “never be used by this workflow; protected environment secrets enforce that an arbitrary dispatched ref cannot add them.” The production environment only permits deployments from main.

🔴 (10:29) Working-tree comparison reported exactly 44 files changed, 557 insertions(+), 3317 deletions(-). Modified files were .github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, docs/key_rotation_vault_changes.md, docs/rfc.md, package.json, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, src/publish/update-issue.js, and yarn.lock.

🔴 (10:29) Working-tree deleted files were docs/publish-issue-format.md, scripts/generate-publish-issue-title-parser.js, src/modules/__tests__/ci-poller-input.js, src/modules/__tests__/ci-poller-workflow.js, src/modules/__tests__/generate-publish-issue-title-parser.js, src/modules/__tests__/publish-location.js, src/modules/__tests__/publish-workflow.js, src/modules/__tests__/release-revision.js, src/modules/ci-poller-input.js, src/modules/publish-issue-title.js, src/modules/publish-issue-title.peggy, src/modules/publish-issue-validation.js, src/modules/publish-location.js, src/modules/release-revision.js, src/publish/__tests__/discover-location.js, src/publish/__tests__/resolve-location.js, src/publish/__tests__/resolve-release-revision.js, src/publish/discover-location.js, src/publish/resolve-ci-poller-input.js, src/publish/resolve-location.js, and src/publish/resolve-release-revision.js.

🔴 (10:29) /home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js is 109 lines. recordCiReadyAttestation() concurrently retrieves the issue, events, and authenticated login; rejects if the issue is not open, its title changed, accepted is absent, no current accepted event exists, or expected actor/event ID differs; then calls createCiReadyAttestation({ acceptedEvent, ciReadyActor, issue }). main() requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, and APPROVAL_ISSUE_TITLE, optionally binds EXPECTED_ACCEPTED_ACTOR plus EXPECTED_ACCEPTED_EVENT_ID, and appends exactly ci_ready_attestation=${attestation}\n to GITHUB_OUTPUT.

🔴 (10:30) The repository production environment has deployment_branch_policy.custom_branch_policies: true, deployment_branch_policy.protected_branches: false, and one branch_policy protection rule with ID 42720759 and node ID GA_kwDOEgGvjc4Ci933.

🔴 (10:30) Repository Actions defaults are default_workflow_permissions: "write" and can_approve_pull_request_reviews: true.

🔴 (10:30) An attempt to configure allowed Actions/reusable workflows returned HTTP 409 Conflict with All actions and workflows are allowed on this repository and documentation URL https://docs.github.com/rest/actions/permissions#get-allowed-actions-and-reusable-workflows-for-a-repository.